Log inRegister

Security News

DDoS

His Homemade Tools Used to Launch 600,000 DDoS Attacks, Police Say Mathew J. Schwartz (euroinfosec) • April 12, 2016     Young DDoS Software Developer Escapes Jail TimeBirmingham's Victoria Law Courts (Source: Tony Hisgett//CC-by-2.0)

A British man who pleaded guilty to selling homemade distributed denial-of-service attack tools reportedly used to carry out more than 600,000 attacks has escaped jail time, with a judge calling him "young and naïve."

See Also: The Inconvenient Truth About API Security

Grant Manser, 20, who lives in Kidderminster, England, appeared last week in Birmingham Crown Court, where he pleaded guilty to six charges under the U.K. Computer Misuse Act, as well as four charges under its Serious Crime Act, the Birmingham Mail newspaper reports.

Judge Nicholas Cole imposed a two-year sentence on Manser - to be served in a youth detention center. But the judge suspended imposing that sentence for 18 months. That means that if Manser stays out of trouble for 18 months, he'll avoid jail time. Cole also sentenced Manser to 100 hours of unpaid community service and an £800 ($1,100) fine.

Manser's attorney, Jamie Baxter, told the court that his client wasn't a hacker, hadn't ever stolen or sold information, and programmed his software to avoid certain types of targets, including banks, healthcare organizations, police agencies and the FBI, Birmingham Mail reports. "He is not a hacker; the system doesn't take or hack any information from the websites being attacked," Baxter said. "He was only 16 when he started to do this and it was his immaturity and naivety which led him to commit these offenses."

Prosecutor Raj Punia told the court that Manser created four pieces of "stresser" software - named Dejabooter, netspoof, Refinedstresser and Vexstresser - that sold for £5 to £20 ($7 to $29) via unnamed "dark web" sites.

While that might seem inexpensive, the price range is typical for many of today's cybercrime tools and services. On the outsourcing front, for example, several Russian underground markets charge $5 per hour or $50 per day to wage a DDoS attack on a site, according to a new report from Dell SecureWorks. For longer disruptions, Dell researchers found that attackers were charging $200 per week - $350 if the site to be disrupted had anti-DDoS defenses in place - or $1,000 per month.

Illegal DDoS Attacks

As with the Russian outsourced DDoS services, Manser's software was not sold for the legitimate purpose of testing websites' resiliency, but instead to enable buyers to launch illegal DDoS attacks, Birmingham Mail reports. Punia told the court that Manser started his business at the age of 16, in January 2012, and that it ran until November 2014, when he was arrested by England's West Midlands Regional Cyber Crime Unit. At that point, she said, Manser counted nearly 4,000 clients who had paid him a total of £50,000 ($71,000) via PayPal and used his software to carry out more than 603,000 DDoS attacks against almost 225,000 targets (see How Do We Catch Cybercrime Kingpins?).

Manser ploughed his earnings into buying better computer equipment and fixing up his motorcycle and was so successful that he was advertising for additional employees, Birmingham Mail reports (see Cybercrime Recruiters Want You).

Punia told the court that the victims of Manser's DDoS floods against websites, servers and email addresses included not only businesses but also schools, colleges and government agencies across not just the United Kingdom, but also other EU countries - including France, the Netherlands and Poland - as well as the United States. Manser reportedly told police that he cooked up the DDoS software business after working for someone in the United States who was running a similar scheme and witnessing the profit potential.

Stresser Software Arrests

Manser isn't the first young man to be arrested for selling or using stresser software. Last year, for example, the U.K.'s National Crime Agency announced that it arrested six teenage boys for buying and using the online "Lizard Stresser" DDoS tool sold by hacking gang Lizard Squad, and that it was visiting and warning 50 other individuals - one-third of whom were teenagers - who it believed had registered for the service, but not yet used it (see UK Police Detail DDoS-for-Hire Arrests).

The preponderance of young hacking offenders is concerning and begs the question of whether sentences should be more severe. But Dublin-based cyber psychology expert Grainne Kirwan says that most young people who commit crimes tend to naturally stop doing so as they "age out," referring to their getting more responsibilities - including a job, long-term relationship, mortgage or children - that leave little time for cybercrime (see Young Hackers: Jail Time Appropriate?).

Fraud

Jail Time for Russian Cybercriminals Is Rare Mathew J. Schwartz (euroinfosec) • April 15, 2016     Russia: 7-Year Sentence for Blackhole MastermindDmitry 'Paunch' Fedotov at the time of his arrest by Russian authorities. (Source: Group-IB.)

Russian authorities have sentenced Dmitry "Paunch" Fedotov, the developer of the notorious Blackhole exploit kit that's been linked to large amounts of fraud, to seven years in prison - an unusually severe sentence for online crime in that nation.

See Also: Unite & Disrupt: Mitigate Attacks by Uniting Security Operations

He was one of seven Russian men who were found guilty of computer crimes and sentenced to spend up to eight years in prison for committing a spree of hacking and malware attacks that resulted in the theft of more than 25 million rubles (worth about $800,000 at 2013 exchange rates) from Russian banks, state-owned Russian news agency TASS reports. All are due to serve their sentence in a "penal colony," it adds.

Russia's Ministry of Internal Affairs had previously tied the Blackhole gang to 70 million rubles in fraud, which would have been worth $2.1 million at 2013 exchange rates. Authorities in other countries also tied the gang to many millions of dollars in fraud and ransomware payments that they received from victims.

Artem Palchevsky, who remains at large, was convicted in absentia of helping to design software that hacked PCs and exfiltrated sensitive financial information that could be used to drain accounts, TASS reports. He's been sentenced to serve eight years in prison. Fellow hackers Roman Kulakov, Sergey Shumarin, Ilya Bragin, Valery Gorbunov, and Vladimir Popov were also sentenced to between five and a half and eight years in prison, Tass reports.

But the most notorious member of the group was Fedotov, who was arrested in October 2013 at age 27. Russian authorities often turn a blind eye to Russians who run cybercrime campaigns that target foreigners. But Fedotov, a.k.a. "Paunch," made the mistake of stealing from Russian banks while residing on Russian soil (see Russian Cybercrime Rule No. 1: Don't Hack Russians).

The length of the prison sentences imposed on the gang members is "not typical for the Russian legal system," says Sergey Nikitin, deputy head of the computer forensics laboratory and malicious code analysis team at Moscow-based cybersecurity firm Group-IB. He called the sentences "a very positive step" toward combatting cybercrime.

"Court judgments for cybercrimes in Russia are usually delivered in accordance with Articles 272 and 273 of the Russian Criminal Code, and criminals often receive a suspended sentence," Nikitin tells Information Security Media Group. "However, in this particular case investigators managed to prove that cybercrimes had been accompanied by monetary theft, which meant criminals had committed fraud and therefore should be sentenced to imprisonment."

Group-IB assisted Russian authorities with their Blackhole investigation (see How Do We Catch Cybercrime Kingpins?).

Subscription-Based Cybercrime Service

The arrest of Fedotov and his colleagues shuttered the Blackhole cybercrime service. The service, which was sold on a subscription-only basis starting at $50 per day or $500 per month, was primarily used to send large volumes of spam that included email attachments that attempted to exploit known vulnerabilities on PCs. Security experts say Blackhole was the most prevalent online threat in 2012 and was used to distribute many different types of malware, including banking Trojans that could be used to drain victims' bank accounts. The exploit kit was also used to infect systems with ransomware, providing a separate revenue stream for criminals in the form of ransom payments.

Blackhole was so successful that Fedotov, beginning in October 2012, was then able to develop and sell a premium offering called Cool Exploit Kit that was packed with zero-day flaws and available for $10,000 per month. He also offered the malware obfuscation service Crypt.am, according to Group-IB.

Cybersecurity , Risk Management

Obama Also Names MasterCard CEO to Group Working on Strategies Eric Chabrow (GovInfoSecurity) • April 14, 2016     Cybersecurity Commission Includes Former Heads of NSA, NISTEx-NSA Director Keith Alexander, left, joins the Commission on Enhancing National Cybersecurity.

Keith Alexander, former National Security Agency director, and Patrick Gallagher, who once headed the National Institute of Standards and Technology, will join Ajay Banga, chief executive of MasterCard, on the new Commission on Enhancing National Cybersecurity.

See Also: Unlocking Software Innovation with Secure Data as a Service

The commission's members, appointed by President Obama, also include Tom Donilon, the former White House national security adviser, who was previously announced as chairman, and Samuel Palmisano, IBM's former leader, who is vice chairman.

Alexander, who also served as commander of the U.S. Cyber Command, is CEO of IronNet, a cybersecurity consultancy he founded in 2014. Gallagher left NIST in 2014 to become chancellor and chief executive of the University of Pittsburgh.

The commission, which holds its first meeting this week, has a Dec. 1 deadline to produce a report that will advise Obama and the next president on steps the government and private sector can take over the next 10 years to improve cybersecurity.

Other Commission Members

Other members of the commission named April 13 by President Obama include:

Annie Antón, professor and chair of the School of Interactive Computing at the Georgia Institute of Technology; Steven Chabinsky, general counsel and chief risk officer at security provider CrowdStrike and former deputy assistant director of the FBI's cyber division and chief of the FBI's cyber intelligence section; Peter Lee, corporate vice president at Microsoft Research; Herbert Lin, senior research scholar for cyber policy and security at the Center for International Security and Cooperation and a research fellow at the Hoover Institution, both at Stanford University; Heather Murren, private investor and member of the board of trustees of the Johns Hopkins University and the Johns Hopkins University Applied Physics Laboratory; Joe Sullivan, chief security officer at Uber and former CSO at Facebook and assistant U.S. attorney for computer hacking; and Maggie Wilderotter, former CEO and executive chairman at Frontier Communications.

The Republican and Democratic leaders of the House and Senate were invited to recommend one commission member each, according to the executive order establishing the commission. The White House did not disclose which of the 12 commission members, if any, were suggested by lawmakers.

Cybersecurity National Action Plan

The commission is part of the administration's Cybersecurity National Action Plan, which Obama said would require the government and business to collaborate "for the next five years, 10 years, 20 years, so that we can make sure that we get the benefits of the internet and utilization, and not the dangers and threats.

"They're going to be thinking about everything from how do we keep the huge databases that exist in the federal government more secure, to how do we more effectively work with critical sectors of our economy, whether it's the financial sector or our critical infrastructure, like utilities, to make sure their systems are more secure," Obama said.

President Obama discusses the Cybersecurity National Action Plan on Feb. 9.

The Department of Commerce's NIST will provide support to the commission. Commerce Secretary Penny Pritzker says involvement of public- and private-sector leaders would provide the perspectives of business, the tech sector, IT security, national security and law enforcement to address the nation's cybersecurity challenges.

"As the owners and operators of much of the infrastructure and digital networks that represent the backbone of the 21st century economy, the private sector is our indispensable partner in protecting the networks that are so essential to commerce, public safety and national security," Pritzker says.

Cybersecurity , Data Loss , Governance

Data Security Risk: A CISO's Perspective Presented by Informatica     60 Minutes     Data Security Risk: A CISO's PerspectiveProtecting sensitive information is especially difficult for corporations that have data stores scattered in physical, virtual and cloud-based repositories across the globe. Not only do these multinational organizations need to protect their data from countless threat actors, they must contend with exploding data growth and constantly changing, oftentimes contradictory privacy regulations in the countries where they do business. This session will cover key topics for data and security professional in 2016, including: CISO Perspective on Data Security Risk The Intersection of Data Security Risk and Data Management Create a 360-degree view of your data security risks Deliver on-demand intelligence for prioritization, audit and governance Never-ending threats, exploding data growth and privacy regulations challenge IT and security responsible for thousands of data stores scattered across the globe. Therefore, a data security framework is mandatory to protect your data across international regions. But in order to construct this framework, you need visibility into all your data and its attendant risk. This webinar, hosted Bill Burns, CISO at Informatica, and featuring Josh Alpern, vice president, strategic business development, data security at Informatica and David Loshin president of consultancy Knowledge Integrity, will teach you how to gain visibility, control and understanding of your sensitive data and the financial impact of keeping it safe. Register for this webinar and learn the why and how of devising an effective global data risk and security framework. This informative session will also highlight how you can: Understand data proliferation (AKA the "data monster") Create a 360-degree view of your data risks Deliver on-demand intelligence for audit and governance programs Eliminate costly and error-prone manual efforts in securing your data You might also be interested in … Old IT Project Raises New Concerns for 1,400 Organizations Old IT Project Raises New Concerns for 1,400 Organizations
Cybersecurity Commission Includes Former Heads of NSA, NIST
Cybersecurity Commission Includes Former Heads of NSA, NIST
Are Two Bank Breaches Related?
Are Two Bank Breaches Related?
Strategies to Tackle New Age Cybercrime
Strategies to Tackle New Age Cybercrime
Ransomware: Is It Ever OK to Pay?
Ransomware: Is It Ever OK to Pay?
Badlock is Bad - But Could Be Worse
Badlock is Bad - But Could Be Worse
IRS Chief: Agency Faces Loss of Key InfoSec Personnel
IRS Chief: Agency Faces Loss of Key InfoSec Personnel
Proactively Protect Against Healthcare Data Breaches
Proactively Protect Against Healthcare Data Breaches

Encryption , Legislation , Privacy

Why Decryption Legislation Is a Bad Idea Proposal Would Infringe on American's Right to Privacy, and Set a Bad Example Eric Chabrow (GovInfoSecurity) • April 15, 2016     Why Decryption Legislation Is a Bad IdeaSen. Ron Wyden strongly opposes the Compliance with Court Order Act.

Draft legislation offered by the leaders of the Senate Intelligence Committee has a commendable goal: furnish law enforcement and intelligence agencies with critical information to keep America safe from terrorists and criminals.

See Also: Secure, Agile Mobile Banking: Keeping Pace with Last Best User Experience

The Compliance with Court Orders Act of 2016 would compel technology providers to turn over their customers' information, when they receive a court order, and aid law enforcement and intelligence agencies in decrypting data when necessary.

"This bill will empower repressive regimes to enact similar laws and crack down on persecuted minorities around the world." 

One catalyst for the legislation is Apple's recent battle with the FBI, which obtained a court order to compel the tech giant to unlock the iPhone of one of the shooters in the San Bernardino massacre. Apple strongly resisted the order, and the FBI ultimately backed off after it got outside help cracking the phone (see FBI Unlocks iPhone; Lawsuit Against Apple Dropped).

"Today, terrorists and criminals are increasingly using encryption to foil law enforcement efforts, even in the face of a court order," says the bill's co-sponsor Sen. Dianne Feinstein, the California Democrat who's vice chair of the intelligence panel. "We need strong encryption to protect personal data, but we also need to know when terrorists are plotting to kill Americans."

Feinstein's motives, as well as those of her co-sponsor, Intelligence Committee Chairman Richard Burr, R-N.C., are admirable but misplaced. Their legislation, in the long run, would do more harm than good.

Protecting America's Core Values

Sen. Ron Wyden, D-Ore., the most vocal opponent of legislation to weaken encryption, sounds an important alarm: "This bill will empower repressive regimes to enact similar laws and crack down on persecuted minorities around the world."

Enactment of the Compliance with Court Orders Act, or similar legislation, would diminish America's standing as a moral leader in the world, a nation looked up to by billions of people, even with our many flaws. Our fundamental democratic values of liberty, equality and justice are respected worldwide. The proposed legislation would devalue those principles and diminish our reputation.

U.S. authorities rightly have been criticized for numerous unscrupulous acts, such as the National Security Agency and other intelligence services illicitly spying on American citizens or police maltreatment of criminal suspects and innocent bystanders.

Nevertheless, the right to privacy remains a core American value.

The Compliance with Court Orders Act would erode the right to privacy and give other nations an excuse to adopt similar laws and practices that deprive their citizens of basic human rights. They might do so even without Congress enacting the proposed legislation, but why encourage them? We should not lose the moral high ground.

Flawed Legislation

There is another reason why the Compliance with Court Orders Act is bad legislation, a point often repeated during the battle between Apple and the FBI over cracking the iPhone used by the San Bernardino shooter: Providing backdoors to law enforcement creates opportunities for others - including criminals and terrorists - to employ those exploits (FBI-Apple Aftermath: Finding the Elusive Compromise ). "This flawed bill would leave Americans more vulnerable to stalkers, identity thieves, foreign hackers and criminals," Wyden says.

Encryption, and other safeguards, protect the security and privacy of individuals, and Congress shouldn't weaken those protections. It's an idea that even the bill's sponsors understand. "I have long believed that data is too insecure, and feel strongly that consumers have a right to seek solutions that protect their information - which involves strong encryption," Burr says. But he conditions his statement by expressing a fast-held belief that no technology should be above the law.

Meaningful, Inclusive Debate

Burr says he hopes that circulating the draft legislation will spur a meaningful and inclusive debate on the role of encryption and its place within the rule of law. That conversation has been around for a while, and the reality is that once you give police an encryption workaround, it will become available to everyone. "You can't have a world where the good guys spy and the bad guys can't," says noted cryptographer and cybersecurity author Bruce Schneier.

The conversation must shift to a new focus on how government and industry can collaborate to identify other tools to help get the goods on criminals and terrorists without sacrificing the privacy and civil liberties of American citizens (see Creating a Framework for a Security-Privacy Dialogue).

  1. FBI's Zero-Day iPhone Hack: Many Questions
  2. P.F. Chang's Ruling: Is the Tide Shifting?
  3. Drug Fraud Scheme Includes Criminal HIPAA Violations
  4. JBoss Servers: Ransomware Campaign Alert

Page 2132 of 2215