The Internet Of Poorly Secured Things Is Fueling Unprecedented, Massive New DDoS Attacks

from the build-it-poorly-and-they-will-come dept

Last week, an absolutely mammoth distributed denial of service (DDoS) attack brought down the website of security researcher Brian Krebs. His website, hosted by Akamai pro bono, was pulled offline after it was inundated with 620Gbps of malicious traffic, nearly double the size of the biggest attack Akamai (which tracks such things via their quarterly state of the internet report) has ever recorded. Krebs was ultimately able to get his website back online after Google stepped in to provide DDoS mitigation through its Project Shield service.

According to Krebs, the attack came, he believes, after he began digging more deeply into various gangs that deliver DDoS attacks on-demand. And according to Krebs, this time they had the help of the hystercially piss poor security of the internet of things (IoT) industry:

"There are some indications that this attack was launched with the help of a botnet that has enslaved a large number of hacked so-called “Internet of Things,” (IoT) devices — routers, IP cameras and digital video recorders (DVRs) that are exposed to the Internet and protected with weak or hard-coded passwords."

So not only are "smart" refrigerators, TVs, tea kettles and power outlets leaking your unencrypted data to any nitwit with a modicum of technical knowledge, they're being utilized to amplify existing attacks on security researchers who are actually trying to make things better. The attack comes directly on the heels of Bruce Schneier warning us the check is about to come due -- after IoT companies and evangelists that prioritized hype and sales over security fundamentals helped introduce millions of new network attack vectors into the wild over the last five years or so.

In a recent blog post, Schneier also noted that these larger DDoS attacks come as multiple groups and individuals (likely nation state sponsored hackers) have begun probing for vulnerabilities on an unprecedented scale:

"Recently, some of the major companies that provide the basic infrastructure that makes the Internet work have seen an increase in DDoS attacks against them. Moreover, they have seen a certain profile of attacks. These attacks are significantly larger than the ones they're used to seeing. They last longer. They're more sophisticated. And they look like probing. One week, the attack would start at a particular level of attack and slowly ramp up before stopping. The next week, it would start at that higher point and continue. And so on, along those lines, as if the attacker were looking for the exact point of failure."

And they're finding, as many have warned, millions of poorly secured Internet of Things "smart" devices with stupid default passwords -- or in many instances no security at all. In most instances the buyers of these products are utterly clueless of their participation in these botnets, and very frequently these devices don't give the end user transparent end control over what's being sent over the network anyway.

In a follow-up blog post by Krebs, he makes it clear that in addition to being immensely dangerous (potentially fatal if the right systems are targeted), these larger scale DDoS attacks propped up by the IoT should also be seen as a growing assault on free speech. After all, few independent journalists would be able to afford the kind of DDoS mitigation technologies necessary to truly stop these new, larger attacks:

"In an interview with The Boston Globe, Akamai executives said the attack — if sustained — likely would have cost the company millions of dollars. In the hours and days following my site going offline, I spoke with multiple DDoS mitigation firms. One offered to host KrebsOnSecurity for two weeks at no charge, but after that they said the same kind of protection I had under Akamai would cost between $150,000 and $200,000 per year.

For a country that likes to talk a lot about cybersecurity (mostly to justify awful government policy like backdoors that make us less secure than ever), the United States isn't doing all that much to mitigate the looming threat. Much like Schneier, Krebs calls for a more coordinated effort by industry and government to wake up and begin greater institutional-grade collaborative efforts to shore up our collective security before things spiral out of control:

"I don’t know what it will take to wake the larger Internet community out of its slumber to address this growing threat to free speech and ecommerce. My guess is it will take an attack that endangers human lives, shuts down critical national infrastructure systems, or disrupts national elections."

And it probably goes without saying that this threat looms as we ponder electing two of the least technically sophisticated Presidential candidates in recent memory. These are two researchers who aren't prone to hyperbole, so it seems like we might just want to take their advice before the Internet of Things devolves from a running gag into a potentially fatal shitshow.

Filed Under: brian krebs, ddos, iot, security
Companies: akamai

Rather Than Launch A Massive DDoS Attack, This Time China Just Asks GitHub To Take Down Page It Doesn't Like

from the not-that-it-works-any-better dept

You may recall that a year ago, a massive DDoS attack was launched against GitHub from China. The attack itself was somewhat clever, in that it effectively turned the Great Firewall around, using Chinese search engine Baidu's ad platform and analytics platform to basically load code that contributed to the attack. The target of the attack were two tools that helped people in China access material that was blocked in China by the Great Firewall. Of course, this attack was actually the second attempt by China to stop people from accessing such information on GitHub. The first attack involved just using the Great Firewall to block GitHub entirely (it needed to block the entire GitHub, rather than just specific pages, because GitHub is all HTTPS) -- but that caused Chinese programmers who rely on GitHub to freak out and point out that they rely on GitHub to do their jobs.

Well, this third time, China is trying a different approach: it's sent a takedown request to GitHub, asking if a certain page can be removed for "malicious slander." Since GitHub posts all its government takedown notices, you can see the full request, which is rather short and sweet:

Cyber Security Association of China

To whom this might be concerned at GitHub:

The post at https://github.com/programthink/zhao/issues/38 vilifies our President Xi as a murder suspect, which is a groundless and malicious slander. We hereby express our strong concern and request you to take it off your website at the earliest time possible.

Cyber Security Association of China

June 8, 2016

Address: No.190 Chaoyangmennei Street, Dongcheng District, Beijing. Zip Code: 100010

The blog post link above where we found this story also notes that the entire repo that includes this content is currently not accessible in China, though it's accessible outside of China. At the very least, that suggests that GitHub disabled access to it within the country. It's, of course, unknown if China believes that disabling access just from within China is enough based on its takedown, but it is the equivalent of just blocking it via the Great Firewall -- so perhaps.

Filed Under: china, ddos, takedown
Companies: github

Yes, Switching To HTTPS Is Important, And No It's Not A Bad Thing

from the we-need-encryption dept

Last month we wrote about Mozilla's move to deprecate HTTP in favor of encrypted HTTPS, which followed on Chrome's move to do something similar. What surprised me a bit was the response from many in our comments who didn't think this was a good idea. People talked about how it added complications to development, or pointed to problems with the whole concept of trusting certificate authorities and a variety of other problems. Some worried about the costs associated with getting a certificate. Ben Klemens, who has written eloquently for years about the problems of software patents, wrote an article noting that this would make it difficult for individuals to easily set up their own web platforms, and require them to rely on a third party with whom you'd have to identify yourself (the certificate authority).

Of course, there are many attempts to deal with these issues, such as the big Let's Encrypt project from EFF and others to offer free certificates. And, if you're hosting websites online, you're likely already going through a third party hosting provider, and it's not clear how dealing with a certificate authority is really all that different.

But the most compelling argument I've seen for why this is so important comes from Eric Mill, who discusses why this is so important by highlighting the many, many ways in which the web has changed over the past few years -- allowing both companies and governments to readily abuse the unencrypted nature of the legacy web, putting all of us at risk. This is a real problem that HTTPS goes a long way in solving:

But when I look at the last few years, I see a very different web than the one I was introduced to:

• Verizon injects tracking headers into unencrypted traffic so they can sell your browsing activity to advertisers. This program started in 2012, after Verizon realized they "had a latent asset", but wasn't noticed until 2014.
• Other companies like Turn piggyback on Verizon's tracking header to sell your data to even more people, because they "are trying to use the most persistent identifier that we can in order to do what we do", says Turn's chief privacy officer.
• Comcast injects ads into unencrypted traffic, because "it's a courtesy, and it helps address some concerns that people might not be absolutely sure they're on a hotspot from Comcast".
• Andreas Gal (Mozilla's CTO, in his personal capacity) has claimed that Yahoo and Bing "can acquire search traffic by working with large Internet Service providers" to harvest users' Google search results to improve their own -- and strongly implies that they used to do this before Google shut them out through encryption. Even if you support better competition against Google, I doubt you expected your ISP to make deals to sell your traffic to other corporations without your knowledge.
• The nation of India tried and failed to ban all of GitHub. HTTPS meant they couldn't censor individual pages, and GitHub is too important to India's tech sector for them to ban the whole thing.
• The nation of China weaponized the browsers of users all over the world to attack GitHub for hosting anti-censorship materials (since like India, they can't block only individual pages) by rewriting Baidu's unencrypted JavaScript files in flight.

We discussed that last one last month as well, in noting how HTTPS would prevent attacks like the one China launched (and is constantly launching elsewhere as well).

And, also, it's not just corporate abuse, but government/intelligence community abuse as well:

The NSA scans just about everything that goes through the internet backbones and saves as much of it as possible, in collaboration with intelligence agencies around the world. This is called "upstream collection", and their "posture" is to "collect it all".

The NSA's upstream collection program has not been reformed. It will not be reformed by the current draft of the USA Freedom Act, in fact was endorsed by the only government agency whose job it is to review it, and the most meaningful court victory so far -- while a wonderful and important precedent -- addresses a separate program that only touches data about telephone calls.

After the Charlie Hebdo attacks, France is now making bulk internet spying explicitly legal and giving its intelligence services vast powers to work with ISPs to surveil the network.

The United Kingdom is likely to do something similar, after Cameron's strong re-election means he can make good on his pledge to make all online communication subject to monitoring.

Pretty much everyone agrees that the security certificate system has its problems. We've been pointing that out for years. But encouraging more encryption now is solving real problems today. And, as Mill notes, Klemens' and others' concerns about this move towards HTTPS being a kind of "recentarlization" of the web are also misguided. All of those examples above show how big companies and governments are, themselves, abusing the unencrypted nature of the internet to take control and force a distributed system to act more like a centralized system by inserting themselves in the middle. HTTPS actually helps protect a more decentralized web by blocking those man in the middle attacks:

When I look at all these things, I see companies and government asserting themselves over their network. I see a network that is not just overseen, but actively hostile. I see an internet being steadily drained of its promise to "interpret censorship as damage".

In short, I see power moving away from the leafs and devolving back into the center, where power has been used to living for thousands of years.

What animates me is knowing that we can actually change this dynamic by making strong encryption ubiquitous. We can force online surveillance to be as narrowly targeted and inconvenient as law enforcement was always meant to be. We can force ISPs to be the neutral commodity pipes they were always meant to be. On the web, that means HTTPS.

The security certificate system isn't perfect. But an unencrypted web has serious and dangerous flaws that put us all at risk. In the old days, people could keep their homes unlocked as well, but that got widely exploited so now most of us lock our doors. It's not perfect and it has problems, but the overall protection is worth it. That's even more true online where encryption is important in enabling greater freedom of expression and protection of privacy.

Filed Under: attacks, centralized, ddos, distributed, eric mill, http, https, privacy, security

Wall Street Journal Suggests Snowden Gave China Its 'Great Cannon' Software... Based On Pure Random Speculation

from the journalism! dept

There's been lots of talk lately about China's "Great Cannon" -- the DDoS tool that China used to launch a massive attack on GitHub a few weeks ago. Much of the research on this tool was provided by Citizen Lab. That report is great and interesting. And then, the Wall Street Journal -- still a respected news source -- jumps in to speculate wildly based on nothing in particular, that Ed Snowden gave China NSA source code to build the Great Cannon.

Edward Snowden sabotaged the intelligence capabilities of the U.S. and its allies, and now we learn he may have given the Chinese regime a weapon to spread Internet censorship across the planet. The Great Firewall, the unofficial name for a suite of blocking tools, stops Chinese citizens from accessing outside information. In the past few weeks Beijing has deployed a new offensive capability, dubbed the Great Cannon.

First of all, Snowden didn't "sabotage" any intelligence capabilities at all. He revealed to journalists how the NSA and its partners were abusing certain powers, likely breaking the law. That's not "sabotage." Second, the "we learn" is not based on anything the WSJ's nameless author of the opinion piece actually "learned." It's based on wild speculation by stringing some misleading and unrelated ideas together. So we're already off to an inauspicious start to the piece.

According to a report from the University of Toronto’s Citizen Lab, the Great Cannon is similar to Quantum, a tool developed by the U.S. to track potential terrorists and criminals abroad. Snowden, a former system administrator for the U.S. National Security Agency, revealed the existence of Quantum for the first time in 2013 when he fled to Hong Kong and then Moscow.

Loose connection #1.

Did Snowden give the Chinese the code for the Great Cannon? He denies sharing anything with foreign governments. But then he’s an admitted liar, and we don’t know what the Chinese and Russian spy services have been able to copy from what he stole. In any event he alerted them to a weakness that could be exploited.

Wait, what? How is he "an admitted liar?" That seems like a stretch already, and seems like the kind of line you'd find in a conspiracy website, not the pages of the Wall Street Journal. Second, the idea that the Chinese didn't already recognize how to do online attacks via such methods until Snowden revealed it seems especially questionable. Among the other things that Snowden revealed: the NSA knows that the Chinese are among the most sophisticated in building tools for mounting online attacks. The idea that they would be totally ignorant of methods like these until Snowden's revelations came out seems difficult to believe.

A South China Morning Post report that the Great Cannon has been under development for about a year is suggestive. This means China’s hacking bureaucracy geared up to produce this new product soon after the Snowden leaks.

Loose connection #2. Also, notice that the WSJ doesn't actually link to the SCMP story, so we'll do that for you. It actually doesn't say it was in development for a year. It says that it's "been in operation for about one year." I guess the timing still sorta works if you're making loose connections, but it seems like a pretty big leap to argue that's somehow evidence that Snowden gave the info to the Chinese during his brief stay in Hong Kong.

It also means that in the name of “transparency,” Snowden and his media accomplices may have empowered one of the world’s worst censors.

Uh, no, it doesn't. If the WSJ's editorial board knew the first thing about technology, they'd know that it didn't require Ed Snowden to teach the Chinese how to build a giant DDoS machine.

This is another example of how the Western left fails to distinguish between the secrecy and surveillance required by democracies to preserve freedom and that used by dictators to quash it.

Huh? That sentence doesn't even make sense.

Either way, as one commenter noted, you'd think that the WSJ might realize that even if China modeled the Great Cannon on the NSA's Quantum, it really says something that we're building tools that can be used to censor the internet. And they should realize that's a problem. Instead, they try to blame the whole thing on Snowden, because... well, actually not for any actual reason that I can see -- just pure speculation. That's the kind of thing we'd expect to see on conspiracy theory websites. Not the Wall Street Journal.

Filed Under: china, ddos, ed snowden, great cannon, nsa, quantum, rumors, speculation
Companies: wall street journal

Another Reason To Deploy Encryption Widely: Spiking China's 'Great Cannon' Attack

from the reasons-to-be-crypto dept

A couple of weeks ago, Mike provided an in-depth analysis of China's new tactic in its longstanding efforts to restrict access by its population to material that challenges the official narrative. This powerful DDoS attack has now been dubbed "China's Great Cannon" by researchers in a fascinating analysis published by The Citizen Lab. As Mike pointed out, one reason why this new approach has been developed is that it is not possible to block individual URLs when HTTPS traffic is involved. Thus, ironically, the increased use of encryption -- which is meant to protect users online -- led to the development of a powerful new digital weapon that potentially makes them not just victims, but even part of the attack. However, encryption is also a remedy, as The Citizen Lab researchers write:

Our findings in China add another documented case to at least two other known instances of governments tampering with unencrypted Internet traffic to control information or launch attacks -- the other two being the use of QUANTUM by the US NSA and UK’s GCHQ. In addition, product literature from two companies, FinFisher and Hacking Team, indicate that they sell similar "attack from the Internet" tools to governments around the world. These latest findings emphasize the urgency of replacing legacy web protocols, like HTTP, with their cryptographically strong versions, like HTTPS.

However, the remedy is only partial. Writing on his blog, Brian Krebs quotes Bill Marczak, one of the lead authors of the Great Cannon report, as saying:

Relying on an always-on encryption strategy is not a foolproof counter to this attack, because plug-ins like https-everywhere will still serve regular unencrypted content when Web sites refuse to or don't offer the same content over an encrypted connection. What's more, many Web sites draw content from a variety of sources online, meaning that the Great Cannon attack could succeed merely by drawing on resources provided by online ad networks that serve ads on a variety of Web sites from a dizzying array of sources. "Some of the scripts being injected in this attack are from online ad networks," Marczak said. “But certainly this kind of attack suggests a far more aggressive use of https where available."

This confirms that encryption is no panacea, but is certainly worth deploying. The fact that it can make China's Great Cannon attacks harder, if not impossible, should also give pause to government officials around the world as they try to demonize encryption and call for it to be weakened or even banned.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: ddos, encryption, great cannon, great firewall, https

China's Great Firewall Turned Around: Why China Wants To Censor Global Internet

from the pay-attention----this-matters-a-lot dept

If you pay attention to Github (and you should), you know that late last week the site started experiencing some problems staying online, thanks to a massive and frequently changing DDoS attack. Over the past few days a lot more details have come out, making it pretty clear that the attack is coming via China with what is likely direct support from the Chinese government. While it's messing with all of Github, it's sending traffic to two specific Github pages: https://github.com/greatfire and https://github.com/cn-nytimes. Those both provide tools to help people in China access Greatfire and the NY Times. Notably, Greatfire itself notes that prior to the DDoS on Github, its own site was hit with a very similar DDoS attack.

If you want the technical details, Netresec explains how the DDoS works, noting that it's a "man-on-the-side" attack, injecting certain packets alongside code loaded by Chinese search engine Baidu (including both its ad platform and analytics platform), but is unlikely to be coming directly from Baidu itself.

But the much more interesting part is why China is using a DDoS attack, rather than its standard approach of just blocking access in China, as it has historically done. The key is that, two years ago, China tried to block Github entirely... and Chinese programmers flipped out, pointing out that they couldn't do their jobs without Github. The Chinese censors were forced to back down, leading to a sort of loophole in the Great Firewall. That leads to the next question of why China doesn't just block access to the URLs of the two repositories it doesn't like? And the answer there: HTTPS. Because all Github traffic is encrypted via HTTPS, China can't just block access to those URLs, because it doesn't know specifically what's being accessed.

And thus, we get the decision to turn its firewall around, launching a rather obvious DDoS attack on the two sites it doesn't like, with the rather clear message being sent to Github: if you stop hosting these projects, the DDoS will stop. Of course, so far Github is taking a stand and refusing to take down those projects (which is great and exactly what it should be doing).

However, this does suggest an interesting escalation in questions about the increasing attempts to fragment the internet. You see various countries demanding (or forcing) certain websites get blocked. But those solutions are truly only temporary. Because the overall internet is too important to block, and because some sites are necessary (like Github) there are always holes in the system. Add in a useful dose of encryption (yay!) and the ability to control everything that's read in one particular country becomes increasingly difficult. You might hope the response would be to give up attempts to censor, but China isn't likely to give up just like that. So, instead, it's basically trying to censor the global internet, by launching a high powered attack on the site that is the problem, while basically saying "get rid of these projects and we'll stop the attack."

It seems likely that this sort of escalation is only going to continue -- but in some ways it's actually a good sign. It shows that there are real cracks in China's attempts to censor the internet. We're basically realizing the limits of the Great Firewall of China, and useful services like Github have allowed a way to tunnel through. China is responding by trying to make life difficult for Github, but as long as Github and others can figure out ways to resist, censorship attempts like the Great Firewall will increasingly be useless.

In the early days of the internet, people talked about how it was resistant to censorship. Over the past decade or so, China has challenged that idea, showing that it could basically wall off large parts of the internet, and actually keep things semi-functional. Yes, there were always cracks in the wall, but for the most part, China showed that you could censor large parts of the internet. This latest move suggests that we may be moving back towards a world where the internet really is resistant to censorship -- and China is freaking out about it and responding by trying to increase the censorship globally. It's a battle that is going to be important to follow if you believe in supporting free expression online.

Filed Under: censorship, china, ddos, encryption, great firewall, injection, man in the side
Companies: github, greatfire, ny times

How The Great Firewall Of China Caused A DDOS Attack In France

from the global-village dept

Many people outside China know about the country's Great Firewall, but probably assume it will have little, if any, impact on their own online activities. However, a fascinating post on Benjamin Sonntag's blog explains how one of the servers of La Quadrature du Net, the Paris-based digital freedom association he co-founded, and for which his company provides free hosting, was hit by distributed denial of service attacks (DDOS) caused directly by the Great Firewall's policies.

His blog post provides all the technical details: it turned out that the vast majority of the attacks were coming from Chinese IP addresses. Here's what seems to have happened:

China is censoring its Internet, that's well known

to do this, this country censors (among others) DNS [Domain Name System] queries in its network (and also censoring as a side effect, the rare Japanese, Korean or Taiwanese queries going through China)

when it answers a DNS query to a censored website, it answers with "any incorrect IP address" instead.

That is, instead of letting Chinese Net users access "forbidden" content, the Great Firewall generally re-directs them to some random, presumably harmless, site. But that wasn't happening here:

we see spikes of requests to websites censored in China coming to IP addresses such as those of La Quadrature du Net. Other people had this same issue : http://furbo.org/2015/01/22/fear-china/

So, the end story is that we just saw censored websites requests coming to La Quadrature du Net's IP address from China, due to how the Chinese Internet censorship is working!

Rather than pushing limited traffic to lots of sites, the Great Firewall was sending lots of traffic to just a few. Among the possible explanations for this new behavior, Sonntag offers two that are equally worrying:

Maybe one of the system administrator of the great firewall of China is gaining some small and quick money selling DDOS, selling Internet attacks to the highest bidder (in bitcoin? ;) ) and using that censorship system as a weapon

Maybe China chose a precise list of targets to send censored traffic to, adding to this technical "useful" process (the censorship) a "nice" one (putting down foreign opponents' websites)... La Quadrature du Net, as a digital freedom association, seems to be too nice a target (among others of course).

Neither is good news for sites in the West. Whatever the real reason for this DDOS attack on La Quadrature, it certainly shows that the operation of the Great Firewall of China can have very direct effects outside that country. Another reason, perhaps, for those in the West to pay closer attention to China's increasingly harsh approach to online censorship.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: china, ddos, france, great firewall
Companies: la quadrature du net

Sony Jabs Hornets Nest, Allegedly Engages In DDoS Attacks Against Sites Hosting Leaked Documents

from the Sony-Pictures-tells-astonished-reporter-studio-is-'bigger-than-logic' dept

To be sure, there is a large amount of schadenfreude contained within the hacking of Sony Pictures. To have your dirty laundry aired for the world to see is excruciatingly painful, but Sony Corporation's past actions have drawn a target on its back on multiple occasions.

Rayne, a contributor to Marcy Wheeler's emptywheel blog, notes that Sony has been hacked 56 times in twelve years. And it has learned nothing. Passwords for Sony Pictures accounts were stashed away in a folder labeled "Passwords." The password for this folder? "Password."

So, when Sony fights back, as it is now, it's far too late. It had several chances to shore up its defenses, but it never made a serious effort to fix its security holes. Now, nearly everything has been exposed. Celebrities' personal data. Staffers' borderline racist opinions on Barack Obama's movie preferences. Its plan to join the MPAA in paying off states' attorneys general to go after Google.

Sony has issued hundreds of DMCA notices in response to the leaked documents. It has seeded bogus torrents to thwart further distribution. Now, it's allegedly decided to take an even more aggressive approach to the continuing leaks.

The company is using hundreds of computers in Asia to execute what’s known as a denial of service attack on sites where its pilfered data is available, according to two people with direct knowledge of the matter.

Sony is using Amazon Web Services, the Internet retailer’s cloud computing unit, which operates data centers in Tokyo and Singapore, to carry out the counterattack, one of the sources said.

Or not. Or possibly not at this moment. Re/code's updated post contains a denial from Amazon.

“The activity being reported is not currently happening on AWS (Amazon Web Service),” Amazon said in an emailed statement to Re/code on Thursday. Amazon declined to comment further on whether the activity happened prior to Thursday.

“AWS employs a number of automated detection and mitigation techniques to prevent the misuse of our services,” according to Amazon’s statement. “In cases where the misuse is not detected and stopped by the automated measures, we take manual action as soon as we become aware of any misuse.”

Re/code's sources say "yes." Others say this isn't happening.

CloudFlare, which offers denial-of-service protection and network monitoring, said it has not seen anything that would suggest Sony had conducted a counter-attack. The company said it would continue monitoring the situation.

If Sony is indeed engaged in DDoS attacks, it's participating in the sort of behavior it's been quick to decry in the past. Sony Pictures may be relishing the chance to turn hackers' tools against them, but its history strongly suggests it really isn't in the position to be provoking further attacks. To pursue this option is pure hubris. It's hypocrisy and stupidity rolled into one. It may think it will escape this latest hack bowed but not broken, but whatever pride it has left at this point is delusional. It has opened everything up to criticism by failing to take proper precautions and destroyed its employees' trust that their employer would make the minimum of effort to keep their internal conversations internal.

Filed Under: cfaa, ddos, emails, hack back, sony emails, sony hack, sony picture emails
Companies: sony, sony pictures

French Privacy Agency DDoS's Itself In Ordering Google To Link To It From Google France Home Page

from the what-you-get-when-you're-technologically-clueless dept

Last month, Google got hit with a €150,000 fine for its new privacy policy, which French regulators claimed violated the law. Google has been disputing this and has appealed, but as part of the ruling by the French National commission for Computing and Civil Liberties (CNIL), Google was ordered to post a statement to the home page of Google.fr about the fine, along with a link back to CNIL's website which had the full ruling. Google had asked to suspend the order to post the message until after the appeals process was complete, but that was denied. In response, Google posted the message, and promptly caused CNIL's website to go offline, as apparently the technologically clueless folks over there never realized that having a link from Google's home page in that country might lead to a bit of extra traffic.

Filed Under: cnil, ddos, france, google home page, link, privacy
Companies: google

Victims Of GCHQ's Denial Of Service Attacks Start Asking Who Are The Real Criminals?

from the doesn't-seem-right dept

Earlier today, we wrote about the latest Snowden docs, in which it was revealed that the UK spy agency, GCHQ, was engaged in DDoS attacks on people participating in Anonymous chats and other events, while also helping to identify certain participants, leading to their eventual arrests and convictions. Basically, it looks like GCHQ was engaged in widespread DDoSing, while at the same time helping to convict some kids for doing their own DDoSing. We've already questioned whether or not GCHQ is even supposed to be doing that to UK citizens (they're supposed to be focused on foreign targets), but some of those convicted are already questioning how it's right that they were convicted of the same thing that the GCHQ itself was doing to them.

Chris Weatherhead was sentenced to 18 months in prison for participating in a DDoS against Paypal, Mastercard and Visa (one of the first big Anonymous DDoS attacks, in response to those 3 companies cutting off payments to Wikileaks). Now he's pointing out that GCHQ was DDoSing his own servers, and he wonders how that's right:

My Government used a DDoS attack against servers I owned, and then convicted me of conducted DDoS attacks. Seriously what the fucking fuck?

— Chris Weatherhead (@CJFWeatherhead) February 5, 2014

Meanwhile, another Anonymous participant, Jake Davis, who was arrested and banned from the internet seems equally angry about things for pretty good reasons:

I plead guilty to two counts of DDoS conspiracy and to my face these GCHQ bastards were doing the exact same thing - http://t.co/Y4vo1qeN4I

— Jake Davis (@DoubleJake) February 5, 2014

Davis has also written a long piece concerning all this that is absolutely worth reading, asking a simple question: who are the real criminals here?

Why do British government spooks so brazenly attempt to inhibit the activities of acephalous online collectives and not, say, the hate-filled Westboro Baptist Church, or chat networks that encourage racism or paedophilia?

Or maybe the more important question: how can they even be permitted to launch these attacks at all? There's no justification for how nonchalant a democratic government can be when they breach the very computer misuse rules they strongly pushed to set in place.

When we look at what Western governments are doing - snooping on our emails, infecting our computers, intercepting our phone communications, following our avatars around in online games, backdooring our public encryption, discrediting our Internet viewing habits, encouraging illicit activity and even engaging in their own illicit activity - we have to ask ourselves: who are the real criminals here?

Others have similarly wondered if GCHQ is going to have to face charges over this, given that these actions appear to be entirely outside of its mandate and mission, and seem more compelled by just general dislike of some kids messing around.

Filed Under: anonymous, chris weatherhead, ddos, gchq, jake davis, legality, uk