Update 2 on DDoS

The Register reports that a man has been arrested in connection with the DDoS attack on SpamHaus - the one that involved a throughput of 300Gbps in one major Internet exchange.

Without commenting on the arrest itself, there are now more details on the DDoS. It's estimated that the attack used about 30,000 DNS resolvers to generate the traffic, so we can update the statistics:

While there may be 21m open resolvers, the attack used perhaps 30,000. Each open resolver was receiving an average of about 100kb/s traffic inbound and emitting an average of 10Mb/s. This is a lot more noticeable than the 15kb/s, but still not necessarily a big deal in a major data centre.

It did, however, trigger an alarm for Trevor Pott, the author of the Sysadmin blog on The Register. In his article, he reports:

The alarm went off late Tuesday night reporting DNS traffic of 10Mbit. 

My mistake stems from the simple assumption that BIND disables recursion by default. The change was made with BIND 9.4 way back in 2007. For reasons incomprehensible to me CentOS 5.9 ... is running BIND 9.3.6 which means that by default recursion requests are honoured. 

The fix required is simple ... I needed to ... instruct BIND to only honour recursion requests from servers inside my datacenter. 

But what of the future? Unfortunately, this attack is likely to be repeated. The Open DNS Resolver Project tracks open resolvers and has been reporting a steady growth in number. At the time of the attack, it estimated about 21m open resolvers. This week's survey has grown by another 4m. Cloudflare's future looks bright.

Some thoughts on Distributed Denial of Service (DDoS) attacks

I recently answered a question on StackOverflow on how web applications could be protected from a DDoS. This was a popular question, and (for me) a very popular answer, and a few other members added their thoughts.  I have expanded on my post, done more research, and rewritten large portions.

UPDATE: Spamhaus was subject to an enormous DDoS in March 2013 and they turned to Cloudflare, a professional CDN I mentioned in this posting. I discuss the attack in a follow-up posting here and a second here.

What is a Distributed Denial of Service?

DDoS is a family of attacks which overwhelm key systems in the datacenter, disabling your web site and the web applications you are running on it. DDoS attacks are very common and carried out for a number of reasons:

• Political or ideological individuals, or groups as Anonymous
• Criminal groups using them either to:
• Extort money from business that don't know how or can't afford to protect themselves or
• Are paid to damage business competitors reputation or ability to trade on the web

The first DDoS attacks were very simple, but they have evolved over the years taking advantage of any weakness in the network protocols, firewalls, operating systems and web servers. However, at the most basic level, a DDoS can be indistinguishable from just a lot of users accessing your services - almost like a digital Occupy.

DDoS can attack any one (or indeed several) of the many different components of the application stack including:

• The hosting center's network connection to the internet
• The hosting center's internal network and routers
• Your firewall and load balancers
• Your web servers, application servers and database.

DDoS is just one way hackers can attack your systems and services. When securing your systems, you should consider defense against DDoS as just one aspect of your overall security posture.

There's a lot of information below the break.

Staggering security flaw on Samsung Galaxy range

A hacker has found a way to seriously damage your Samsung phone - including the Galaxy S2 and S3. The hacker can:

• Reformat your phone (destroying all data on it)
• Destroy your SIM, requiring you to buy a new one from your telco
• Change your PIN code
• And a whole lot more.

How can this occur:

• You visit a web page or view an email message and click a malicious link
• S/he texts you a malicious link via WAP (and you don't even have to be present and click a link - the damage happens automatically and immediately) 
• You scan a QR barcode

The common feature is that the link URI - it starts "tel". This is picked up by Samsung and passed to the Messaging client, which interprets the URI as a command, typically by running a device management feature. Samsung in its infinite madness has a whole lot of commands, and no prompts. 

This is frightening.

Luckily you can block this switching off the 'feature' that runs these commands automatically - it's called 'Service Loading'. Follow these instructions:

1. Open the Messaging client
2. Bring up the menu
3. Click on the Settings menu item
4. In the menu screen that appears, scroll down into the "Push message settings". You will see "Push Messages" and "Service Loading"
5. Tap the "Service Loading" menu item, a list of options appears: Always, Prompt, Never
6. Choose Never or Prompt

My advice to Samsung device owners: Do this right now. Very soon people will start placing these links on web sites, spam and even messaging these commands to your phone.

Message to Samsung: I understand why you would want such device management features on a phone. It allows you to optimise your manufacturing and support, decreasing your costs. But allowing these to be run automatically and remotely? What on earth were you thinking? Please place competent security professionals in your OS customization teams and conduct a full review.

UPDATE 27th Sept

Samsung have released an over-the-air patch for the Galaxy SIII with more devices to follow. For those on other devices, Collin Mulliner has released TelStop into the Google Play app store. Download, install, and TelStop will catch those nasty URIs.