Archive for April 2013 | Monthly archive page

bank of america signs

Little and Large Websites Attacked

Little and Large Websites Attacked

The coordinated attacks used to knock a large number of websites offline grew became more powerful in the past months. According to the American company Prolexic who run the world’s largest and most trusted distributed denial of service (DDoS) protection & mitigation service, there has been an eight-fold increase in the average amount of junk traffic used to take sites down.

bank-of-america logo

Chase Bank Logo

citi bank logo

wells fargo logo

Attackers have moved on from just using compromised PCs in homes and small offices to flood websites with vast volumes of traffic, and are now using Web servers, which have vastly more more bandwidth available.

The recent ongoing attack on servers running the WordPress blogging application is constantly seeking new computing power that can be harnessed to form vastly bigger botnets.

Prolexic reported that well-financed attackers  are increasingly able to coordinate with fellow crime organizations in the large-scale assaults.

These types of attacks appear to be here to stay and can only be achieved by having access to significant resources  including manpower, technical skills and an organised chain of command.

The most prominent targets of the attacks have been the America’s largest banks, including Bank of America, Wells Fargo Bank, Chase Bank which at times have become completely unreachable following the flood of traffic.

Prolexic believes these attacks are not individual youngsters flexing their muscles, because the efforts involved in the harvesting of hosts, coordination, schedules,  specifics and the sheer military precision of the attacks suggests the presence of experienced criminals that recruit ‘digital mercenary groups’ to do their work for them.

San Francisco-based CloudFlare’s network was recently bombarded by data sent by more than 80,000 servers across the Internet that all appeared to be running WordPress.

Attackers will enter a legitimate user name along with passwords that are known to be invalid, which, when repeated millions of times overwhelms the servers as they perform database lookups and then report the authentication failure which the system struggles to record it in the internal logs.

The vast increase in applications such as WordPress and Joomla  could become to this decade what the early versions of Microsoft’s Windows XP were to the previous decade. In the 2000s it was easy to compromise desktop PCs and turn them into spam-sending engines or botnets to perform various nefarious acts.

Nowadays using a server that is at least ten times as powerful as a desktop computer can do a great deal more damage.

Recent Irish websites that have been attacked include the websites for the Department of Justice and the website of the Department of Finance.

Little and Large Websites Attacked

Irish Web Design

Magnifying Glass

Web Servers Under Attack

Irish Web Design continue to monitor developments in the ongoing saga of the many web servers under attack.

Eye Graphic

The www.arstechnica.com website carried the following story on the subject in its Risk Assessment / Security & Hacktivism section.

The piece is entitled “Admin beware: Attack hitting Apache websites is invisible to the naked eye”

With the sub-heading: “Newly discovered Linux/Cdorked evades detection by running in shared memory.”

“Ongoing exploits infecting tens of thousands of reputable sites running the Apache Web server have only grown more powerful and stealthy since Ars first reported on them four weeks ago. Researchers have now documented highly sophisticated features that make these exploits invisible without the use of special forensic detection methods.

Linux/Cdorked.A, as the backdoor has been dubbed, turns Apache-run websites into platforms that surreptitiously expose visitors to powerful malware attacks. According to a blog post published Friday by researchers from antivirus provider Eset, virtually all traces of the backdoor are stored in the shared memory of an infected server, making it extremely hard for administrators to know their machine has been hacked. This gives attackers a new and stealthy launchpad for client-side attacks included in Blackhole, a popular toolkit in the underground that exploits security bugs in Oracle’s Java, Adobe’s Flash and Reader, and dozens of other programs used by end users. There may be no way for typical server admins to know they’re infected.

“Unless a person really has some deep-dive knowledge on the incident response team, the first thing they’re going to do is kill the evidence,” Cameron Camp, a security researcher at Eset North America, told Ars. “If you run a large hosting company you’re not going to send a guy in who’s going to do memory dumps, you’re going to go on there with your standard tool sets and destroy the evidence.”

Linux/Cdorked.A leaves no traces of compromised hosts on the hard drive other than its modified HTTP daemon binary. Its configuration is delivered by the attacker through obfuscated HTTP commands that aren’t logged by normal Apache systems. All attacker-controlled data is encrypted. Those measures make it all but impossible for administrators to know anything is amiss unless they employ special methods to peer deep inside an infected machine. The backdoor analysed by Eset was programmed to receive 70 different encrypted commands, a number that could give attackers fairly granular control. Attackers can invoke the commands by manipulating the URLs sent to an infected website.

“The thing is receiving commands,” Camp said. “That means that suddenly you have a new vector that is difficult to detect but is receiving commands. Blackhole is a tricky piece of malware anyway. Now suddenly you have a slick delivery method.”

In addition to hiding evidence in memory, the backdoor is programmed to mask its malicious behaviour in other ways. End users who request addresses that contain “adm,” “webmaster” “support,” and similar words often used to denote special administrator webpages aren’t exposed to the client exploits. Also, to make detection harder, users who have previously been attacked are not exposed in the future.

It remains unclear what the precise relationship is between Linux/Cdorked.A and Darkleech, the Apache plug-in module conservatively estimated to have hijacked at least 20,000 sites. It’s possible they’re the same module, different versions of the same module, or different modules that both expose end users to Blackhole exploits. It also remains unclear exactly how legitimate websites are coming under the spell of the malicious plugins. While researchers from Sucuri speculate it takes hold after attackers brute-force the secure-shell access used by administrators, a researcher from Cisco Systems said he found evidence that vulnerable configurations of the Plesk control panel are being exploited to spread Darkleech. Other researchers who have investigated the ongoing attack in the past six months include AV provider Sophos and those from the Malware Must Die blog.

The malicious Apache modules are proving difficult to disinfect. Many of the modules take control of the secure shell mechanism that legitimate administrators use to make technical changes and update content to a site. That means attackers often regain control of machines that are only partially disinfected. The larger problem, of course, is that the highly sophisticated behavior of the infections makes them extremely hard to detect.

Eset researchers have released a tool that can be used by administrators who suspect their machine is infected with Linux/Cdorked.A. The free python script examines the shared memory of a sever running Apache and looks for commands issued by the stealthy backdoor. Eset’s cloud-based Livegrid system has already detected hundreds of servers that are infected. Because Livegrid works only with a small percentage of machines on the Internet, the number of compromised Apache servers is presumed to be much higher.”

Further relevant articles can be found on the website: http://www.arstechnica.com

living social logo

Living Social Website Compromised

The mighty Living Social website is the latest to be hacked, attacked or as they put it “experienced a security breach”.

livingsocial logo living social

Irish Web Design have carried out a series of actions to protect all the websites they have designed and currently manage.

Irish Web Design is currently considering the best course of action to take to keep all the websites in their care safe in the future.

We will be posting the results here and will also send the  details directly to our clients.

If you are not currently a client we are happy to keep you informed if you send us a message from the Contact page of this website.

In the meantime this is the content of the message subscribers received from Living Social earlier on.

IMPORTANT INFORMATION

LivingSocial recently experienced a security breach on our computer systems that resulted in unauthorised access to some customer data from our servers. We are actively working with the authorities to investigate this issue.

The information accessed includes names, email addresses, the date of birth of some users, and encrypted passwords; technically ‘hashed’ and ‘salted’ passwords. We never store passwords in plain text.

The database that stores customer credit card information was not affected or accessed.

Although your LivingSocial password would be difficult to decode, we want to take every precaution to ensure that your account is secure, so we are expiring your old password and requesting that you create a new one.

For your security, please create a new password for your account by following the instructions below.

  1. Visit https://www.livingsocial.com
  2. Click on the “Create New Password” button (top right corner of the homepage)
  3. Follow the steps to finish

We also encourage you, for your own personal data security, to consider changing password(s) on any other sites where you use the same or similar password(s).

The security of your information is our priority. We always strive to ensure the security of our customer information, and we are redoubling efforts to prevent any issues in the future.

Please note that LivingSocial will never ask you directly for personal or account information in an email. We will always direct you to the LivingSocial website – and require you to login – before making any changes to your account. Please disregard any emails claiming to be from LivingSocial that request such information or direct you to a different website that asks for such information.

We are sorry this incident occurred, and we look forward to continuing to introduce you to new and exciting things to do in your community.

Sincerely,
Tim O’Shaughnessy, CEO

 

Living Social Website Compromised

YouTube Dragons Den Interview by Log Holder Company

The Log Holder Company

Name Seamus Connolly

Equity sought 20%

Investment sought €20,000

The Pitch

Seamus Connolly from Athy, Co Kildare from The Log Holder Company, he is looking for €20,000 for 20% in his company which designs a range of Victorian style log holders which allows your fuel to dry out.

The Outcome

The Dragons check out Seamus’ designs. Barry asks what the costs are to manufacture, Seamus tells him it costs €40 to make one and he sells it for €100. Gavin tells him the costs put him off and asks can he get it down, Seamus tells him he could if he was to produce in bulk. He has sold 70 units to date and hopes to sell 400 in year one with a net profit if €20,000. Barry tells Seamus he doesn’t think the company is scalable so opts out. Sean also tells him he thinks it doesn’t need an investor so opts out. Ramona is the last Dragon to opt out.

Irish Web Design created the Log Holder Company e-commerce website

YouTube Dragons Den Interview by Log Holder Company on RTE Television

Website Photography Training

Website Photography Training for e commerce web owners

photo showing good and bad website product photos

Learn the essentials of creating photos for your own web site or blog with Website Photography Training

Workshops to teach you how to create professional quality images for your Irish shop website

Quality internet photography at a low cost

Learn the basics of photography and advanced techniques to ensure top quality images for your website

For further details of one day, half day workshops and courses for individuals and groups Contact Irish Web Design

Courses include hands on seminars, workshops and all kinds of one to one training course.

wordpress attacked circular 3d logo

Protect Your WordPress Website

One of the most popular content management systems in use on modern websites is WordPress, found on more than 60 million websites around the world.

WordPress has been in the news recently as the subject of a large-scale attack from a huge number of computers from across the internet.  This automated botnet attack was attempting to take over servers that run WordPress websites.

Many experts believe that this current attack is a relatively small scale version of a botnet that will infect computers in the future. The next attack may be vastly stronger and more destructive than what we have seen recently.

Running on the servers that have bandwidth connections that are hundreds or even thousands of times faster than machines in homes and small businesses.

The enormous popularity of WordPress shows its vulnerability in a situation like this, as a result of it’s ease of use is weak security by users.

This typically means that users continue to use the word ‘admin’ as a user name, as this is the default administration account that’s created when you first install WordPress.

Weak passwords may be guessed by the ‘brute force’ attack of a botnet, able to try vast numbers of password combinations in a short space of  time.

For the moment every WordPress user should disabled the default ‘admin’ account in their installation,  and replace it with something else. This may take you out of the immediate danger from the current the attackers.

To create a strong password you need to use at least ten characters with a combination of upper and lower case letters along with some numbers and even some extended characters

The recent attack serves as a reminder to everyone that that security for your WordPress blog or website is something you do need to continue to work on.

What follows is Irish Web Design’s advice on what can you do to make your site more secure. These actions will help to deter such attacks in the future.

Update to the latest WordPress (currently version 3.5.1)

If there is an administrative user called ‘admin’.

Create a new account with a different name, unconnected with the name of your website. Give it administrative privileges.
Give it a strong password you have never used before.
Write these details down in at least two different places.
Sign out of the account.
Sign in as the new user.
Delete the old ‘admin’ user account.
During this procedure, you’ll be asked by  what account should you assign posts to created by ‘admin’ to.
Choose the new account name you just created.

You should also enable ‘two-step verification’ for each user in your WordPress account. As this is a more complex process with additional implications we will carry an article on the subject in the near future.

Irish Web Design would also recommend changing all passwords connected with access to the site, server and database on a regular basis.

As a matter of course Irish Web Design also recommend that all users should install a number of security programmes on all WordPress websites to prevent them being hacked.

In our view, if you adhere to minimum standards of security for your WordPress site it will give you a good level of security and will make it more difficult to hack into your site.

Don’t let the spammers, hackers or botnets destroy your presence on the web. Your site or blog can be secure with a little thought and effort.

Title of article: Protect Your WordPress Website published by Irish Web Design

Irish Web Design work on Dragons Den

At Irish Web Design we were delighted to have one of our long standing clients appear on the Dragon’s Den recently.

The original Log Holder Company website was purely an information site, and served the business well in its early days of trading.

When Seamus Connolly decided to step up a gear he decided to have an e-commerce website where customers would be able to choose and purchase their log holders online.

log-holder-company-dragons-den-V5-960x330

Irish Web Design designed, printed and mounted the sign that appeared with Seamus in the Dragon’s Den, and featured prominently in the final film.

The Log Holder Company logo was created by Irish Web Design based on an idea by the client.

log-holder-company-hand-crafted-in-ireland-V5-960x330

Despite tight deadlines the website was ready to deal with orders as the show was screened, and was delivered on budget.

New ranges of Log Holders have been introduced and a photo shoot has been booked so that Irish Web Design can create a new set of professional standard photographs.

The new product photos will be used on the online shop and for other promotional purposes such as a new edition of the Log Holder Company’s electronic brochure or e-brochure as they are called.

The site has been well designed when it comes to Search Engine Optomisation, or SEO and began to feature highly on Google straight away.

It was very gratifying to see the Irish Web Design work on Dragons Den, and know that it would serve our client  well.

Visit the Log Holder Company Website Here

Irish websites attacked

A report from the BBC News website reported:

WordPress website targeted by hackers

Wordpress website
WordPress users are advised to change their user names

WordPress has been attacked by a botnet of “tens of thousands” of individual computers since last week, according to server hosters Cloudflare and Hostgator.

The botnet targets WordPress users with the username “admin”, trying thousands of possible passwords.

The attack began a week after WordPress beefed up its security with an optional two-step authentication log-in option.

The site currently powers 64m websites read by 371m people each month.

According to survey website W3Techs, around 17% of the world’s websites are powered by WordPress.

“Here’s what I would recommend: If you still use ‘admin’ as a username on your blog, change it, use a strong password,” wrote WordPress founder Matt Mullenweg on his blog.

He also advised adopting two-step authentication, which involves a personalised “secret number” allocated to users in addition to a username and password, and ensuring that the latest version of WordPress is installed.

“Most other advice isn’t great – supposedly this botnet has more than 90,000 IP addresses, so an IP-limiting or login-throttling plugin isn’t going to be great (they could try from a different IP [address] a second for 24 hours),” Mr Mullenweg added.

Matthew Prince, Chief Executive and co-founder of Cloudflare, said that the aim of the attack may have been to build a stronger botnet.

“One of the concerns of an attack like this is that the attacker is using a relatively weak botnet of home PCs in order to build a much larger botnet of beefy servers in preparation for a future attack,” he wrote in a blog post.

“These larger machines can cause much more damage in DDoS [Distributed Denial of Service] attacks because the servers have large network connections and are capable of generating significant amounts of traffic,” he added.

Hi-tech crime terms

  • Bot – one of the individual computers in a botnet; bots are also called drones or zombies
  • Botnet – a network of hijacked home computers, typically controlled by a criminal gang
  • Malware – an abbreviation for malicious software ie a virus, trojan or worm that infects a PC
  • DDoS (Distributed Denial of Service) – an attack that knocks out a computer by overwhelming it with data; thousands of PCs can take part, hence the “distributed”
  • Drive-by download – a virus or trojan that starts to install as soon as a user visits a particular website
  • IP address – the numerical identifier every machine connected to the net needs to ensure data goes to the right place.

Many Irish websites attacked, and further information provided by Blacknight revealed that:

Last Tuesday they began to see high load on a small number of their shared hosting servers, upon investigation they saw the cause was an unusual number of login requests to the admin section of WordPress sites.

It quickly became obvious the scale of this attack was far greater than the usual attacks seen on self-hosted WordPress sites and was the work of a large botnet.

Our technical team work around the clock to ensure servers and services remain online and work as expected. While many hosting companies began reporting the attack and took action at a server level, including in some cases blocking access to wp-login, we worked to mitigate the issue at a network level. This was due mainly to the large number of servers involved.

The attack slowed down on occasions during the week and then increased again with some characteristics changing to overcome the defence mechanisms that were put in place.
By Friday afternoon the attack was no longer growing and the number of new IPs we were seeing had reduced greatly, the attack continued to slow at the weekend.

So here are some numbers and statistics that we are happy to share.

Over the week our Engineering team recorded over 10 million login attempts originating from over 190,000 IPs, of that we blocked 65,000 IPs from over 183 countries, from our network during the attack.

Top 30 – blocked IPs by country

13866 : BR, Brazil
6313 : TR, Turkey
2909 : MX, Mexico
2419 : IN, India
2252 : PL, Poland
2171 : ID, Indonesia
1862 : VN, Vietnam
1795 : AR, Argentina
1751 : KR, Korea, Republic of
1568 : RS, Serbia
1431 : GR, Greece
1392 : PT, Portugal
1366 : FR, France
1319 : TH, Thailand
1281 : EG, Egypt
1185 : VE, Venezuela
1118 : MA, Morocco
1035 : DZ, Algeria
907 : RU, Russian Federation
873 : CL, Chile
801 : BA, Bosnia and Herzegovina
796 : UA, Ukraine
775 : SA, Saudi Arabia
769 : ES, Spain
754 : RO, Romania
752 : IT, Italy
728 : CO, Colombia
569 : MY, Malaysia
527 : PE, Peru
475 : US, United States

 

Visit Us On TwitterVisit Us On FacebookCheck Our Feed