Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog - Internet Storm Center Diary 2016-09-22 InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

The era of big DDOS?

Published: 2016-09-22
Last Updated: 2016-09-22 23:55:19 UTC
by Rick Wanner (Version: 1)
5 comment(s)

I have been tracking DDOS's for a number of years, and quite frankly, it has become boring.  Don't get me wrong, I am not complaining, just stating a fact.  A number of factors seem to have contributed to its fall from mainstream consciousness.  Some of these factors being; somewhat better filtering practices, more awareness of timely patching, and probably the most significant being the novelty has worn off.  Occasionally I will still see a multi-Gbps DDOS, but mostly it has been relegated to booter traffic which is not even a nuisance for most providers.

Over the last few days though there have been two very significant DDOS events.  Firstly, on Tuesday, Sep 20, hosting company OVH was hit with DDOS which peaked near  the 1Tbps range, and also on Tuesday evening (Sep 20), InfoSec journalist Brian Krebs website was hit with a DDOS peaking at over 600 Gbps. 

These are believed to be the two largest DDOS on record and significantly exceed what it was believed could be achieved by any one DDOS group.

While the nature of the DDOS attack traffic used against OVH has not been revealed, the attack against Brian Kreb's site is unusual in that the traffic is not your typical reflective UDP DDOS traffic, but rather TCP traffic that made connections with the web server and GRE (generic routing encapsulation) packets.  The reason why this is unusual is that this traffic cannot be spoofed, but rather an analysis of the traffic should reveal which devices were used to launch the attack.

Is this a sign that big DDOS is making a comeback or just a couple of isolated attacks?

 

UPDATE: It appears Akamai is not happy with the extra excitement hosting Brian Kreb's site is bringing them.  Brian is looking for a new hosting provider.

-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)

Keywords:
5 comment(s)
ISC Stormcast For Friday, September 23rd 2016 https://isc.sans.edu/podcastdetail.html?id=5179

YAHDD! (Yet another HUGE data Breach!)

Published: 2016-09-22
Last Updated: 2016-09-22 23:42:35 UTC
by Rick Wanner (Version: 1)
0 comment(s)

It looks like Yahoo! is the latest victim of a large scale data breach.  It looks like the released data dates back to at least 2014 and contains more than 500 Million user accounts, so if you haven't changed your Yahoo! password in the last couple of years then it is time.

As one of the other ISC Handlers pointed out...not all Yahoo! customers may know they are Yahoo! customers. Yahoo! white labels email services on behalf of ISPs and email providers. I assume those white label providers will need to do notifications to their customers as well?

-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)

Keywords: Data Breach
0 comment(s)

OpenSSL Update Released

Published: 2016-09-22
Last Updated: 2016-09-22 13:52:16 UTC
by Johannes Ullrich (Version: 1)
1 comment(s)

As announced earlier this week, OpenSSL released an update today for all currently supported versions (1.0.1, 1.0.2, 1.1.0).

The update fixes 14 different vulnerabilities. Only one vulnerability is rated "High". This vulnerability, CVE-2016-6304, can lead to memory exhaustion and a denial of service if the client sends multiple large OCSP requests.

With this update, the latest versions of OpenSSL for the various branches are 1.0.1u, 1.0.2i and 1.1.0a. All three branches are currently supported.

The table below shows which vulnerabilities apply to each branch.

CVE Description Rating 1.0.1 1.0.2 1.1.0
CVE 2016-6304 OCSP Status Request extension unbounded memory growth High x x x
CVE 2016-6305 SSL_peek() hang on empty record (CVE-2016-6305) Moderate     x
CVE 2016-2183 SWEET32 Mitigation (CVE-2016-2183) Low x x  
CVE 2016-6303 OOB write in MDC2_Update() Low x x  
CVE 2016-6302 Malformed SHA512 ticket DoS Low x x  
CVE 2016-2182 OOB write in BN_bn2dec() Low x x  
CVE 2016-2180 OOB read in TS_OBJ_print_bio() (CVE-2016-2180) Low x x  
CVE 2016-2177 Pointer arithmetic undefined behaviour (CVE-2016-2177) Low x x  
CVE 2016-2178 Constant time flag not preserved in DSA signing Low x x  
CVE 2016-2179 DTLS buffered message DoS Low x x  
CVE 2016-2181 DTLS replay protection DoS Low x x  
CVE 2016-6306 Certificate message OOB reads Low x x  
CVE 2016-6307 Excessive allocation of memory in tls_get_message_header() Low     x
CVE 2016-6308 Excessive allocation of memory in dtls1_preprocess_fragment() Low     x

---
Johannes B. Ullrich, Ph.D.
STI|Twitter|LinkedIn

 

Keywords:
1 comment(s)
Diary Archives