Cybercriminals Use NSA Exploits To Attack Servers

Cyber criminals are currently actively using the NSA exploits last week by the hacker group Shadow Brokers were made public to provide servers backdoors and possibly spreading ransomware. Let know several security researchers.

Thus Double Pulsar tool found on the various servers. The NSA would use this tool after it has been through an exploit access to a server. In addition, security reports SenseCy that there is currently a "trend" going where the leaked NSA exploits used to infect Windows Servers with ransomware. The attackers were using either a vulnerability in Windows SMB Server make that Microsoft patched in March.

Further details are not given, however, about this ransomware attacks. Earlier researcher Kevin Beaumont predicted that the NSA exploits a ransomware worm would be used. "It's the next logical step yields for worms and criminals, because the money and is easy to do," says the researcher. Beaumont says that if known exploits are currently being used to servers a backdoor provide.

ISC: Another Port For SSH Is Not Meaningless

Who SSH (Secure Shell) to log on to remote computers and servers will benefit from it to change the default port 22, as late as a handler of the Internet Storm Center (ISC) know. SSH is a popular protocol for managing computers. Standard protocol listens on port 22.

This will also be a lot of scans and attacks on this port. At present, there Reddit , in response to this article , a discussion or change the default port is wise. One of the criticisms is that " security through obscurity "is not a security measure, but only one way to slow an attacker and therefore offers little value. "While it is true that it is difficult to stop a determined attacker to cause you provide, any measure that prevents arbitrary script kiddies and scanners to your SSH look not entirely meaningless," says ISC handler Rick Wanner.

Wanner says more than 15 years SSH on a non-standard port to run, such as port 52222. "Of course this is not the only security measure that I use. I patch daily use hosts.allow where possible, keys and passphrases instead passwords and use Deny Hosts ", he tells. ISC handler notes that he does not use port 22 because of "security through obscurity" benefits, but because it eliminates all noise on port 22.

Port 22 is a favorite target of brute force attacks and port scans rising every year. These activities cause Wanner as much noise in the logs. "Why would you tolerate it if it is not needed?", He notes. The default port change he would attack traffic are much diminished that he occasionally his defense test to see if it still works.

Spamhaus Sees Increase In Botnet Servers In 2014

The past year were more servers detected that were used by botnets to control infected computers, according to Spamhaus in a new survey published. According to the anti-spam organization comes as no surprise that there are more botnet activity was observed.

Most botnet servers are located at providers with undermanned abuse departments, inadequate abuse policy or who are not able to detect abuse on their network efficiently and fight. The areas used by cyber criminals for their botnet servers are mainly registered with registrars in countries with lax laws and enforcement against cyber crime.

Last year saw Spamhaus 7182 unique IP addresses when a botnet server was hosted. An increase of IP addresses 525 (7.88%) relative to 2013. In 48% of cases, however, it was a hacked web server. The botnet servers were hosted on different network in 1183. Most botnet servers were found in the French OVH, German and Dutch Hetzner Leaseweb. Spamhaus notes that this is just about the raw numbers and the numbers say nothing about how long a botnet server is active, or the provider responds quickly to takedown requests.

When it comes to registrars where cyber criminals domain names for their botnet server register the top 5 consists only of Russian and Chinese registrars. Furthermore, are also American registrars extended in the overview. Regarding the tld who choose the cyber criminals is most likely to domains ending in .com and .ru. Further from the survey shows that most botnet servers are used for controlling banking Trojans, Trojans that are designed to steal money from online bank accounts. 4565 servers (63.5%) were used for this type of malware.

Thousands of fake servers Tor network removed

The administrators of the Tor network have removed thousands of fake servers that had been added by the group Lizard Squad. The group claimed earlier this week to sit behind attacks on Xbox Live and the Playstation Network and would now plans have been to attack the Tor network.

In a short time appeared some 3,000 new servers in the Tor network. Thereby Lizard Squad had a considerable share in the network, which came out with the new servers at 10.000 "relays". In theory this is a risk for Tor users, for a party that has a large part of the network owned'd users can unmask. In this case, Tor users were however no danger. The capacity of the new servers was 20 kilobytes per second per server too small.

Tor Network List

The total capacity of the Lizard Squad servers accounted for only 0.27% of the entire Tor network. The servers would become the first three days are not selected as a server for Tor users, let security researcher Nadim Kobeissi opposite The Verge know. Meanwhile, the fake servers are removed, according to the list of Tor servers. On Twitter Kobeissi states that were hosted many of these servers in the Google Cloud. He also suspects that it was thousands of small virtual machines with limited bandwidth.

In previous post we discussed about the Tor Network is Under Attack

The Tor Network Is Under Attack

Tor users in the coming days may have problems with the use of its services. As representatives warn Tor, detected an attempt to take control of specialized servers, referred to as directory Authorities that support this network. They did not disclose what the hacker group or organization is behind this attack. "We have taken steps to ensure the safety of users of our services. Tor already uses redundancy mechanisms that will keep their anonymity, even if the planned attack will be executed. Tor is safe "provides" arma "on the blog associated with the project . "Arma" is a nickname associated with the project leader Roger Dingledine.

The Tor network packets are exchanged directly between the source and the receiver, and pass through several randomly selected relay servers, which mask the path of the flow of information and thus allow the anonymity of the users of the network. "Even if the attacker take control of the majority of servers, they will not be able to force the Tor client software to resign from the other relays communication and as a result will still be safe and anonymous "provides" arma ".

If you use Tor - you may want to note down and temporarily avoid these affected mirrors in a below pic

Affected Mirrors

Currently, Tor uses 9 servers to manage traffic in the network. They are located in the USA and Europe. At the moment (Monday 22/12/2014) there was no information about the planned attack on Tor. Representatives of the project promise that all information on the current situation will be immediately posted on the blog design . -providing anonymity on the Internet.

Tor network is used by users who want to avoid censorship and track their content published by the secret services, especially in non-democratic countries. Representatives say the Tor project, the network is also used by millions of people who want to ensure the security of the communication itself when connecting to the Internet in public areas. Unfortunately, it is also used by criminals, such as drug trafficking network Silk Road. It was closed down in October 2013 years by the US police, but there is another version - Silk Road 2.0. Despite these controversies, Tor network is one of the symbols of freedom and privacy of Internet communication and any attempt to attack this system probably will lead to big stir among users global network.

"IP addresses are insufficient evidence against North Korea"

The evidence that the United States against North Korea when it comes to the hack of Sony is weak, says a security expert who analyzed the IP addresses used in the attack. Last week, the FBI said in an official statement that the Asian country was responsible for the intrusion on the network of Sony Pictures Entertainment, the theft of all data and sabotage of thousands of computers.

However, the FBI is careful in the words chosen, says security expert and blogger " krypt3ia ". He sees in the choice of words that the investigative unsure. Initially the attack was linked not to North Korea by the FBI, and is now said that the country is the culprit. "Something that makes people like me crazy," he notes. The expert therefore decided to look at the IP addresses used by the malware and introduced himself, the question of whether the resources are to be used or used only by North Korea.

IP Addresses

The IP addresses that the attackers used are from Thailand, Poland, Italy, Bolivia, Singapore, Cyprus and the United States.These include for which proxies and servers can be used by anyone. For one of the servers Krypt3ia found the credentials on a Chinese forum. The IP addresses appeared more frequently used for other cybercrime activities such as sending spam and controlling compromised computers.

"If all IP addresses are used by the US as evidence that North Korea has carried out this attack, I think the evidence is weak," said the expert. Most of these systems are in fact well-known compromised machines that are used for all kinds of cyber crime purposes. Also, many of these types of compromised servers are shared by attackers with each other.

North Korea has used such tactics in the past, according to the expert circumstantial evidence that is inadmissible in court.However, Obama announced that the US will take appropriate action against North Korea. The expert then also questions whether the US base their theoretical response on circumstantial evidence, which he makes reference to the so-called weapons of mass destruction in Iraq. Further, according to the expert whether there because of a break-in at a single entertainment company in Hollywood should be acted upon at the state level. "When I go to Twitter and the news I see is marketing hype and unjustified award ... and it will lead to our mutual destruction," concluded the blogger.