Mois : <span>octobre 2016</span>

Criminals this morning massively attacked Dyn, a company that provides core Internet services for Twitter, SoundCloud, Spotify, Reddit and a host of other sites, causing outages and slowness for many of Dyn’s customers.

In a statement, Dyn said that this morning, October 21, Dyn received a global distributed denial of service (DDoS) attack on its DNS infrastructure on the east coast starting at around 7:10 a.m. ET (11:10 UTC).

“DNS traffic resolved from east coast name server locations are experiencing a service interruption during this time. Updates will be posted as information becomes available,” the company wrote.

DYN encouraged customers with concerns to check the company’s status page for updates and to reach out to its technical support team.

A DDoS is when crooks use a large number of hacked or ill-configured systems to flood a target site with so much junk traffic that it can no longer serve legitimate visitors.

DNS refers to Domain Name System services. DNS is an essential component of all Web sites, responsible for translating human-friendly Web site names like “example.com” into numeric, machine-readable Internet addresses. Anytime you send an e-mail or browse a Web site, your machine is sending a DNS look-up request to your Internet service provider to help route the traffic.

US prosecutors on Thursday said they expected to file espionage charges against a private contractor for the National Security Agency suspected of stealing an « astonishing quantity » of classified information.

Harold Martin III was arrested August 27 in Maryland and poses a « grave danger » to the United States, prosecutors wrote in a filing ahead of a detention hearing set for Friday in Baltimore.

Martin, who has now been fired, worked for Booz Allen Hamilton — the same firm that hired the NSA whistleblower Edward Snowden.

Martin was entrusted to work with classified information for several government agencies and allegedly had been stealing information since 1996.

« The defendant violated that trust by engaging in wholesale theft of classified government documents and property — a course of felonious conduct that is breathtaking in its longevity and scale, » prosecutors wrote.

They said Martin had swiped at least 50,000 gigabytes of information, though not all of it was classified.

One single gigabyte is enough space to store about 10,000 pages of documents containing images and text.

« The defendant was in possession of an astonishing quantity of marked classified documents which he was not entitled to possess, including many marked (secret), » prosecutors said.

Some of the documents « appear » to contain national defense information and Martin allegedly kept the files in his car and lying around his Maryland home.

Investigators also allegedly found an « arsenal » of 10 firearms including an assault rifle.

« The government anticipates that the charges will include violations of the Espionage Act, an offense that carries significantly higher statutory penalties and advisory guideline ranges than the charges listed in the complaint, » prosecutors wrote.

Martin’s lawyers have previously said he loves his family, and said there was no evidence he intended to betray his country.

Martin does not appear to have a valid passport and investigators have not said he sent information to foreign governments.

But prosecutors noted: « The defendant has also communicated online with others in languages other than English, including in Russian. »

Booz Allen has said it reached out to offer full cooperation with the authorities as soon as it learned of the arrest, and quickly fired Martin.

The arrest came after investigators began looking into the theft of source code used by the NSA to hack adversaries’ computer systems, such as those of Russia, China, Iran and North Korea.

Such access would enable the NSA to plant malware in rivals’ systems and monitor — or even attack — their networks.

The case is an embarrassing new blow for both the NSA and Booz Allen, which the New York Times said helps build and operate many of the NSA’s most sensitive cyber operations.

Former NSA contractor Snowden has been living in Russia since shortly after leaking documents revealing the scope of the agency’s monitoring of private data.

A new Linux kernel vulnerability disclosed on Wednesday allows an unprivileged local attacker to escalate their privileges on a targeted system. Red Hat said it was aware of an exploit in the wild.

The vulnerability, discovered by Phil Oester, was sarcastically dubbed by some people “Dirty COW” due to the fact that it’s caused by a race condition in the way the Linux kernel’s memory subsystem handles copy-on-write (COW) breakage of private read-only memory mappings.

The security hole, tracked as CVE-2016-5195, allows local attackers to escalate their privileges on the targeted system by modifying existing setuid files, Red Had said in itsadvisory.

“An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system,” the company explained.

Red Hat, which classified the flaw as “important,” said it was aware of an exploit leveraging this technique in the wild, but the company has not shared any other information. A fix has already been developed and Linux distributions have started releasing updates.

An increasing number of vulnerabilities have been branded since the discovery of Heartbleed. While some believe that branding a flaw could have a positive impact, others are concerned that branding even low-risk issues could lead to companies ignoring the vulnerabilities that really matter.

The people who created the Dirty COW website, logo and Twitter account have admitted that this vulnerability is not as serious as others and they claim to have branded it to make fun of branded flaws. They even created a shop that sells “Dirty COW” mugs and t-shirts for thousands of dollars.

Linux Kernel Vulnerabilities

Google security researcher Kees Cook has analyzed the Linux kernel vulnerabilities discovered since 2011 in an effort to determine for how long they go unnoticed after they are introduced in a Linux release.

Based on the analysis of 557 CVE identifiers assigned to Linux kernel flaws since 2011, Cook determined that their average lifespan is roughly 5 years. According to the expert, high severity issues are fixed after 6.4 years, while critical issues are discovered, on average, after 3.3 years.

The Sarvdap spambot was recently observed checking the IP addresses of infected hosts against common blacklists, in an attempt to ensure that its spam email is successfully delivered, Palo Alto Networks security researchers reveal.

While other spambots typically start sending spam emails as soon as a host has been infected, Sarvdap first checks to see whether the IP isn’t on a blacklist, and shuts itself down if it is. Commonly downloaded by the Andromeda botnet, the spambot has been used to deliver pharmaceutical spam and to distribute the main Andromeda bot to more targets.

After initial execution, Sarvdap drops a copy of itself into the %windir% folder, launches a new svchost.exe process, and then initializes itself by allocating memory. Next, the malware injects the main bot code into this process, checks the system for a debugger to ensure it isn’t being analyzed, and creates the mutex “Start_Main_JSM_complete”.

Next, the malware checks the Internet connection by attempting to connect towww.microsoft.com and, if the check passes, it starts enumerating multiple blacklist feeds to verify the host IP’s reputation status. In the event that the IP isn’t blacklisted, the malware starts beaconing to the hardcoded command and control (C&C) server over TCP port 2352. Should the host be blacklisted, the malware terminates itself.

If the C&C is online and the Real-time Blackhole List (RBL) checks are passed, a configuration file is downloaded. However, because the server was offline during analysis, the security researchers couldn’t determine what exactly the configuration contained.

The most interesting capability of Sarvdap, researchers say, is present within the original code: a hardcoded list of commonly known blacklist servers. Because the referenced blacklists are from all around the world, the Palo Alto Networks researchers concluded that the spambot’s author was looking for global coverage rather than focusing on a specific region.

“Phishing emails remain a highly prevalent threat for enterprise, government and home users. For-hire, large-scale spam focused botnets continue to churn out hundreds of thousands of messages a day from compromised hosts. Sarvdap is particularly interesting not due to its scale, but rather due to its attempts to increase overall spam delivery by abusing reputation blacklists,” the security researchers note.

Using blacklist functions isn’t a novel technique when it comes to malware, though most malicious programs use them to evade detection. While many pieces of malware blacklist only the most popular anti-malware solutions or sandboxes out there, there are some that pack extensive lists of programs and websites to be avoided, such as the Furtim malwar