Journalist Sues FCC For Hiding Details About Its Alleged, Phantom DDOS Attack

from the calling-your-bluff dept

You might recall that when John Oliver did his latest piece on net neutrality, the FCC's comment system ground to a halt under the load of viewers pissed to realize that the FCC is trying to kill popular consumer protections protecting them from buffoonery by the likes of Comcast. But the FCC then did something odd: it claimed that a DDOS attack, not HBO's hit show, resulted in the website's issues. A statement issued by the FCC proclaimed that extensive "analysis" by the FCC had led the agency to conclude that it had suffered the attack at roughly the same time Oliver's program had ended:

"Beginning on Sunday night at midnight, our analysis reveals that the FCC was subject to multiple distributed denial-of-service attacks (DDos). These were deliberate attempts by external actors to bombard the FCC’s comment system with a high amount of traffic to our commercial cloud host. These actors were not attempting to file comments themselves; rather they made it difficult for legitimate commenters to access and file with the FCC."

The problem: security experts saw no evidence that claim was true in publicly available logs, and saw none of the usual indicators preceding such an attack. And the FCC ever since has been bizarrely cagey, refusing to provide any evidence whatsoever supporting its claim. The FCC was subsequently prodded by several Senators as to the nature of the attack, but the FCC still refused to share any real data, despite agency boss Ajit Pai repeatedly, breathlessly insisting he would be a stalwart defender of transparency at the agency.

And when Gizmodo recently filed a FOIA request for anything regarding the nature of the attack, the FCC first released seventeen pages of nonsense, before admitting it had no documented "analysis" proving an attack as previously claimed. When additional websites began to point out that the FCC's behavior here was a little odd, the agency sent out a strangely-punchy press release lambasting news outlets for being "irresponsible."

So what's really happening here? The unsubstantiated journalist guess du jour is that the FCC bizarrely made up a DDOS attack in a feeble attempt to downplay the "John Oliver effect" in the media. "We weren't inundated by millions of people angry that we're killing popular consumer protections solely to the benefit of Comcast," this narrative suggests, "we were unfairly attacked!" The fact that there never actually was a DDOS attack would go a long way toward explaining the Trump FCC's subsequent inability to provide any evidence supporting the claim, even under pressure from Congress.

Hoping to flesh this theory out a bit, journalist Kevin Collier last week filed a lawsuit against the FCC (pdf) not only demanding more data on the agency's supposed DDOS attack, but also urging the FCC to provide some insight on what it's doing to address the wave of bogus, bot-produced anti-net neutrality comments flooding the agency's website in recent months:

"Collier said his records request was prompted by the FCC’s “weird and cagey” inclination to obscure details about the incident. “The fact that they gave Gizmodo such a runaround in its own request for internal ‘analysis’ of the attack just goes to show this,” he said. “I want to know the full story.” Sen. Ron Wyden, Democrat of Oregon, told Gizmodo last week the FCC’s actions raised “legitimate questions about whether the agency is being truthful when it claims a DDoS attack knocked its commenting system offline.”

Again, the refusal to address fraudulent anti-net neutrality comments being made at the FCC website (like the one made in my name), combined with the FCC's bizarre, phantom DDOS attack, has many believing the FCC is actively engaged in an intentional, amateurish attempt to downplay the massive backlash to their assault on net neutrality. And while it's entirely possible the FCC is just being non-transparent and generically stupid here, if it can be proved the agency actively lied about a DDOS attack then covered it up simply to downplay the immense unpopularity of its policies, the inevitable lawsuits against the agency in the wake of its final vote to kill the rules could get very interesting.

Filed Under: ddos, fcc, foia, kevin collier, public records

Convicted Fraudster Uses DDoS Attack To Clean Up Search Results, Fails Spectacularly

from the engage-self-destruct dept

A Seattle man has found a surefire way to clean up negative search engine results: get arrested for threatening (and apparently executing) a denial-of-service attack against a legal web site for refusing to take down an unflattering link.

Federal prosecutors announced the arrest of Kamyar Jahanrakhshan, 32, on a criminal charge of extortion by threats to cause damage to Leagle.com. If convicted, he faces up to 5 years in federal prison and a $250,000 fine.

A man named Andrew Rakhshan allegedly contacted the website in December 2014 and asked that a link to the offending court decision be taking down.

Then Rakhshan was done asking.

“On January 24, 2015 Rakhshan again sent an e-mail claiming that he met a group of hackers online who were willing to launch a massive cyber-attack on Leagle.com,” prosecutors said in a statement. “Rakhshan claimed that he had no other options to resolve the matter. He threatened to use these hackers to conduct a Distributed Denial of Service (DDoS) attack to force Leagle.com to comply with his demands. On January 25, 2015, a large amount of traffic targeted the IP address for Leagle.com.”

The website was unable to mitigate the attack traffic, which subsided when it removed the link.

Nice work, Andrew. Generating a federal indictment is a surefire way to ensure your vanity search results remain unmarred by "offending court decisions." But this DDoS wasn't Rakhshan's only attempt to scrub the web of negative info. Searching through the Lumen (formerly Chilling Effects) database reveals post-alleged attack efforts Rakhshan made to clean up unflattering search results.

Several takedown notices sent to Google reference a court order obtained by Rakhshan targeting three URLs set up by someone who wanted the world to know about Rakhshan's fraudulent Canadian escapades.

Rakhshan's requests demand the removal of the following URLs by Google.

http://jahanrakhshan-credit-card-embosser.blogspot.com/

http://jahanrakhshan-impersonated-police.blogspot.com/

http://jahanrakhshan-rakhshan-fraud-trial.blogspot.com/

http://rakhshan-vs-whatcom-county-washington.blogspot.com/

http://whistleblower-legislation-canada.blogspot.com/p/blog-page.html

However, the court order [PDF] he cites (in increasingly angry tones) only specifies the removal of three URLs.

http://rakhshan-vs-whatcom-county-washington.blogspot.com/

http://jahanrakhshan-rakhshan-fraud-trial.blogspot.com/

The third URL refers to a Google Drive document.

The court's order says the person posting these must remove them, not Google. In fact, a handwritten note appended to the end of the approved order makes it clear Google is not responsible for the removal of the URLs.

(In case you can't see it, the handwritten note reads "Google is not a party to this lawsuit.")

The three other URLs listed in Rakhshan's takedown notices were struck from the court order before approval. That's because there was nothing even possibly libelous about the posts. All they contained were Canadian court documents pertaining to Andrew Rakhshan/Kamyar Jahanrakhshan which, no matter how unflattering, cannot possibly be considered defamatory.

Not that it seems to matter to Rakhshan. This note is appended to his September 2016 takedown request:

Next month is ONE-YEAR anniversary of when I first submitted this Complaint. I am attaching BOTH my Court Orders once again. TELL ME what is the problem or issue. I will then PRINT your comments, attach them to my sworn affidavit, and take it before the SAME Judge and wont leave his courtroom until he gives me a THIRD Order which is to your standards. Once again, the first 2 URLs above are explicitly stated in both orders. That means the Judge has found them to be unlawful, not once, but TWICE - No further explanation is therefore required. The 3rd, 4th and 5th URLs above are an exact replicate of what you removed between December to April. I could elaborate extensively if you wish, but in sum, the Defendant either accuses me of DDoS, or else being a same person as a convicted fraudster from Canada. Last week Google Security called me and asked that I stop contacting Google. I will NEVER do that until these 5 URLs are removed, even if it takes 10 ...

Strange that it mentions a DDoS. But by this point, he'd probably been hearing about the accusations for at least a year. According to the indictment, the attack took place in January 2015. Also stranger that it says the URLs claim he's the same person as a convicted fraudster from Canada. The URLs that remain live don't connect the two names. But the multiple takedown notices -- coupled with the recent indictment of Andrew Rakhshan -- seem to indicate these are both the same person.

However, both a 2011 Canadian news article about Rakhshan…

Westpac, St George Bank and Bankwest were just three banks and card issuers from around the world that gave evidence this year against Kamyar ''Andy'' Jahanrakhshan of North Vancouver.

In spending almost $C500,000 of other people's money, Jahanrakhshan used forged credit cards that carried his real name and supplied the various car dealers with his driver's licence.

He was found guilty last month of multiple counts of fraud by the Supreme Court in British Columbia.

And the DOJ's indictment…

Kamyar Jahanrakhshan, aka “Kamyar Jahan Rakhshan,” “Andy or Andrew Rakhshan,” “Andy or Andrew Kamyar,” and “Kamiar or Kamier Rakhshan,” 32, of Seattle, Washington, was arrested today on a federal criminal complaint charging him with extortion by threats to cause damage to the Dallas, Texas hosting company for Leagle.com, announced U.S. Attorney John Parker of the Northern District of Texas.

...make it explicit this is the same person, despite Rakhshan's protests to the contrary.

And it could be Rakhshan is impersonating the Canadian Broadcast Corporation as well. There are three notices purportedly from the CBC demanding takedowns of archived versions of the CBC's original story about Rakhshan's Canadian legal troubles.

So, it appears Rakhshan is -- or at least was -- engaging in a lot of questionable behavior attempting to scrub the web of mentions of his Canadian criminal past. Adding bogus DMCA takedown notices to an alleged DDoS isn't the ideal course of action one should pursue if they feel their search results are already a bit sketchy.

Filed Under: andrew rakhshan, ddos, kamyar jahanrakhshan, reputation management, search engine optimization, seo
Companies: leagle

Senator Wyden Argues FCC Is Either Incompetent Or Lying About Alleged DDoS Attack

from the derailing-the-John-Oliver-effect dept

Last week we noted how the FCC was acting incredibly suspicious in regards to its May claim that a DDOS attack, not annoyed John Oliver viewers, brought down the agency's website shortly after Oliver's latest rant on net neutrality. Despite pressure from journalists and several Senators, the FCC is simply refusing to release any data providing the existence of the attack, resulting in many media outlets not so subtly implying that the agency was lying:

"The FCC’s refusal to produce records of any true relevance reflects pressure from the agency’s upper echelon to limit the disclosure of information about the incident to a handful of carefully crafted public statements...It would be hard for a government agency to do more to give off the impression that it was engaged in a cover up. That’s troubling given the rise of questions over the FCC’s integrity.

As we noted last week, there are really only two options here. One, the FCC was attacked coincidentally at the same time John Oliver's program aired, it just failed to do any meaningful written analysis of the attack, and has zero interest in being transparent about it. Two, the FCC made up the attack completely to try to deflate all the talk about the "John Oliver effect" in the press, a misguided continuation of the agency's clear desire to downplay the massive public opposition to Pai's plan to kill net neutrality.

Based on the FCC's other recent behaviors in regards to ignoring comment fraud to this same purpose, it's fairly obvious the latter is a very real possibility. But with the FCC refusing to comply to FOIA requests, it's going to take some notable outside pressure to get to the truth. That's not going to be easy given that despite broad bipartisan support for the rules, ISPs have successfully convinced the public this is a partisan issue, which helps them stall meaningful discourse by bogging the entire process down in thinking-optional partisan patty cake.

Under the din of this dysfunction, Senator Ron Wyden was quick to highlight at the hearing that the FCC doesn't look particularly good here regardless of your political leaning:

"Senator Ron Wyden...stated in an email to Gizmodo that the agency’s response to Gizmodo’s FOIA request raised "legitimate questions about whether the agency is being truthful when it claims a DDoS attack knocked its commenting system offline."

The Oregon senator said it was critical that the agency produce evidence of the attack, if only so independent experts could verify and learn something from it. He continued: "If the FCC did suffer a DDoS attack and yet created no written materials about it, that would be deeply irresponsible and cast doubt on how the FCC could possibly prevent future attacks. On the other hand, if FCC is playing word games to avoid responding to FOIA requests, it would clearly violate Chairman Ajit Pai’s pledge to increase transparency at the FCC."

The FCC's contention is that for fifteen hours after the attack, nobody sent an e-mail, wrote a memo, or documented this supposed attack in any fashion. And again, this lack of transparency about any of this is in stark contrast to FCC boss Ajit Pai's repeated, breathless claims that he was going to bring a new wave of transparency to the agency. This lack of transparency will become increasingly stark as the agency continues to gut popular, meaningful consumer protections -- leaving the only thing standing between you and your carrier's bullshit an unelected bureaucrat that believes anti-competitive behavior in the telecom sector isn't a real problem.

Filed Under: ajit pai, ddos, fcc, john oliver, lies, ron wyden

FCC Won't Release Data To Support Its Claim A DDOS Attack, Not John Oliver, Brought Down The Agency's Website

from the not-so-transparent-after-all dept

You might recall that when HBO comedian John Oliver originally addressed net neutrality on his show in 2014, the FCC website crashed under the load of concerned consumers eager to support the creation of real net neutrality rules. When Oliver revisited the topic last May to discuss FCC boss Ajit Pai's myopic plan to kill those same rules, the FCC website crashed under the load a second time. Both instances did a fantastic job highlighting how satire often tops traditional journalism in driving interest toward what can often be rather wonky tech policy issues.

But then something weird happened. In the midst of all the attention Oliver was receiving for his segment, the FCC issued a statement (pdf) by FCC Chief Information Officer David Bray, claiming that comprehensive FCC "analysis" indicated that it was a malicious DDoS attack, not angry net neutrality supporters, that brought the agency's website to its knees:

"Beginning on Sunday night at midnight, our analysis reveals that the FCC was subject to multiple distributed denial-of-service attacks (DDos). These were deliberate attempts by external actors to bombard the FCC’s comment system with a high amount of traffic to our commercial cloud host. These actors were not attempting to file comments themselves; rather they made it difficult for legitimate commenters to access and file with the FCC."

But this claim that a DDoS disabled the FCC website at coincidentally the exact same time Oliver's segment was airing raised a few eyebrows among security experts, who noted they saw none of the usual online indicators pointing to a DDoS attack, nor any evidence of an attack via publicly-available logs. Security analysts noted the FCC provided no evidence to support their claim of an attack, and the agency has consistently and repeatedly refused to offer any additional hard detail, despite being prodded by several Senators on the subject.

Hoping to glean a little more information, Gizmodo recently filed a FOIA request asking for server logs or documents offering more insight into this supposed attack. What they found is that the FCC never conducted said "analysis" of the attack in the first place:

"The FCC now tells Gizmodo, however, that it holds no records of such an analysis ever being performed on its public comment system; the agency claims that while its IT staff observed a cyberattack taking place, those observations “did not result in written documentation."

Gizmodo's FOIA request asked for "all communications between employees in the offices of Chairman Ajit Pai and Commissioner Michael O’Rielly" concerning the alleged cyberattack, as well as copies of "any records related to the FCC 'analysis' (cited in Dr. Bray’s statement) that concluded a DDoS attack had taken place." What they got instead was 17 pages of heavy redactions and nonsense (including several user complaints about what Pai's been up to) and a rotating crop of excuses for why the FCC couldn't be more transparent about the alleged attack:

"The agency cited a variety of reasons for why it was refusing to release 209 documents related to the purported DDoS attack. Some of the records, it says, contain “trade secrets and commercial or financial information” which it deems “privileged or confidential,” citing the Trade Secrets Act. Other documents were withheld in an effort to “prevent injury to the quality of agency decisions,” citing a FOIA exemption that typically protects attorney-client communications but also extends to documents that reflect “advisory opinions, recommendations and deliberations” as part of the government’s decision-making processes."

It didn't take long for news outlets to highlight the FCC's refusal to be clear about what happened, prompting the agency to e-mail this press release to reporters, deriding said reports as "completely irresponsible":

"Media reports claiming that the FCC lacks written documentation of its analysis of the May 7-8 non-traditional DDoS attack that took place against our electronic comment filing system are categorically false. In its FOIA request, Gizmodo requested records related to the FCC analysis cited in Dr. David Bray’s May 8 public statement about this attack. Given that the Commission’s IT professionals were in the midst of addressing the attack on May 8, that analysis was not reduced to writing. However, subsequent analysis, once the incident had concluded, was put in writing. Indeed, analysis was made public in response to a request from Capitol Hill.

“Moreover, the FCC has never stated that it lacks any documentation of this DDoS attack itself. And news reports claiming that the Commission has said this are without any basis and completely irresponsible. In fact, we have voluminous documentation of this attack in the form of logs collected by our commercial cloud partners."

But while the FCC's statement proclaims the agency has oodles of documentation detailing the supposed DDoS (it just doesn't want to reveal it), that's the precise opposite of what the agency is telling reporters that have filed FOIA requests to get a hold of it:

So it seems like there's two options here. One is that there really was some kind of non-traditional DDoS attack, but the agency failed to conduct a detailed written analysis of what caused it, and despite boss Ajit Pai's breathless dedication to transparency, has zero interest in being up front about it.

The other possibility is the entire attack narrative was poorly-constructed bullshit, feebly designed to try and deflate the "John Oliver effect" in the media and downplay the volume of consumers pissed off about what Ajit Pai is up to. And now that Senators and reporters are pushing harder for actual evidence, the FCC is having to engage in some comical tap dancing to obfuscate the fact it made up a DDOS attack as a lame (and ineffective) PR ploy.

The former's certainly possible, but the latter's also in character. Either way, expect this and the agency's willful disregard of comment proceeding fraud to pop up in the inevitable lawsuits awaiting Ajit Pai when he rams through the final net neutrality killing vote later this year.

Filed Under: ajit pai, comments, ddos, fcc, john oliver, net neutrality

The FCC Claims A DDoS Attack -- Not John Oliver -- Crashed Its Website. But Nobody Seems To Believe Them

from the botnet-bravado dept

We just got done noting that the FCC's commenting system crashed after comedian John Oliver's latest bit on net neutrality last weekend. Given that Oliver's first bit on net neutrality did the exact same thing, it didn't take long before the media wires were filled with stories about how a flood of outraged net neutrality supporters had crippled FCC systems. Again.

But then something interesting happened. The FCC issued a statement (pdf) claiming that the agency's website didn't crash because of a flood of annoyed net neutrality supporters, but crashed due to "multiple DDoS attacks" that just happened to have been launched at the exact same time Oliver announced a specially crafted URL (GoFCCYourself.com) to make commenting on the FCC's net neutrality-killing NPRM easier:

"Beginning on Sunday night at midnight, our analysis reveals that the FCC was subject to multiple distributed denial-of-service attacks (DDos). These were deliberate attempts by external actors to bombard the FCC’s comment system with a high amount of traffic to our commercial cloud host. These actors were not attempting to file comments themselves; rather they made it difficult for legitimate commenters to access and file with the FCC. While the comment system remained up and running the entire time, these DDoS events tied up the servers and prevented them from responding to people attempting to submit comments. We have worked with our commercial partners to address this situation and will continue to monitor developments going forward."

And while that may or may not be true, there's a rising tide of skepticism about the FCC's statement. For one, requests from multiple news outlets for additional detail on the scope and nature of the attack were met with total silence by the agency. And multiple security experts were quick to point out that there were none of the usual indicators, claims of responsibility or online chatter you see online ahead of many DDoS attacks:

"There don’t appear of be any indications of a DDoS attack in the sensors we use to monitor for such things,” said John Bambenek, a threat intelligence manger at Fidelis Cybersecurity. “It appears the issue with the FCC is less of a DDoS attack, traditionally defined, and more of an issue of crowdsourcing comments generated by John Oliver and reddit."

Jake Williams, CEO of cybersecurity firm Rendition InfoSec, said the agency “offered no support” to prove a DDoS had occurred.

"There was no observed DarkWeb chatter about such a DDoS before or after the event and no botnets that I’m monitoring received any commands ordering a DDoS on the FCC’s site,” Williams said.

Of course that's not definitive proof that the there wasn't a DDoS attack, but the fact that the FCC isn't willing to offer a shred of additional detail -- along with the timing of the mystery "attack" -- remains curious. And given that this is the same FCC that has spent the last few months claiming that gutting all regulatory oversight and public accountability of some of the least liked and least competitive companies in America somehow "restores freedom," lying in a feeble attempt to squash the media narrative that a flood of pissed off consumers broke the FCC's website wouldn't be out of character for the Ajit Pai-led agecy.

Of course, there's one way to settle any confusion: the FCC could release logs of its network traffic during the attack. Net neutrality activists were quick to demand as much. As was Senator Ron Wyden, who fired off a letter to the FCC asking for some hard data on the width and breadth of the attack. If it really was a malicious attack -- and not just a throng of consumers genuinely annoyed by the FCC's wave of recent anti-consumer behavior -- it shouldn't be particularly hard to prove.

Filed Under: comments, ddos, fcc, john oliver, net neutrality

Chinese Company Recalls Cameras, DVRs Used In Last Week's Massive DDoS Attack

from the internet-of-broken-things dept

For some time now, security researchers have been warning that our lackadaisical approach to Internet of Things security would soon be coming home to roost. Initially it was kind of funny to read how "smart" fridges, tea kettles and Barbie dolls did an arguably worse job than their dumb counterparts with a greater risk to privacy and security. But as we collectively realized that these devices not only created millions of new home and business attack vectors, but could also be used to wage historically-unprecedented DDoS attacks, things quickly became less amusing.

Last week, the theoretical became very real with the massive attack on DNS provider DYN, which knocked a swath of companies and services off the internet for a large portion of Friday. In a piece discussing the attack over at Flashpoint, the security firm (which worked with Akamai to help DYN) notes that the DDoS was indeed thanks to compromised IoT devices, and the Mirai botnet malware recently released to make compromising and harnessing such devices easier than ever. But the group also notes that targeted devices included everything from cameras to... your cable DVR:

"Mirai malware targets Internet of Things (IoT) devices like routers, digital video records (DVRs), and webcams/security cameras, enslaving vast numbers of these devices into a botnet, which is then used to conduct DDoS attacks. Flashpoint has confirmed that at least some of the devices used in the Dyn DNS attacks are DVRs, further matching the technical indicators and tactics, techniques, and procedures (TTPs) associated with previous known Mirai botnet attacks."

Brian Krebs notes that the lion's share of these devices were manufactured by a Chinese company named XiongMai Technologies, which almost instantly found a huge swath of its product line contributing to the attack:

"It’s remarkable that virtually an entire company’s product line has just been turned into a botnet that is now attacking the United States,” Nixon said, noting that Flashpoint hasn’t ruled out the possibility of multiple botnets being involved in the attack on Dyn. At least one Mirai [control server] issued an attack command to hit Dyn,” Nixon said. “Some people are theorizing that there were multiple botnets involved here. What we can say is that we’ve seen a Mirai botnet participating in the attack."

For what it's worth, XiongMai was quick to issue a statement announcing that it would be recalling some of its products (mostly webcams), while strengthening password functions (Mirai often depends on default usernames and passwords) and sending users a patch for products made before April of last year. It also issued a poorly translated statement on its role in bringing the U.S. Internet to a crawl for much of Friday:

"Security issues are a problem facing all mankind. Since industry giants have experienced them, Xiongmai is not afraid to experience them once, too," the company statement said.

And while that's all well and good, that's just one company. There are dozens upon dozens of companies and "IoT evangelists" that refuse to acknowledge that they put hype and personal profit ahead of security, by proxy putting the entire internet at risk. Not only do most of these devices lack even the most fundamental security, they usually provide no functionality to help users determine if they're generating traffic or participating in attacks. And these devices are often sitting behind consumer-grade routers on the network that have equally flimsy security while using default username and password combinations.

So while it's nice to see at least one company almost admit culpability, this really is little more than a small drop in a very deep ocean of dysfunction. It's going to take a lot more naming and shaming of the companies that pushed "smart" but idiotic and poorly-secured technologies on consumers if we're to avoid significantly worse (and potentially fatal) attacks.

Filed Under: botnet, cameras, china, ddos, dvrs, mirai, recall
Companies: dyn, xiongmai

Dumb & Dumber Claims About Last Week's Internet Attack (SOPA?!? Really?)

from the take-your-pick dept

As you know, last week, large chunks of the internet spent hours writhing on the ground and totally inaccessible thanks to a giant DDoS attack that appears to have been launched via a botnet involving insecure DVR hardware (which can't be patched -- but that's another post for later). Of course, whenever this kind of thing happens, you know that some people on the politics side of things are going to come up with dumb responses, but there were some real whoppers on Friday. I'm going to focus on just two, because I honestly can't decide which one of these is dumber. I'll discuss each of them, and then you guys can vote and let us know: which of these is dumber.

First up, we've got Marsha Blackburn, who is not just a member of Congress, but (incredibly) on the House Subcommittee on Communications and Technology, which is often considered to the subcommittee that handles internet related issues. We've written about her quite a few times before, highlighting her efforts to block broadband competition and gut net neutrality. She's also argued that fair use is just a buzzword and we need stronger copyright laws. Not surprisingly, she was one of the most vocal supporters of SOPA who only finally agreed to dump the bill days after the giant online protest.

And apparently she's still upset about all that.

On Friday she went on CNN to discuss a variety of things, and the first question from Wolf Blitzer was about the DDoS attacks, and her answer is the sort of nonsense word salad that is becoming all too common in politics these days, but where she appears to suggest that if we'd passed SOPA this kind of attack wouldn't have happened. She's not just wrong, she's incredibly clueless. Here's what she said:

Wolf, you don't know who is behind this, you do not know if it's foreign or domestic. What I do know is over the years we have tried to pass a data security legislation. There's been bipartisan agreement in the House. It has not moved forward in the Senate. We also know that a few years ago we tried to do a bill called SOPA in the House which would require the ISPs to do some governance on these networks and to block some of the bad actors.

And of course, there were all of the cyberbots that took out after us that were trying to say 'no you can't do that you're going to impede our free speech.' We said 'no we're trying to keep the roadway clear and to keep some of these bad actors out of the system.'

So, what you have now, whether it is foreign or domestic, no one knows. No one knows who has released some ransomware, spyware, malware into the system that is cau... and bear in mind also this malware can live on your system for a year or much longer before it is detected.

And that is how you've had some of these extensive data breaches because the malware gets into the system, it rests there, it is pulling information and at some point, it activates. And as I tell my constituents, be careful what websites you go to, be careful what emails you open because you may be unintendedly inviting that malware or spyware into your system.

Okay, so. Almost nothing that is said above has anything to do with the DDoS attack. Not at all. Not the "data protection" bill, which is basically about requiring companies to reveal breaches to those impacted. But most certainly not SOPA, which had nothing whatsoever to do with anything having to do with cybersecurity or online attacks or DDoS. And "cyberbots"? Is she implying that the millions of people who spoke out against SOPA were some sort of fake bots? SOPA wouldn't have done anything to stop this kind of attack at all. It had nothing to do with this issue in any way shape or form. Not that Wolf Blitzer seems to know or care about any of that as he just accepts that answer and moves on.

So that's the first dumb response. Now the second: the IANA transition. We've been discussing this for years, and as we've explained, the transition is a good thing in taking an argument away from countries like Russia and China who have been trying to get more control over internet governance, by dropping an almost entirely superficial connection between the fairly minor IANA function and the US Commerce Dept. The transition happened a few weeks ago and nothing on the internet has changed, nor will it, because of this transition. It's a non-story. But, Ted Cruz tried to make it a story and now it's become a partisan thing for no good reason at all. And thus, given an opportunity, partisan sites are blaming the IANA transition for the DDoS:

Today there was a major attack on a part of the Internet that few people pay any attention to. It’s critically important though, and any disruption threatens both our prosperity as Americans, but also our freedom to communicate with each other.

This is a great reminder of why President Obama’s Internet handover plans are so threatening to our way of life.

Probable foreign attackers effectively took thousands of companies off of the Internet today by attacking a major Domain Name Service (DNS) provider: Dyn. This two-hour outage surely cost many people, very much money.

What is DNS, and why is it so important? Put simply, DNS is the system that tells people how to find you online. It converts the names of servers and sites, into numbers that the Internet Protocol can find. It’s an essential service of the commercial Internet.

And yet Barack Obama is trying to hand control of DNS over to the Chinese and the Russians. Ted Cruz has been warning people about this, and so have I. People tend to tune it out, because it sounds like a very technical, obscure issue that isn’t very important.

Well, first of all, newsflash: the transition happened three weeks ago, and Neil Stevens at Red State is so concerned about this he didn't even notice. Damn. Sneaky Obama. Second, the hand over of the IANA functions has absolutely nothing to do with a DDoS attack or what it would take to prevent it. Yes, there are some ridiculous aspects to the DNS system, some of which are managed by ICANN. But (1) the IANA transition has nothing to do with "handing control" over to the Chinese or Russians (in fact, it's the opposite -- it takes a big argument away from the Russians and Chinese that they had been using to try to seize more control, and actually makes it much more difficult for them to take control by making sure nationstates actually have very little say in internet governance). And (2) the IANA transition has fuck all to do with DDoS attacks.

Both of these examples seem to be completely clueless, technically illiterate people using real problems (the fragility of DNS systems, the massive unsecured bot-infested systems out there, the ease of taking down important systems, overly centralized critical systems), and using them to pitch some entirely separate personal pet complaint or project. But both are completely ignorant. The only question is which one is worse:

Filed Under: attacks, cybersecurity, data protection, ddos, dns, iana, iana transition, marsha blackburn

'Nice Internet You've Got There... You Wouldn't Want Something To Happen To It...'

from the this-is-no-longer-theoretical dept

Last month, we wrote about Bruce Schneier's warning that certain unknown parties were carefully testing ways to take down the internet. They were doing carefully configured DDoS attacks, testing core internet infrastructure, focusing on key DNS servers. And, of course, we've also been talking about the rise of truly massive DDoS attacks, thanks to poorly secured Internet of Things (IoT) devices, and ancient, unpatched bugs.

That all came to a head this morning when large chunks of the internet went down for about two hours, thanks to a massive DDoS attack targeting managed DNS provider Dyn. Most of the down sites are back (I'm still having trouble reaching Twitter), but it was pretty widespread, and lots of big name sites all went down. Just check out this screenshot from Downdetector showing the outages on a bunch of sites: You'll see not all of them have downtime (and the big ISPs, as always, show lots of complaints about downtimes), but a ton of those sites show a giant spike in downtime for a few hours.

So, once again, we'd like to point out that this is as problem that the internet community needs to start solving now. There's been a theoretical threat for a while, but it's no longer so theoretical. Yes, some people point out that this is a difficult thing to deal with. If you're pointing people to websites, even if we were to move to a more distributed system, there are almost always some kinds of chokepoints, and those with malicious intent will always, eventually, target those chokepoints. But there has to be a better way -- because if there isn't, this kind of thing is going to become a lot worse.

Filed Under: attack, ddos, dns, internet, vulnerabilities
Companies: dyn

Akamai: 12-Year-Old SSH Vulnerability Fueling Internet-Of-Broken-Things DDoS Attacks, And Worse

from the security-as-a-distant-afterthought dept

We've increasingly covered how the "internet of poorly secured things" has contributed to a rise in larger DDoS attacks than ever before. The barely-there security standards implemented by companies more interested in hype than quality meant it didn't take long before hackers were able to incorporate "smart" refrigerators, power outlets, TVs and other IoT devices in the kind of DDoS attacks that recently took down security researchers like Brian Krebs. The end result is DDoS attacks that continue to break records, first 620Gbps in the Krebs attack, then more recently a 1.1 terabits per second attack on a French web host.

But just how bad have things become? A new report by Akamai warns that hackers are using a 12-year-old vulnerability in OpenSSH to funnel malicious network traffic through IoT devices. SSH certainly can be implemented securely, but as with every other security aspect of the IoT, many hardware vendors aren't bothering to do so. Akamai's data indicates roughly 2 million devices have been compromised by this type of hack, which the firm dubs SSHowDowN.

CVE-2004-1653 is a default configuration in old versions of OpenSSH that can be exploited by an attacker to forward ports, letting a hacker route malicious traffic through the device as part of the overall DDoS command and control infrastructure. To pull this off you need the device's admin username and password; certainly not a problem in the IoT space where default logins are often the norm. Akamai notes that many IoT devices not only ship with this vulnerability intact, but with no ability to fix it:

"We’re entering a very interesting time when it comes to DDoS and other web attacks; ‘The Internet of Unpatchable Things’ so to speak,” explained Ory Segal, senior director, Threat Research, Akamai. “New devices are being shipped from the factory not only with this vulnerability exposed, but also without any effective way to fix it. We’ve been hearing for years that it was theoretically possible for IoT devices to attack. That, unfortunately, has now become the reality."

Of course the internet-of-poorly-secured things isn't just useful for DDoS attacks. Brian Krebs has penned a new blog post noting how criminals are often using hacked IoT hardware as proxies to obscure their real location as they engage in tax return fraud and other criminal activity, courtesy of your not-so-smart WiFi-enabled tea kettle or home-automation system. An anonymous researcher tells Krebs he was able to track the various "honeypot" systems he configured as they were traded and sold as malware-infested proxies in exchange for bitcoin.

In short, flimsy Internet of Things security, combined with already often-dubious embedded security in routers, is kind of a throwback to the wild west of the 1990s when the idea of your mom's PC as a botnet participant was kind of novel. Krebs' source puts it this way:

"In a way, this feels like 1995-2000 with computers," my source told me. "Devices were getting online, antivirus wasn’t as prevalent, and people didn’t know an average person’s computer could be enslaved to do something else. The difference now is, the number of vendors and devices has proliferated, and there is an underground ecosystem with the expertise to fuzz, exploit, write the custom software. Plus, what one person does can be easily shared to a small group or to the whole world."

And again, while the abysmal state of IoT security can often be funny, firms like Gartner predict that the population of Internet of Things devices will top 20.8 billion by 2020, up from 6.4 billion or so today. Researchers like Bruce Schneier have been warning for some time that the check is about to come due in the form of attacks that may put human lives at risk at an unprecedented scale, lighting a fire under researchers who believe that automated cyberdefense and self-healing network technologies we haven't invented yet are what stand between us and the not-so-smart device cyber apocalypse.

Filed Under: ddos, iot, security, ssh
Companies: akamai

Hackable Speed Cameras Highlight Risk Of Rush Toward IoT-Enabled 'Smart' Cities

from the if-you-build-it-(poorly)-they-will-come dept

We've been talking at length about how the lack of security in the Internet of Things space is seen as a sort of adorable joke, but isn't always a laughing matter. While the hillarious stupidity of some of the "smart" products flooding the market is undeniable, the reality is that the abysmal state of security in "IoT" devices (read: little to none) is creating millions of new attack vectors every year. And as Bruce Schneier recently warned, it's only a matter of time before the check comes due, and these vulnerabilities contribute to hacking attacks on core infrastructure resulting in notable fatalities.

Refrigerators that leak your Gmail credentials are one thing, but this looming calamity is going to be made notably worse by the rush toward "smart" cities. The same hardware vendors that can't bother to secure their consumer-side hardware haven't done a much better job securing the gear they're shoveling toward cities under the promise of a better, more connected tomorrow. Case in point: Kaspersky Lab researchers have discovered that a significant number of city speeding cameras are, you guessed it, easily hackable:

"According to Vladimir Dashchenko and Denis Makrushin from Kaspersky Lab, these devices can be easily manipulated. The results were published in a security conference paper about the security hazards in smart cities...The Russian researchers were using the Shodan search engine to explore the security implications of the "smart city" fad. They hypothesized that the rush to deploy high-tech, "Internet of things" devices to improve the municipal infrastructure often meant that security was left behind.

And they were right. Except security wasn't just subpar on speed cameras made by vendors like Redflex Traffic Systems. In many instances it didn't exist whatsoever:

"We decided to check that passwords were being used," Dashchenko and Makrushin wrote. "Imagine our surprise when we realized there was no password and the entire video stream was available to all Internet users. Openly broadcast data includes not only the video stream itself, but additional data, such as the geographical coordinates of cameras, as well."

The researchers noted that even in not-so-smart cities, the cameras are already processing gigabytes of citizens' data with little to no protection. Worse, the researchers found that given these cameras are tied to larger networks, hackers could potentially gain access to databases of stolen vehicles and add or remove vehicles from said lists. Their full paper, Fooling The Smart City (pdf), is worth taking a look at, and highlights how a significant number of kiosks -- used for everything from ticket sales to bicycle rentals -- are also vulnerable.

The result isn't just an exponential explosion in vulnerabilities. These compromised devices are now being used in historically massive new DDoS attacks, that appear to be getting larger by the day. On the heels of the recent, record-setting 620 gigabit-per-second DDoS attack against Brian Krebs (which was fueled in part by compromised IoT devices), a new attack this week launched against a French web host peaked at an incredible 1.1 terabits per second, driven in part by -- you guessed it -- hacked security cameras.

Krebs subsequently noted this week that the source code for the IOT-fueled DDoS that took down his website has been released, all but guaranteeing that mammoth, even larger attacks fueled by not-so-smart cars, not-so-smart locks, and not-so-smart power outlets are about to become the norm.

Filed Under: brian krebs, ddos, hackable, iot, speed cameras