Massive Internet attack

Dmbeucler

Super Member
Registered
Joined
Aug 29, 2009
Messages
184
Reaction score
25
Location
Ohio
Website
dmbeucler.blogspot.com
So... my paranoid thought when I saw this was happening was "But today isn't election day..."

I'm probably being way paranoid, but a lot of social media being down on November 8th seems like it has a potential to be disruptive...
 

AW Admin

Administrator
Super Member
Registered
Joined
Apr 19, 2008
Messages
18,772
Reaction score
6,286
That's what worries me. Could this be an attempt to get everyone looking in one direction while the real damage is being done elsewhere?

I'd say . . . certainly there are going to be opportunistic attacks, and that yes, it could be a deliberate cover, or a dress rehearsal. I think the after-the-fact data will be really interesting.

Still seeing lots of Russian and Chinese data traffic.
 

robjvargas

Rob J. Vargas
Banned
Joined
Dec 9, 2011
Messages
6,543
Reaction score
511
I never got the motivation of this kind of attack.

It's just being a dick.
Not enough information yet, but sometimes it's not about who was affected.

Sometimes it's about who was not. Or it was to prove something. Or a dress rehearsal.

There's all kinds of ways that could play out.
 

MaeZe

Kind Benefactor
Super Member
Registered
Joined
Jun 6, 2016
Messages
12,822
Reaction score
6,576
Location
Ralph's side of the island.
This is an odd coincidence. Normally my spam folder on Yahoo is swamped with ~50-150 spam mails a day. There have been zero spam entries in the spam folder all day. My regular folder is working fine with dozens of campaign and my other usual emails.
 

Roxxsmom

Beastly Fido
Kind Benefactor
Super Member
Registered
Joined
Oct 24, 2011
Messages
23,122
Reaction score
10,882
Location
Where faults collide
Website
doggedlywriting.blogspot.com
When I looked at the map linked up thread, there was a lot of unusual activity centered on Peru. Is that where the major internet hubs for South America are located?

Wait, the data they're showing me is for December of 2014. Not sure how to get current information to pop up.
 
Last edited:

AW Admin

Administrator
Super Member
Registered
Joined
Apr 19, 2008
Messages
18,772
Reaction score
6,286
Oddly a series of bots from India and Pakistan with identical footprints to a series of bots from the Ukraine yesterday attempted to register 4800+ accounts. I've had to turn off registration briefly, block IPs, and then clean up the mess and turn registration back on. And yes, these are wi-fi devices, mostly cameras.

For those who are curious about how this works, two articles that do a good job of explaining how DNS works so that your web browser can find the server that matches the URL you enter:

http://gizmodo.com/what-is-dns-and-why-does-it-make-the-internet-break-1788065317

http://gizmodo.com/this-is-probably-why-half-the-internet-shut-down-today-1788062835
 

darkprincealain

Super Member
Registered
Joined
Mar 17, 2008
Messages
3,395
Reaction score
1,978
Location
Nowhere. Now here.
Unfortunately, don't listen to Marsha Blackburn, who was invited to the Situation Room because she's on the House Subcommittee on Communications and Technology. She doesn't seem to be very knowledgeable about the topic her subcommittee works on.

Linky
 

MaeZe

Kind Benefactor
Super Member
Registered
Joined
Jun 6, 2016
Messages
12,822
Reaction score
6,576
Location
Ralph's side of the island.
Oddly a series of bots from India and Pakistan with identical footprints to a series of bots from the Ukraine yesterday attempted to register 4800+ accounts. I've had to turn off registration briefly, block IPs, and then clean up the mess and turn registration back on. And yes, these are wi-fi devices, mostly cameras.

For those who are curious about how this works, two articles that do a good job of explaining how DNS works so that your web browser can find the server that matches the URL you enter:

http://gizmodo.com/what-is-dns-and-why-does-it-make-the-internet-break-1788065317

http://gizmodo.com/this-is-probably-why-half-the-internet-shut-down-today-1788062835

This is from 2008 but I thought it was relevant given the current attack appears embedded in small devices: Throw away your digital picture frames
An insidious computer virus recently discovered on digital photo frames has been identified as a powerful new Trojan Horse from China that collects passwords for online games — and its designers might have larger targets in mind.
“It is a nasty worm that has a great deal of intelligence,” said Brian Grayek, who heads product development at Computer Associates, a security vendor that analyzed the Trojan Horse… The authors of the new Trojan Horse are well-funded professionals whose malware has “specific designs to capture something and not leave traces,” Grayek said. “This would be a nuclear bomb” of malware.

Mocmex is its name. Reportedly, it can evade hundreds of anti-malware and firewall products, including the Windows Firewall. I suspect that this succeeds only when users are logged in as administrators, so here’s yet another reason to stop doing this altogether, as is the US Government with its new Federal Desktop Core Configuration for Windows XP and Windows Vista.


The virus actually propagates to just about any kind of removable USB storage device, jumping from various well-concealed hiding places on your PC whenever such a device is inserted. Picture frames are implicated because the virus apparently originated in the factory where the frames were built (in turn sold by Best Buy, Sam’s Club, Target, and Costco, but now discontinued). Amazingly, according to the UK security firm Prevx, over 67,500 variants of this thing exist!

Computers in Almost Everything

I'm picturing John Carpenter's Christine.
 

AW Admin

Administrator
Super Member
Registered
Joined
Apr 19, 2008
Messages
18,772
Reaction score
6,286
The root problem is twofold:

1 Not changing the default passwords and logins on devices with Internet ability—including cameras with WiFi, "smart home" appliances and routers. Change the login ID and password. There are public lists of the default logins used by manufacturers.

2 Using Admin as a login name. Just don't. Don't use Root or Test either.

Then there's the related problems of using high level Admin access when you don't need to, and having stupid passwords that are in dictionary lists.
 

ElaineA

All about that action, boss.
Super Member
Registered
Joined
Jan 17, 2013
Messages
8,582
Reaction score
8,522
Location
The Seattle suburbs
Website
www.reneedominick.com
I thought the issue was more with gadgets coming with preset passwords that the end user isn't prompted to change. I just opened my digital cable box WiFi connection page and I don't recognize either the WiFi Network name or the password (which is entirely generic). It's not the name and PW I set up for our WiFi router so it's bypassing something.

It's maddening how cavalier the gadget-makers (really, the companies BUYING from the gadget makers) have been with our security. The Mfgs better be pushing some firmware out to these internet-enabled devices and make everyone set a unique password to use them. I'd rather pay double for a Bluetooth internet connected DVD player and have robust security than get a cheap one that can be mustered by a Bot Army. The cost of the latter is far more significant than the former.
 

robjvargas

Rob J. Vargas
Banned
Joined
Dec 9, 2011
Messages
6,543
Reaction score
511
IIt's maddening how cavalier the gadget-makers (really, the companies BUYING from the gadget makers) have been with our security. The Mfgs better be pushing some firmware out to these internet-enabled devices and make everyone set a unique password to use them. I'd rather pay double for a Bluetooth internet connected DVD player and have robust security than get a cheap one that can be mustered by a Bot Army. The cost of the latter is far more significant than the former.
I have to leap to the hardware makers' defense just a little bit.

Those default credentials (like "admin" and "admin) are there because anything more complex turns off customers. Manufacturers cannot customize the initial settings because they need to support end users through that initial setup. And the more complex the password, the more they are going to hear about it as a complaint from customers.

The accusation of being cavalier has merit. Please don't think I'm letting manufacturers/developers off the hook. But I remember my time with Sprint. I remember having sales quotas even as I was working to resolve technical issues. And I can tell you that even customers who were open to upselling reacted badly to being "fully informed" during the sales pitch.

"If I get a data plan, can I browse the Web?"
"Just remember that the browser on your phone isn't a full Web browser. Some sites..."
<click>
"If I get a data plan, can I browse the Web?"
"Yes."
"Great! How much for..."
I'm a terrible salesman because I could never answer in absolutes like that. Well... other reasons, too, but that's a big one.

It's wrong for companies to not include some kind of warning to change those default credentials. But make the initial setup anything more than the minimal baseline to achieve functionality, and you lose the customer. I've met customers that would rather return the device than read the manual (and the wimpy docs that claim to be user manuals are another peeve of mine).

There's a fine, shaky tightrope that manufacturers have to walk in order to get customers to use their freshly-bought appliances/electronics.

It's not as simple a problem as it may seem up front.
 

ElaineA

All about that action, boss.
Super Member
Registered
Joined
Jan 17, 2013
Messages
8,582
Reaction score
8,522
Location
The Seattle suburbs
Website
www.reneedominick.com
I've met customers that would rather return the device than read the manual (and the wimpy docs that claim to be user manuals are another peeve of mine).
Oh, believe me. I know. I'm married to a guy who would rather pay $500 for the electronics store to come and set up everything than bother to learn how to do any of it himself. If I'm not around and he needs "tech" support (from me, an English major) he's screwed.

There's a fine, shaky tightrope that manufacturers have to walk in order to get customers to use their freshly-bought appliances/electronics.

It's not as simple a problem as it may seem up front.
I get this, too. But the setups of these devices don't even include a "change the password" prompt. At the very least there should be an option in the setup for devices that have typing enabled (ie: DVRs, DVD players, TVs) It's a little more difficult for things like baby monitors and cameras and refrigerators where an end user would have to go online to do the proper set-up. I'd rather see a little effort over none at all, though. Their customers certainly won't be happy if/when the net goes down because of the Botnet and they can't use their devices at all.