Bob CollinsWhat’s happening to the nation’s big websites today is yet another reminder how vulnerable we are.
A major cyberattack appear to be underway in the nation today, knocking out major social networking sites and other websites, including Major League Baseball, Twitter, Politico, Reddit, Amazon, and Disqus (which provides the infrastructure for comments on this blog).
Dynamic Network Services Inc., said its domain name system — DNS — was hit by the first attack a little after 7 this morning and another one is underway at this hour.
Denial of service attacks can knock out websites by flooding them with junk messages and requests, preventing anyone else from accessing them.
It could be punishment for a talk that exposed some of the methods cybercriminals do to stage these attacks.
“The attack on DYN comes just hours after DYN researcher Doug Madory presented a talk on DDoS attacks in Dallas, Texas at a meeting of the North American Network Operators Group (NANOG),” security expert Brian Krebs writes on his website today. “Madory’s talk delved deeper into research that he and I teamed up on to produce the data behind the story DDoS Mitigation Firm Has History of Hijacks.”
The size of these DDoS attacks has increased so much lately thanks largely to the broad availability of tools for compromising and leveraging the collective firepower of so-called Internet of Things devices — poorly secured Internet-based security cameras, digital video recorders (DVRs) and Internet routers. Last month, a hacker by the name of Anna_Senpai released the source code for Mirai, a crime machine that enslaves IoT devices for use in large DDoS attacks. The 620 Gbps attack that hit my site last month was launched by a botnet built on Mirai, for example.
Interestingly, someone is now targeting infrastructure providers with extortion attacks and invoking the name Anna_senpai. According to a discussion thread started Wednesday on Web Hosting Talk, criminals are now invoking the Mirai author’s nickname in a bid to extort Bitcoins from targeted hosting providers.
A White House spokesman says the Department of Homeland Security is also looking into the cyberattack.
This week, Politico reported that despite spending by media companies to protect their systems, news organizations are vulnerable to Election Night chaos should cybercriminals choose to attack then.
Senior U.S. officials, current and former lawmakers and cybersecurity pros told POLITICO the threat against the media is real — and they fret the consequences. Specifically, the security community is worried The Associated Press’ army of reporters could get hacked and the wire service — the newsroom that produces the results data on which the entire media world relies — inadvertently starts releasing manipulated election tallies or that cybercriminals penetrate CNN’s internal networks and change Wolf Blitzer’s teleprompter.
“It’s the art of possible is what really scares me,” said Tony Cole, chief technology officer of FireEye, a Silicon Valley-based cybersecurity firm that works with some of the country’s major television and newspaper companies. “Everything is hackable.”
“No site is safe,” added Tucker Carlson, editor-in-chief of The Daily Caller. “If the federal government can be hacked, and the intelligence agencies have been hacked, as they’ve been then, can any news site say we have better cybersecurity than the FBI or Google?”
Obviously not.
