Threat Level: green Handler on Duty: Jim Clausing

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2016-09-22 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

The era of big DDOS?

Published: 2016-09-22
Last Updated: 2016-09-22 23:55:19 UTC
by Rick Wanner (Version: 1)
6 comment(s)

I have been tracking DDOS's for a number of years, and quite frankly, it has become boring.  Don't get me wrong, I am not complaining, just stating a fact.  A number of factors seem to have contributed to its fall from mainstream consciousness.  Some of these factors being; somewhat better filtering practices, more awareness of timely patching, and probably the most significant being the novelty has worn off.  Occasionally I will still see a multi-Gbps DDOS, but mostly it has been relegated to booter traffic which is not even a nuisance for most providers.

Over the last few days though there have been two very significant DDOS events.  Firstly, on Tuesday, Sep 20, hosting company OVH was hit with DDOS which peaked near  the 1Tbps range, and also on Tuesday evening (Sep 20), InfoSec journalist Brian Krebs website was hit with a DDOS peaking at over 600 Gbps. 

These are believed to be the two largest DDOS on record and significantly exceed what it was believed could be achieved by any one DDOS group.

While the nature of the DDOS attack traffic used against OVH has not been revealed, the attack against Brian Kreb's site is unusual in that the traffic is not your typical reflective UDP DDOS traffic, but rather TCP traffic that made connections with the web server and GRE (generic routing encapsulation) packets.  The reason why this is unusual is that this traffic cannot be spoofed, but rather an analysis of the traffic should reveal which devices were used to launch the attack.

Is this a sign that big DDOS is making a comeback or just a couple of isolated attacks?

 

UPDATE: It appears Akamai is not happy with the extra excitement hosting Brian Kreb's site is bringing them.  Brian is looking for a new hosting provider.

-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)

Keywords:
6 comment(s)

YAHDD! (Yet another HUGE data Breach!)

Published: 2016-09-22
Last Updated: 2016-09-22 23:42:35 UTC
by Rick Wanner (Version: 1)
0 comment(s)

It looks like Yahoo! is the latest victim of a large scale data breach.  It looks like the released data dates back to at least 2014 and contains more than 500 Million user accounts, so if you haven't changed your Yahoo! password in the last couple of years then it is time.

As one of the other ISC Handlers pointed out...not all Yahoo! customers may know they are Yahoo! customers. Yahoo! white labels email services on behalf of ISPs and email providers. I assume those white label providers will need to do notifications to their customers as well?

-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)

Keywords: Data Breach
0 comment(s)

OpenSSL Update Released

Published: 2016-09-22
Last Updated: 2016-09-22 13:52:16 UTC
by Johannes Ullrich (Version: 1)
2 comment(s)

As announced earlier this week, OpenSSL released an update today for all currently supported versions (1.0.1, 1.0.2, 1.1.0).

The update fixes 14 different vulnerabilities. Only one vulnerability is rated "High". This vulnerability, CVE-2016-6304, can lead to memory exhaustion and a denial of service if the client sends multiple large OCSP requests.

With this update, the latest versions of OpenSSL for the various branches are 1.0.1u, 1.0.2i and 1.1.0a. All three branches are currently supported.

The table below shows which vulnerabilities apply to each branch.

CVE Description Rating 1.0.1 1.0.2 1.1.0
CVE-2016-6304 OCSP Status Request extension unbounded memory growth High x x x
CVE-2016-6305 SSL_peek() hang on empty record (CVE-2016-6305) Moderate     x
CVE-2016-2183 SWEET32 Mitigation (CVE-2016-2183) Low x x  
CVE-2016-6303 OOB write in MDC2_Update() Low x x  
CVE-2016-6302 Malformed SHA512 ticket DoS Low x x  
CVE-2016-2182 OOB write in BN_bn2dec() Low x x  
CVE-2016-2180 OOB read in TS_OBJ_print_bio() (CVE-2016-2180) Low x x  
CVE-2016-2177 Pointer arithmetic undefined behaviour (CVE-2016-2177) Low x x  
CVE-2016-2178 Constant time flag not preserved in DSA signing Low x x  
CVE-2016-2179 DTLS buffered message DoS Low x x  
CVE-2016-2181 DTLS replay protection DoS Low x x  
CVE-2016-6306 Certificate message OOB reads Low x x  
CVE-2016-6307 Excessive allocation of memory in tls_get_message_header() Low     x
CVE-2016-6308 Excessive allocation of memory in dtls1_preprocess_fragment() Low     x

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

 

Keywords:
2 comment(s)
Diary Archives