Facebook and Twitter both Hit by Targetted Denial of Service (DoS) Attack

On an otherwise normal and happy Thursday morning, Facebook and Twitter both became the most recent high profile sites to be the target of a denial of service attack (DoS).

A Georgian blogger with accounts on Twitter, Facebook, LiveJournal and Google's Blogger and YouTube was targeted in a denial of service attack that led to the site-wide outage at Twitter and problems at the other sites on Thursday, according to a Facebook executive.

The blogger, who uses the account name "Cyxymu", the name of a town in the Republic of Georgia, had accounts on all of the different sites that were attacked at the same time, Max Kelly, chief security officer at Facebook said.

Attacks such as this are malicious efforts orchestrated to disrupt and make unavailable services such as online banks, credit card payment gateways, and the usual online services provided to customers.

Twitter. 'We are defending against this attack now and will continue to update our status blog as we continue to defend and later investigate.'

Facebook: "We have restored full access for most people," the company reported. "We’ll keep monitoring the situation to make sure you have the reliable experience you expect from us.

UK Investigation into Cyber Attack goes Global

UK authorities have launched an investigation into the recent cyberattacks that crippled Web sites in the U.S. and South Korea, as the trail to find the perpetrators stretches around the world.

On Tuesday, the Vietnamese security vendor Bach Khoa Internetwork Security (Bkis) said it had identified a master command-and-control server used to coordinate the denial-of-service attacks, which took down major U.S. and South Korean government Web sites.

Zombie PCs
A command-and-control server is used to distribute instructions to zombie PCs, which form a botnet that can be used to bombard Web sites with traffic, rendering the sites useless. The server was on an IP (Internet Protocol) address used by Global Digital Broadcast, an IP TV technology company based in Brighton, England, according to Bkis.

BKIS control
That master server distributed instructions to eight other command-and-control servers used in the attacks. Bkis, which managed to gain control of two of the eight servers, said that 166,908 hacked computers in 74 countries were used in the attacks and were programmed to seek out and download new instructions every three minutes, from designated random sites.

Miami Master Server
But the master server isn't in the U.K.; it's in Miami, according to Tim Wray, one of the owners of Digital Global Broadcast, who spoke to IDG News Service on Tuesday evening, London time.
The server belongs to Digital Latin America (DLA), which is one of Digital Global Broadcast's partners. DLA encodes Latin American programming for distribution over IP TV-compatible devices, such as set-top boxes.

VPN Connections

New programs are taken from satellite and encoded into the proper format, then sent over VPN (Virtual Private Network) to the U.K., where Digital Global Broadcast distributes the content, Wray said. The VPN connection made it appear the master server belonged to Digital Global Broadcast when it actually is in DLA's Miami data center.

Engineers from Digital Global Broadcast quickly discounted that the attacks originated with the North Korean government, which South Korean authorities have suggested may be responsible.

Digital Global Broadcast notified
Digital Global Broadcast was notified of a problem by its hosting provider, C4L, Wray said. His company has also been contacted by the U.K.'s Serious Organised Crime Agency (SOCA). A SOCA official said she could not confirm or deny an investigation.

Amaya Ariztoy, general counsel for DLA, said the company examined the server in question today and found "viruses" on it. "We are conducting an investigation internally," Ariztoy said.

Forensic Analysis

Investigators will need to seize that master server for forensic analysis. It's often a race against the hackers, since if the server is still under their control, critical data could be erased that would help an investigation.

"It's a tedious process and you want to do it as quickly as possible," said Jose Nazario, manager of security research for Arbor Networks.

Data Logs Audit

Data such as log files, audit trails and uploaded files will be sought by investigators, Nazario said. "The holy grail you are looking for are pieces of forensics that reveal where the attacker connected from and when," he said.

D-o-S MyDoom Variant

To conduct the attacks, the hackers modified a relatively old piece of malware called MyDoom, which first appeared in January 2004. MyDoom has e-mail worm characteristics and can also download other malware to a PC and be programmed to conduct denial-of-service attacks against Web sites.

The Evidence Trail

Analysis of the MyDoom variant used in the attacks isn't that impressive. "I still think the code is pretty sloppy, which I hope means they [the hackers] leave a good evidence trail," Nazario said.

Perpetrator Profile
It could also be that the perpetrator is either very confident that they will not be found, is trying to hide in the pseudo amateur world of the cyber geeks and cyber vandals, is not concerned or is immune from discovery.

Maybe, a virtual self destructive personality that is implementing a non fatal 'suicide' mission for yet to be revealed reasons.

Unrest in Iran - Cyber-Attacks Begin in earnest

An apparently ad-hoc cyber protest against the results of recent Iranian elections has knocked out key Web sites in the country.

On Monday, sites belonging to Iranian news agencies, President Mahmoud Ahmadinejad and Iran's supreme leader Ayatollah Ali Khamenei, were knocked off-line after activists opposed to the Iranian government posted tools designed to barrage these Web sites with traffic.

This type of attack, known as a denial of service (DoS) attack, has become a standard political protest tool, and has been used by grassroots protesters in several cyber-incidents over the past few years, including cyber events in Estonia in 2007 and Georgia last year.

Activists had encouraged anti-government protesters to use automatic Web page refresh tools such as Pagereboot.com, to hit government run site. But they have also developed custom DoS tools. One such tool, called BWRaeper was posted to an Iranian sports discussion forum on Monday. Others are being promoted via Twitter and blogs, and hosted by activists in the U.S.

The "campaign is starting to target international users, compared to the original one aiming to recruit Iranians only," said Dancho Danchev, a security consultant who has blogged about the tools. "Judging by the effect this crowdsourcing is having, they've disrupted the sites set as targets."

Danchev counts 12 sites as being under attack, including other news agencies, the Ministry of Foreign Affairs, Ministry of Justice, National Police, and the Ministry of the Interior.

In response to the attacks, state-sponsored Iranian News site Fars News added a small piece of Web code that redirected the attack to pro-opposition Web sites, Danchev said via instant message. "Apparently, they thought that the attackers wouldn't stop their attack since they were also indirectly loading the [attack code]," he added. "They, however, didn't stop the attack."

Web disruptions have occurred on both sides of the dispute. Last month, Iran blocked access to Facebook, apparently to prevent opposition voters from using the social networking service to promote their candidates in last week's elections. YouTube and the BBC's Web site have also reportedly been blocked. BBC satellite service to the country has also been jammed.

General Internet service in Iran was also disrupted, though that lasted for just a short period of time, according to network monitoring company Renesys.

Hundreds of thousands of protesters have taken to the streets in Iran to protest the results of last week's presidential elections. Protesters claim that their candidate, Mir Hossein Mousavi, lost because the election was fixed by the government.

Although it has been reported as inaccessible by some Iranian users, Twitter has emerged as the major source of information on the protests, and is being credited with driving coverage of the event on U.S. television networks such as CNN.