Advance DDOS Tools: Encrypted Layer Attacks and Server-Based Botnets

Application security solutions provider Radware has released its 2012 Global Application and Network Security Report. According to the study, distributed denial-of-service (DDOS) attacks are becoming more sophisticated and more severe.

In addition, cybercriminals have started deploying new attack tools, such as server-based botnets and encrypted layer attacks, to make their campaigns more effective.

While server-based botnets make the attacks more powerful, by weaponizing the encryption layer, cybercriminals can ensure that their operations escape detection and remain hidden.

The recent DDOS attacks launched by Izz ad-Din al-Qassam Cyber Fighters against US banks are a perfect example of how efficient these new tools are.

Besides the new attack tools, the report also highlights the fact that the number of DDOS and DOS attacks lasting more than one week doubled in 2012.

On the other hand, organizations are still not investing enough resources to ensure that they’re protected against such attacks.

While it’s becoming more and more difficult for organizations to protect their networks against cyberattacks, cybercriminals can turn to all sorts of relatively cheap services and kits that can help them achieve their goals.

“The Radware ERT sees hundreds of DoS/DDoS attacks each year, and we’ve found attacks lasting more than one week have doubled in frequency during 2012. Through empirical and statistical research coupled with front-line experience, our team identified trends that can help educate the security community,” noted Avi Chesla, chief technology officer at Radware.

“Through highlighting significant trends found in this report, our goal is to provide actionable intelligence to ensure organizations can better detect and mitigate these threats that plague their network infrastructure.”

The complete report is available here.

Cloud Data Storage Providers that Offers Freemium Service

Probably you've got important documents, videos, music or other stuffs that needs to be shared across multiple devices, using cloud storage technology is for now the easiest option you've got and the number of people it are increasingly by day.

Cloud Storage has come to say and with so many cloud service providers, you may be wondering which one could be right for you. The list below will help you based on general summary of each popular cloud service.

First, let look at what cloud storage is for the benefit of those that don't know what it is. According to wikipedia

Cloud storage is a model of networked online storage where data is stored in virtualized pools of storage which are generally hosted by third parties. Hosting companies operate large data centers, and people who require their data to be hosted buy or lease storage capacity from them. The data center operators, in the background, virtualize the resources according to the requirements of the customer and expose them as storage pools, which the customers can themselves use to store files or data objects. Physically, the resource may span across multiple servers.The safety of the files depends upon the hosting websites.
Cloud storage services may be accessed through a web service application programming interface (API), a cloud storage gateway or through a Web-based user interface.

1. Mega

Mega is a cloud storage provider and successor to Megaupload. The website was launched on 19 January 2013 to coincide with the one-year anniversary of the seizure of Megaupload. After the Gabonese Republic denied the new company the domain name me.ga, Kim Dotcom, the don in-charge announced it would instead be registered in his adopted home of New Zealand under the domain name mega.co.nz.

Currently, free users will get 50 GB of free storage space and total bandwidth will be limited, from 1 to 8 TB per month, for paid accounts. Free account bandwidth is not currently disclosed.

2. SkyDrive

SkyDrive (officially Microsoft SkyDrive, previously Windows Live SkyDrive and Windows Live Folders) is a file hosting service that allows users to upload and sync files to a cloud storage and then access them from a Web browser or their local device. It is part of the Windows Live range of online services and allows users to keep the files private, share them with contacts, or make the files public. Publicly shared files do not require a Microsoft account to access.

The service offers 7 GB of free storage for new users. Additional storage is available for purchase. Users who signed up to SkyDrive prior to April 22, 2012 could opt-in for a limited time offer of 25 GB of free storage upgrade. The service is built using HTML5 technologies, and files up to 300 MB can be uploaded via drag and drop into the web browser, or up to 2 GB via the SkyDrive desktop application for Microsoft Windows and OS X.

3. Google Drive

Google Drive is a file storage and synchronization service by Google that was released on April 24, 2012. Google Drive is now the home of Google Docs, a suite of productivity applications, that offer collaborative editing on documents, spreadsheets, presentations, and more. Rumors about Google Drive began circulating as early as March 2006.

Google Drive gives all users 5 GB of cloud storage to start with. A user can get additional storage, which is shared between Picasa and Google Drive, from 25 GB up to 16 TB through a paid monthly subscription plan ($2.49 US per month for 25 GB).

4. Box

Box Inc. (formerly Box.net) is an online file sharing and Cloud content management service for enterprise companies. The company has adopted a freemium business model, and provides 5 GB of free storage for personal accounts. A mobile version of the service is available for Android, BlackBerry, iPhone, iPad, WebOS, and Windows Phone devices. The company is based in Los Altos, California.

5. MediaFire

MediaFire is a free file and image hosting web site that started in 2005 and is located in Shenandoah, Texas, United States. MediaFire include 50 GB of cloud storage and a limit of 200 MB per file (250 GB of storage and 4GB of file size limit for Pro users and 1000 GB of storage and 10 GB of file size limit for Business users).MediaFire provides users with the ability to create image galleries from folders of images and view and share common document, presentation, and spreadsheet file types inside the web browser. MediaFire's free account service does not require download activity in order to preserve files, and is thus often suitable as a temporary or secondary backup solution although MediaFire does not officially support free data warehousing (long-term storage for inactive accounts).

Android Botnet Infects Over 1 Million Phones in China

A piece of mobile malware believed to be hidden in around 7,000 Android applications has infected the devices of over 1 million users from China. Experts say that this may be the largest Android botnet the country has ever seen.

According to Chinese publication Xinhua, the Trojan that powers the botnet is Android.Troj.mdk, a threat first discovered back in 2011.

Once it’s installed on a device, the Trojan allows its master to take complete control of it. The malicious element can be used to harvest messages, phone numbers, contact details, geo-location data and even media files.

Bitdefender experts note that the Trojan also downloads additional applications that slow down the phone’s performance, generate aggressive adware, and drain the device’s battery.

With over 420 million mobile users, China has become an important target for malware developers.

Top 5 Best Free VPN Service Providers 2013

If you're of the mindset that what you do with your BitTorrent client is your business and not that of people snooping, sniffing, and prying at your packets along the way, then you'll need a VPN to keep your traffic encrypted and secure. Even so, which free VPN service is the best, and which offers the best combination of reliability, features, security, and affordability? We'll be looking at the top five free VPN service providers based on our test.

1. SecurityKiss

SecurityKiss is a popular free VPN service available for use on PCs only. The paid version available for use on Mac, Linux, and smartphones.

The free package includes a 300MB daily limit, and an unspecified bandwidth speed cap of less than 12.5 Mbps, and basic packages start at about $6 per month.

Software installation is required.

2. Its Hidden

ItsHidden uses 128-bit encryption on the secure tunnel created between you and the ItsHidden servers. Based out of the Netherlands, ItsHidden takes advantage of the legal climate there and doesn't log any activity passed through its servers.

Available on Mac, PC, and Linux, and requires no software installation.

3. CyberGhost

CyberGhost VPN is a free utility that encrypts, anonymizes, and offshores your internet use when you're using public Wi-Fi at an airport or coffee shop, or you're worried someone on your network is running a tool like Firesheep to gather credentials

Cyber Ghost is limited to PCs only, and software installation is required.

4. Hotspot Shield

Hotspot Shield is a free program that allows you to secure your connection while surfing WiFi hotspots and to access sites not normally available outside of the USA, like Huluand Pandora.

Everything is done in an extra tab open in your browser, so there's no need to configure anything. A green and red shield in your system tray indicates when Hotspot Shield is or is not connected. The VPN is encrypted with 128 bit SSL encryption so you can surf safely without worrying about others intercepting your data.

It works on Mac and PCs along with Android and iOS devices.

5. Your Freedom

Your Freedom services makes accessible what is unaccessible to you, and it hides your network address from those who don't need to know. Just download the client application and install or just run it on your PC; it turns your own PC into an uncensored, anonymous web proxy and an uncensored, anonymous SOCKS proxy that your applications can use, and if that's not enough it can even get you connected to the Internet just as if you were using an unrestricted DSL or cable connection -- just like the firewall suddenly went boom! You can even make your PC accessible from the Internet if you like.

Hackers Develops Start Button for Windows RT Tablets

The lack of a Start button in Windows 8 is considered one of the main reasons why people choose to stay away from the new operating system, but several third-party solutions are now available in this regard.

A Start button application is now available on Windows RT too, allowing consumers to make their tablets a bit less confusing in case they can’t get used to the new Modern UI.

The ClassicStartMenu app posted on XDA Developers forum is available for Windows RT users who have decided to jailbreak their devices and is based on the popular Classic Shell application compatible with the desktop version of Windows 8.

Keep in mind that this application requires a jailbroken Windows RT tablet and it doesn’t ask for a reboot. In case you restart your device, the jailbreak is completely lost.

Click here to download ClassicStartMenu for Windows RT (the file is delivered as a ZIP package, so a compression tool for Windows RT is needed).

For more information on the Windows RT jailbreak, check out this article.

Foxit Reader Vulnerable to Critical Remote Code Execution Flaw

Foxit Reader, a PDF viewer application often used as an alternative to the more popular Adobe Reader, contains a critical vulnerability in its browser plug-in component that can be exploited by attackers to execute arbitrary code on computers.

Details about the vulnerability and how it can be exploited were publicly disclosed last week by Andrea Micalizzi, an independent security researcher from Italy.

No official patch is yet available, according to an advisory from vulnerability intelligence and management company Secunia. The security firm rated the flaw as highly critical because it can be exploited remotely to gain system access.

Foxit's developers have identified the cause of the vulnerability and are working on creating a patch, a Foxit sales and service representative said Friday via email. The patch is expected to be released within one week, she said.

"The vulnerability is caused due to a boundary error in the Foxit Reader plugin for browsers (npFoxitReaderPlugin.dll) when processing a URL and can be exploited to cause a stack-based buffer overflow via e.g. an overly long file name in the URL," Secunia said. "Successful exploitation allows execution of arbitrary code."

The vulnerability has been confirmed in npFoxitReaderPlugin.dll version 2.2.1.530, which is installed by Foxit Reader 5.4.4.1128—the latest version of the program. However, older versions might also be affected, Secunia said.

By default, Foxit Reader installs the plug-in for Mozilla Firefox, Google Chrome, Opera, and Safari Web browsers.

Reputation as secure alternative reader
In the past, Foxit Reader has been suggested by some people in the security community as a more secure and less attacked alternative to Adobe Reader. In fact, Foxit, the company that develops the application, claims on its website that Foxit Reader is "the most secure PDF reader" and is "better than Adobe PDF Reader and Acrobat." According to the company, the program is used by over 130 million users.

"We have confirmed the vulnerability using Firefox, Opera, and Safari," Chaitanya Sharma, advisory team lead at Secunia, said Thursday via email. "At the moment the best mitigation is to disable this add-on in browsers and use other software e.g. Adobe Reader."

The Foxit representative, too, recommended avoiding using the Foxit browser plug-in for Firefox, Chrome, Opera or Safari, but instead suggested using Internet Explorer to view online PDF files.

EVMBME6EJAKF

Lithuanian Online Game Site Miestukarai Hacked, 24,000 Users Data Leaked

A hacker called AnonVoldemort claims to have gained access to the databases of Miestukarai.lt, a Lithuanian online game that appears to have almost 35,000 players.

In the tweet announcing the hack, AnonVoldemort revealed that he had leaked over 24,000 accounts, both free and premium.

The data has been removed since from Pastebin. It’s possible that the site’s administrators have learned of the leak and have requested Pastebin to remove the information.

However, according to CWN – who had analyzed the leak before it was removed –, usernames, email addresses, IP addresses and hashed passwords were published by the hacker.

If there are any Miestukarai players reading this, I advise them to immediately change their passwords. Not only the ones protecting their game accounts, but all the passwords that are the same with the one leaked by the hacker.

Anonymous hacks MIT after Aaron Swartz's Suicide

On Sunday, the official site of the Massachusetts Institute of Technology (MIT) went offline. On a couple of the website’s subdomains, Anonymous hackers published a message in memory of Aaron Swartz, the Reddit co-founder and activist who recently committed suicide.

“Whether or not the government contributed to his suicide, the government's prosecution of Swartz was a grotesque miscarriage of justice, a distorted and perverse shadow of the justice that Aaron died fighting for […],” the hacktivists wrote on the defaced pages.

“Moreover, the situation Aaron found himself in highlights the injustice of U.S. computer crime laws, particularly their punishment regimes, and the highly-questionable justice of pre-trial bargaining. Aaron's act was undoubtedly political activism; it had tragic consequences,” they added.

The hackers ask the government to “reform” computer crime and copyright and intellectual property laws.

“We call for this tragedy to be a basis for greater recognition of the oppression and injustices heaped daily by certain persons and institutions of authority upon anyone who dares to stand up and be counted for their beliefs, and for greater solidarity and mutual aid in response,” they wrote.

“We call for this tragedy to be a basis for a renewed and unwavering commitment to a free and unfettered internet, spared from censorship with equality of access and franchise for all.”

They concluded their statement by apologizing to MIT administrators for temporarily taking over the website.

MIT has ordered an internal investigation into the case of Swartz. Furthermore, JSTOR – the digital library that accused him of illegally downloading content – has released its own statement regarding Swartz’s death.

At the time of writing, the main MIT site appeared to be working properly. The subdomains that hosted the hacktivists’ message have been taken offline.

In the meantime, a petition to remove United States District Attorney Carmen Ortiz from office for overreach in the case of Aaron Swartz has been created. The petition appears to be supported by both Anonymous and the controversial Kim Dotcom.
Add me on Google+
FILED UNDER:MIT ANONYMOUS HACKTIVISM PROTEST DEFACED WEBSITE

Download Windows RT Jailbreak Tool to Run Unsigned Apps

As we reported to you a few days ago, a group of software creators managed to bypass Windows RT’s restrictions and run unsigned desktop applications on the operating system, basically opening the door to a whole new world of jailbreaking tools.

Even though the whole process of jailbreaking Windows RT was pretty complicated, it was only a matter of time before someone came up with a dedicated solution supposed to perform this task all by itself.

Now XDA Developers user “netham45” has released a batch file that does the entire jailbreaking process automatically, so it modifies the Windows RT system kernel without user interaction.

Even though the software developer admits that some users might get a BSOD after launching the application, he says that everything should work just fine on all Windows RT tablets, including Microsoft’s Surface RT.

At this point, there are only a few software solutions available on a jailbroken Windows RT unit, including VNC Server and Client, Putty and Bochs, but many more apps are very likely to be added to the list as new users do the jailbreak.

Microsoft has already confirmed the jailbreak, saying that it “applauds the ingenuity” of the software developers behind the project, but also hinted that a future fix could block their attempts to modify the system kernel.

netham45 explained that Microsoft would have a very hard time trying to block their efforts. “They can patch it through Windows Update, but since we have the ability to reinstall from recovery partitions we can revert any Windows Updates they release,” he explained.

The jailbreak would only last until the Windows RT device is restarted and even though it may sound like a glitch, it’s actually a simple way to make sure that you won’t lose the warranty or get infected by some sort of virus compiled for the tablet-oriented operating system.

BlackBerry 10 Smartphone Launch Date Leaked

Research in Motion (RIMM) is scheduled to formally unveil its BlackBerry 10 operating system on January 30th, however it is unclear when we will see the first new BlackBerry smartphones launch. Despite the fact that all four major U.S. carriers — Verizon (VZ), AT&T (T), Sprint (S) and T-Mobile — have confirmed plans to carry new BlackBerry 10 devices in 2013, RIM has remained quiet regarding release details. According to an image provided to PHT and other publications allegedly showing Best Buy Canada’s (BBY) internal inventory system, the first BlackBerry 10 smartphone could launch in Canada on February 28th.

This specific release date concerns Canadian carrier Bell (BCE), though the phone will likely launch on additional carriers at the same time if the date is accurate.

When contacted by PHT for comment, RIM declined to confirm or deny the date. “We understand that there is a lot of excitement for BlackBerry 10,” a RIM spokesman told PHT via email. “We will launch the platform on January 30th and until then we won’t comment on speculation.”

RIM has previously said it will announce availability and pricing for its debut BlackBerry 10 devices at the launch event on January 30th.

Bittorent Releases Torrent Client for Chrome Browser

BitTorrent released a new torrent client, but, unlike what you’re already used to from the company (hint: uTorrent), this is integrated straight into the web browser, Google Chrome, that is.

It is a simple extension, currently in alpha, called BitTorrent Surf, which is already available for download from Chrome Web Store.

The core functionality of a torrent downloader is deeply rooted into this extension, so you won’t have trouble connecting to peers or downloading the files. What is more important, though, is searching for the stuff you want to download.

With BitTorrent Surf you can employ multiple websites to find what you’re looking for. The result is a super search function that looks into multiple sources to retrieve results.

BitTorrent Surf displays the estimated torrent health together with the number of people sharing and downloading the file as well as the total downloads to date.

Anonymous Wants Obama Administration to make DDOS Attacks a Legal Form of Protesting

In a petition submitted to the White House’s “We the People” website, Anonymous hacktivists are asking the Obama administration to make distributed denial-of-service (DDOS) attacks a legal form of protesting.

“With the advance in internet techonology, comes new grounds for protesting. Distributed denial-of-service (DDoS), is not any form of hacking in any way. It is the equivalent of repeatedly hitting the refresh button on a webpage,” the initiators of the petition wrote.

“It is, in that way, no different than any ‘occupy’ protest. Instead of a group of people standing outside a building to occupy the area, they are having their computer occupy a website to slow (or deny) service of that particular website for a short time,” they added.

“As part of this petition, those who have been jailed for DDoS should be immediately released and have anything regarding a DDoS, that is on their ‘records’, cleared.”

Hacktivists have often used DDOS attacks in their protests. It was their “weapon” of choice when US authorities took down the popular Megaupload file sharing service.

At the time, they disrupted numerous high-profile websites, including the ones of the FBI, the US Department of Justice, the White House, and ones belonging to the motion picture industry.

They've also utilized DDOS attacks to protest against Israel and the Syrian government.

The petition, created on January 7, has been signed by 814 individuals. However, in order for it to be taken into consideration, it needs to be signed by 25,000 people by February 6.

Official Anonymous communication channels have hundreds of thousands of followers, so getting 25,000 signatures shouldn’t really be an issue. However, some supporters might be discouraged to do so because those who sign the petition are required to create a whitehouse.gov account.

Hack Windows RT to Run any Desktop App

The security mechanism preventing unauthorised software running on ARM-powered Windows RT tablets - such as Microsoft's Surface slabtops - can be easily defeated.

The Redmond giant wanted only cryptographically signed executables, ideally those obtained from the official Windows application store, to run on its hardware. But, we're told, by twiddling a byte of memory in the Windows kernel, it is possible to disable the protection system and allow any code to run on the system.

Taking full control of the device, effectively jail-breaking the computer to run any desktop or touch-driven ARM-compatible software, is an exercise left to the user.

A security researcher calling him or herself C. L. Rokr claims to have found an oversight in the Windows kernel to allow this to happen. According to Rokr, all you have to do is fire up the Windows Debugger software with Administrator-level permissions, connect it to the tablet and manipulate the device's kernel memory.

Specifically, one needs to inject a blob of ARM code into a safe spot of RAM and have the Windows RT kernel divert the processor momentarily to run these instructions. This code locates and alters a moderately hidden variable in the kernel to disable the executable signature check. On PCs the variable contains '0' allowing any program to run, whereas it is '8' on Windows RT devices to enforce the signature check.

Trivially overwriting this byte can therefore change the level of protection on the system and circumvent Microsoft's cryptographic keys.

You can read more about the hack along with a how-to guide here.

Windows RT, which is a straight-up ARM port of Windows 8 for portable computers, was built to only run apps that are signed using a Microsoft-issued certificate.

The hack is unlikely to be something most non-techie users could pull off as it requires knowledge of WinDbg. And modifying the operating system could fall foul of the device's secure boot protection, which refuses to start the OS if it has been altered.

It's also not clear which apps can be run, although as pointed out in this programming forum the software must be compiled for, or otherwise be compatible with, ARM-powered systems. Programs already built for Intel and AMD processors need not apply, therefore.

Windows RT can be found on Microsoft's Surface tablet and fondleslabs from companies including Asus and Samsung. So far it appears sales of Windows RT devices are low and below Microsoft's expectations. Redmond has quickly turned from only selling Surface itself online and in its stores to recruiting retail partners.

One reason for the lack of interest could be lack of apps. Windows RT has been deliberately locked down because, we're told, Microsoft wants to maintain a standard of performance and security, and to ensure apps conform to the design of the interface and input via touch. This means the number of Windows RT apps is far behind the number of apps that exists for Intel machines running the exact same operating system.

Devices using Windows RT come with some built-in apps including Office Home and Student 2013 RT Preview Edition and Mail, Messaging and SkyDrive, but the official way to obtain more is via Microsoft's Windows Store, which supplies suitably signed executables.

Thai Police Arrests Wanted Algerian Hackers in the US

24-year-old Algerian National Hamza Bendelladj has been arrested by Thai police at Bangkok's Suvarnabhumi Airport while transiting from Malaysia to Egypt. Laptops, a tablet computer, a satellite phone and some external hard drives were found in the suspect’s possession.

According to authorities from Thailand, cited by the Bangkok Post, Bendelladj is wanted by the US Federal Bureau of Investigations on suspicion of hacking into private accounts in over 200 banks and other financial organizations from all around the world.

Authorities believe that the man made millions from his illegal transactions.

He will be extradited to the US state of Georgia where an arrest warrant has been issued on his name.

As you can clearly see from the picture taken after the arrest, the man doesn’t seem to be too concerned about the fact that he could spend many years behind bars.

'Expect us 2013', Anonymous Issues threat

The hacking collective Anonymous has clarified that it has no plans to fade away in the New Year. It issued a statement over the weekend that warned the world to "Expect us 2013."

Along with the statement, the group created a video that boasts of its campaigns and exploits carried out in 2012. The video details the group's temporary shutdown of the U.S. Department of Justice, the FBI, Universal Music, and the Motion Picture Association of America's Web sites in protest of the U.S. government's indictment of the operators of popular file-hosting site MegaUpload.

The video also shows newsreels of Anonymous' campaign against Syrian government Web sites because of that government's alleged shutdown of the Internet, along with Anonymous' "cyberwar" against the Israeli government in protest of government attacks on Gaza. The group also recounts its hack into the Web site of the Westboro Baptist Church in response to plans by the controversial church to picket the funerals of those massacred at the elementary school in Newtown, Conn.

"The operations which are listed in the video are only examples, there are far more operations," Anonymous wrote in the statement. "Some of them still running, like Operation Syria. We are still here."

Despite the hacking group's threats, some believe that the collective may not actually make a big impact in the online world in the coming year. Security firm McAfee Labs released its "2013 Threat Predictions" last week and claimed the decline of Anonymous.

The firm argued that a lack of structure and organization, false claims, and hacking for the simple joy of it has affected the group's reputation. McAfee also said, however, that higher-level professional hacking groups may take up the slack, and promote a rise in military, religious, political, and "extreme" campaign attacks.

SMS & Call Blocker Pre-Loaded Exclusively on Chinese Lumia 920 and 820

One of the most sought after features for Chinese mobile users, call and SMS blocker has finally made its way onto Windows Phone devices.

Unfortunately, Chinese users are the ones that will get this important feature on Nokia Lumia 920 and Lumia 820 devices.

According to WPCentral, Chinese customers who purchased a Lumia 920 or Lumia 820 smartphone were pleasantly surprised to find out both devices come with Nokia Spamfilter, which offers the following features:

- Block callers per mobile numbers;
- Block all SMS from specific sender;
- Dynamically block SMS containing specified keywords;
- Update the keyword database online for said SMS blocking;
- View all blocked calls and messages;
- Trace the geographic origin of specific phone numbers (only works for mobile numbers, precise to municipality and carrier).

Nokia Spamfilter seems to be “technically powered by Tencent Inc.” and, hopefully, will make it to Lumia 920 and 820 devices available in other regions as well.