2022 彙整 - Page 12 of 122

ESET Research: Bahamut group targets Android users with fake VPN apps; spyware steals users’ conversations

ESET researchers have identified an active campaign targeting Android users, conducted by the Bahamut APT group.
The main purpose of the spyware is to extract sensitive user data and actively spy on victims’ messaging apps such as WhatsApp, Facebook Messenger, Signal, Viber, and Telegram.
The app used has at different times been a trojanized version of one of two legitimate VPN apps, SoftVPN or OpenVPN, which have been repackaged with Bahamut spyware code.
The campaign appears to be highly targeted, since once the Bahamut spyware is launched, it requests an activation key before the VPN and spyware functionality can be enabled. Both the activation key and website link are likely sent to targeted users.
ESET was able to identify at least eight versions of these maliciously patched apps with code changes and updates being made available through the distribution website, which might mean that the campaign is well maintained.

BRATISLAVA, KOŠICE — November 23, 2022 — ESET researchers have identified an active campaign targeting Android users, conducted by the Bahamut APT group. This campaign has been ongoing since the start of this year. Malicious spyware apps are distributed through a fake SecureVPN website that provides only trojanized Android apps to download. This website has no association whatsoever with the legitimate, multiplatform SecureVPN software and service. Malicious apps used in this campaign are able to exfiltrate contacts, SMS messages, recorded phone calls, and even chat messages from apps such as WhatsApp, Facebook Messenger, Signal, Viber, and Telegram. ESET researchers discovered at least eight versions of the Bahamut spyware, which could mean the campaign is well-maintained. The malicious apps were never available for download from Google Play.

“The data exfiltration is done via the keylogging functionality of the malware, which misuses accessibility services. The campaign appears to be highly targeted, as we see no instances in our telemetry data,” explains ESET researcher Lukáš Štefanko, who discovered and analyzed the dangerous Android malware. “Additionally, the app requests an activation key before the VPN and spyware functionality can be enabled. Both the activation key and website link are likely sent to targeted users,” adds Štefanko. This layer aims to protect the malicious payload from being triggered right after launch on a non-targeted user device or when being analyzed. ESET Research has already seen similar protection being used in another campaign by the Bahamut group.

All exfiltrated data is stored in a local database and then sent to the Command and Control (C&C) server. The Bahamut spyware functionality includes the ability to update the app by receiving a link to a new version from the C&C server.

If the Bahamut spyware is enabled, then it can be remotely controlled by Bahamut operators and can exfiltrate various sensitive device data, such as contacts, SMS messages, call logs, a list of installed apps, device location, device accounts, device info (type of internet connection, IMEI, IP, SIM serial number), recorded phone calls, and a list of files on external storage. By misusing accessibility services, the malware can steal notes from the SafeNotes application and actively spy on chat messages and information about calls from popular messaging apps, such as imo-International Calls & Chat, Facebook Messenger, Viber, Signal Private Messenger, WhatsApp, Telegram, WeChat, and Conion apps.

The Bahamut APT group typically uses spearphishing messages and fake applications as the initial attack vector, against entities and individuals in the Middle East and South Asia. Bahamut specializes in cyberespionage, and ESET Research believes that its goal is to steal sensitive information from its victims. Bahamut is also referred to as a mercenary group offering hack-for-hire services to a wide range of clients. The name was given to this threat actor, which appears to be a master in phishing, by the Bellingcat investigative journalism group. Bellingcat named the group after the enormous fish floating in the vast Arabian Sea mentioned in the Book of Imaginary Beings written by Jorge Luis Borges. Bahamut is frequently described in Arabic mythology as an unimaginably enormous fish.

For more technical information about the latest Bahamut APT group campaign, check out the blog post “Bahamut cybermercenary group targets Android users with fake VPN apps” on WeLiveSecurity. Make sure to follow ESET Research on Twitter for the latest news from ESET Research.

SecureVPN website provides a trojanized app to download.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About ESET
For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide. With solutions ranging from endpoint security to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give individuals and businesses the peace of mind to enjoy the full potential of their technology. ESET unobtrusively protects and monitors 24/7, updating defenses in real time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company. Backed by R&D facilities worldwide, ESET became the first IT security company to earn 100 Virus Bulletin VB100 awards, identifying every single “in-the-wild” malware without interruption since 2003.

ESET 2022

How to Recover a FileVault Key

Jump to Tutorial

FileVault is a disk encryption feature built into macOS to protect your hard drive from unauthorized access. When enabled, your startup volume is locked when the Mac is sleeping or shut down, and the data is encoded so it can’t be read unless the login password is used.

When enabling FileVault, macOS asks you a critical question on how you would like to unlock your disk. There are two options (Figure 1):

Allow your iCloud account to unlock your disk
Create a recovery key

If you choose the first option while enabling FileVault, you only need to access your iCloud account to unlock your Mac and the OS will not create a separate recovery key. If you choose the second option, macOS generates a recovery key that you are expected to store in a safe place.

However, what happens if you lose the key? We’ll cover your options for potentially recovering a FileVault key in this tutorial.

screenshot of security and privacy — Figure 1

Note: If you lose both your Mac password and FileVault recovery key, you will not be able to log in to your device or access the data on your startup disk.

Not Sure if the Recovery Key Is Correct?

Maybe you have a recovery key, but are unsure if it’s the right one for this computer. Fortunately, if you are already/still logged in to your Mac, there is a way forward. You can validate the recovery key by taking these steps:

Launch the Terminal.app on your Mac: search for “terminal” using the Spotlight search option on your device or navigate through Applications > Utilities > Terminal.
Run the command sudo fdesetup validaterecovery and click return. Enter your admin password when requested.
You will be prompted to enter the current recovery key. Do exactly that and ensure you do not leave out the hyphens in the key. Because your entry is hidden and you cannot use the backspace if you type a mistake, we offer this pro tip: copy and paste into Terminal. Just be sure you don’t copy any leading or trailing spaces.

There are three possible outcomes:

true (Figure 2a) if your key is correct
false (Figure 2b) if the key you entered follows the format of a recovery key but is incorrect for this computer
Error: Not a valid recovery key (Figure 2c) if the key does not look like a recovery key at all (e.g., if you leave out the hyphens)

screenshot of a possible outcome — Figure 2a

Recovery Key Incorrect or Lost?

Unless your system is managed by a device management platform, if your FileVault recovery key is completely lost or the validation keeps returning false, unfortunately you cannot recover it. It is gone.

The only thing you can do while you still have access to your computer is to create a new key. You can do this in two ways:

Via Terminal.app
Via the FileVault tab under Security & Privacy

Whichever method you choose, note that you will not get the same recovery key that was lost. Instead, a new key will be generated.

1. Create a New Key Via Terminal

Launch the Terminal.app and run the following command:

sudo fdesetup changerecovery -personal

This method will allow you to generate a new key without having to turn off FileVault and re-enable it. Enter your user name and password when prompted to do so. If the change is successful, you will see a new recovery key (Figure 3).

Otherwise, you may get an error that you cannot change your key. We recommend trying the second method discussed below if this method doesn’t work for you.

2. Create a New Key Via FileVault Tab

With this method, you need to turn off FileVault and turn it back on to generate a new recovery key. On your Mac, go to Apple menu > System Preferences > Security and Privacy and click on the FileVault tab.

Then, click the lock icon on the left-hand side of the pane, provide the administrator password, and click Unlock. Afterwards, select Turn Off FileVault… (Figure 4). The decryption of your disk occurs in the background as you use your device and only while the device is awake and plugged into AC power. You can track the progress under the FileVault tab.

When the decryption is complete, return to the FileVault tab and click Turn On FileVault.You will be prompted to choose between iCloud or recovery key. If you choose “Create a recovery key and do not use my iCloud account,” be absolutely sure to copy it and store it in a safe place, such as your Password Manager.

Do not save it on the same startup disk you are encrypting.

Retrieving Your Key On a JumpCloud-Managed macOS Device

If you use a JumpCloud-managed macOS device, yes it is possible to retrieve your recovery key and avoid the perils of FileVault! Your IT admin will need to take the following steps:

Log in to the JumpCloud Admin Portal via https://console.jumpcloud.com/login/admin
Go to DEVICE MANAGEMENT > Devices
Under Devices, select the relevant device
Under Details, click the view key button

Boom, your admin can now see your recovery key. To learn more about retrieving a recovery key on a JumpCloud-managed device, check out the following support documentation:

Not using JumpCloud yet? Our open directory platform goes beyond allowing you to easily access recovery keys. It empowers you to manage access, user privileges, and the security settings of your entire fleet — no matter the OS. Use our platform for free for up to 10 users and 10 devices so you never have to worry about losing your FileVault recovery key again.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About JumpCloud
At JumpCloud, our mission is to build a world-class cloud directory. Not just the evolution of Active Directory to the cloud, but a reinvention of how modern IT teams get work done. The JumpCloud Directory Platform is a directory for your users, their IT resources, your fleet of devices, and the secure connections between them with full control, security, and visibility.

2022 JumpCloud

Fortinet Authentication Bypass Vulnerability – CVE-2022-40684

Introduction:

The latest FortiOS / FortiProxy / FortiSwitchManager vulnerability has been reportedly exploited in the wild, which allows an attacker to bypass authentication and login as an administrator on the affected system.

Vulnerability Release Time : Oct Nov, 2022
Vulnerability Component Name : FortiOS – FortiProxy – FortiSwitchManager
Affected Products :
- Affected FortiOS
  - 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.2.0, 7.2.1
- Affected FortiProxy
  - 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.2.0
- FortiSwitchManager
  - 7.0.0, 7.2.0
- FortiOS versions 5.x, 6.x are NOT impacted
- FortiProxy version 7.2.0

Solutions :

Please upgrade to FortiOS version 7.2.2 or above
Please upgrade to FortiOS version 7.0.7 or above
Please upgrade to FortiProxy version 7.2.1 or above
Please upgrade to FortiProxy version 7.0.7 or above
Please upgrade to FortiSwitchManager version 7.2.1 or above
Please upgrade to FortiSwitchManager version 7.0.1 or above
Please upgrade to FortiOS version 7.0.5 B8001 or above for FG6000F and 7000E/F series platforms

Execution Summary:

The CVE-2022-40684 vulnerability allows adversaries to bypass authentication and login into the vulnerable systems as an administrator in FortiOS / FortiProxy / FortiSwitchManager products.

Having admin user rights, adversaries can,

add new users to the vulnerable system
reroute the network traffic by updating network configurations
listen to and capture sensitive data by running packet capturing programs

CVSS v3:

Base Score: 9.8 (Critical)
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High

Mitigation:

As mitigation measures and security workarounds for remediating the threat, Fortinet advisory recommends disabling the HTTP/HTTPS admin interface or limiting the IP address that can access the latter. Customers are also highly recommended to upgrade their potentially vulnerable software to the latest versions.

Furthermore,

In their PSIRT Advisories blog, the FortiGuard Labs have given some mitigation suggestions and recommended performing the following upgrades according to the vulnerable products.

For FortiOS:

Upgrade to version 7.2.2 or above
Upgrade to version 7.0.7 or above

If applying patch is not possible for some other reasons, apply the following mitigation suggestions.

Suggestion 1: Disable HTTP/HTTPS administrative interface

Suggestion 2: Limit IP addresses that can reach the administrative interface

config firewall address
edit "my_allowed_addresses"
set subnet <MY IP> <MY SUBNET>
end

Then crate an Address Group

config firewall addrgrp
edit "MGMT_IPs"
set member "my_allowed_addresses"
end

Create the Local in Policy to restrict access only to the predefined group on management interface.

config firewall local-in-policy
edit 1
set intf port1
set srcaddr "MGMT_IPs"
set dstaddr "all"
set action accept
set service HTTPS HTTP
set schedule "always"
set status enable
next
edit 2
set intf "any"
set srcaddr "all"
set dstaddr "all"
set action deny
set service HTTPS HTTP
set schedule "always"
set status enable
end

If you are using non default ports, create appropriate service object for GUI administrative access:

config firewall service custom
edit GUI_HTTPS
set tcp-portrange <admin-sport>
next
edit GUI_HTTP
set tcp-portrange <admin-port>
end

Use these objects instead of "HTTPS HTTP "in the local-in policy 1 and 2 above.

For FortiProxy:

Upgrade to version 7.2.1 or above
Upgrade to version 7.0.7 or above

If applying patch is not possible for some other reasons, apply the following mitigation suggestions.

Suggestion 1: Disable HTTP/HTTPS administrative interface
Suggestion 2: For FortiProxy VM all versions or FortiProxy appliance 7.0.6:

Limit IP addresses that can reach the administrative interface:

config system interface
edit port1
set dedicated-to management
set trust-ip-1 <MY IP> <MY SUBNET>
end

For FortiSwitchManager:

Upgrade to version 7.2.1 or above: Disable HTTP/HTTPS administrative interface

Technical Analysis / Exploits:

We found an open admin panel link and we tried to use default credentials but they failed.

Now that our default bruteforce attack didn’t work, let’s try to use a new exploitation technique. Use below link to open exploit python script.
https://github.com/horizon3ai/CVE-2022-40684

Open the python script file and copy complete code. Create a new file in your local directory and paste that copied python code in the new file.

      In our case we created a file with the name pocforti.py and pasted the code in it

Now let’s run this python script and let it do the magic trick. Use below command with fortinet admin server ip, port number, and your public key path.

python3 pocforti.py -t <fortinet admin server ip>:<port number> --username admin --key-file <your public key path>

Now after executing the python script, let’s try to SSH the fortinet hosted server. Use bellow command to successfully SSH in fortinet server.

ssh admin@<fortinet server ip>

After successfully get fortinet server access, let’s create a new user in fortinet database

Now after adding a new user with admin rights, let’s try this user.

After entering the new credentials of the created user, we successfully login to the fortinet admin panel as an admin user

Open the admin users to verify if your user is successfully added as admin user or not

As you can see, our created user is successfully added in fortinet users as an admin user.

Reference:

#fortinet #FortiProxy #ForitnetAdminAccess #CVE-2022-40684

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

vRx 2022

Hardening

Hardening is the process of bringing our OS, application, etc. to a more secure state, by configuring the system aside from its default (or previous) settings by reducing the attack surface.

This process can (and will) usually include removing software/services from the OS, removing/changing default password, patching, and so on.

The process of hardening has for its aim to remove configuration vulnerabilities.

For example, you can place a password policy on your OS, so that the user has to enter more complex password, than no or a simple password which would classify as a configuration-based vulnerability.

The hardening process should be specific for the OS and the threats you’re attempting to control. It would not be the same for a Linux-based server that’s for example a public webserver and for a Windows desktop. This would be different because of the nature of the threats you’re going up against, i.e., you’d need to have different profiles for each of those.

This implies that there’s no general way to harden systems, however, there are things that you will tend to do that will hold for all those cases. Like, as I already mentioned, removing unnecessary stuff, reducing your attack surface by controlling what could be attacked better, etc.

Hardening is not a trivial task, as it requires in-depth understanding of a system you’re hardening. To make an extreme example – you could set your firewall to block all inbound traffic by default and you would be quite safe, but then again, the reason for that safety would be due to the fact you’ve rendered one of the (main) functionalities of that system unusable – Accessing the Internet. Thus, you really need to pay attention in order to strike that middle ground between usability and security in a sensible way. You don’t want to have issues with using your daily driver OS, and you don’t want to break it.

Layers

Its helpful to think of layers when hardening your systems. One such example can be the webserver I already mentioned. You would have the OS layer, thus you’d need to harden the OS itself, then if your, for example, Apache runs an app server, you’d need to harden that as well. Finally, if you have an application that’s running there – the code for that application would need to be written securely.

This is just an illustration, so that you have a general idea of what to think about when thinking about hardening, but I want to focus more on OSes (if necessary, I will create another OS dedicated article about hardening).

Standards

There are standards out there for mostly anything you’d like to harden, and it’s best to follow these. Similar to let’s say secure coding best practices, or any other type of best practices.

Also, there are scripts that can audit or remediate your system to a state you wanted, this not only saves you time, but it will also provide you with a good way to avoid any human-based errors, while hardening your system.

The standards can be called baselines, benchmarks, policies, standards, etc. Just an fyi. They still describe the same thing… also, note that these benchmarks are made by a community of security professionals, which is what we want.

One such hardening standard is the CIS Benchmarks. As you can see on the link, they offer hardening for Mobile Devices, Network Devices, Server/Desktop Software, Cloud, and more, aside from the OS benchmarks, and it’s a good place to start. Once you’ve found your target system you’d like to harden, you can click on the link for it and download the associated .pdf file for that specific benchmark. (You will need to fill out a form, but after that, you’ll be sent a link where you’ll be able to access all the available .pdfs and download them, for free).

Note that the standards needn’t necessarily align with your needs, so even these standards are not a silver bullet that you can implement blindly. Read it, understand it, and assess what you will need before going forward with the implementation.

Another one of these baselines is the NIST Configuration Baseline, but it’s a bit dated (offering only for Windows 7 and Red Hat – but if you have Red Hat in your environment, it might be useful to you). Regardless, it’s a good resource to skim through so you can learn a bit more on the topic.

One more standard/baseline is the Securiity Technical Implementation Guides (STIGs), from the DoD Cyber Exchange Team. These are up to date, and cover the latest OSes (mostly) and their respective security standards for hardening them. Do note that these are geared more towards the DoD and their requirements, so there might be some things in there that won’t be useful for your case. However, these are something I’d recommend anyone who wants to harden their system(s) to look at and think of them as general hardening guidelines. To view these, you’ll also need a STIG viewer, as they are in an XCCDF format.

Although this might be a bit of a hassle, it’s worth it because it will give you a very nicely laid out interface with recommended settings, references, information, and more – all related to the hardening of system(s).

SCAP – Security Content Automation Protocol

This is a NIST standard, and from their website, it’s about:

The Security Content Automation Protocol (SCAP) is a synthesis of interoperable specifications derived from community ideas. Community participation is a great strength for SCAP, because the security automation community ensures the broadest possible range of use cases is reflected in SCAP functionality.

And

NIST’s security automation agenda is broader than the vulnerability management application of modern day SCAP. Many different security activities and disciplines can benefit from standardized expression and reporting. We envision further expansion in compliance, remediation, and network monitoring, and encourage your contribution relative to these and additional disciplines.

The SCAP standard consists of the following components:

XCCDF
OVAL
DataStream
ARF
CPE
CVE

And is XML-based.

Simply put, SCAP is a protocol/standard that enables to create human and machine-readable security documents, that you can use with automated tools to audit/harden a target system.

Open SCAP is the implementation of SCAP. This is a bundle of tools, security policies, and is based on the SCAP standard. Be sure to check out the SCAP Workbench – This tool allows users to perform configuration and vulnerability scans on a single local or a remote system, perform remediation of the system in accordance with the given XCCDF or SDS file. Workbench can generate reports, in multiple formats, containing the results of a system scan.

It will both help you in case all of this is a bit confusing, and you can also run a test on your system, by inputting of the said standards in it and it will run it against that and tell you if your system passed/failed and if it has any vulnerabilities.

Unfortunately, Open SCAP is more focused on Linux systems (particularly Red Hat systems – CentOS/Fedora), but there is some (very minimal) MacOS and Windows support.

Conclusion

This is an extensive topic, and I hope my intro into it has attracted your attention. In the coming articles I will try to cover at least the OS portion of hardening – for Windows, Mac, and Linux.

Stay tuned!

Cover image by Ian Battaglia

#hardening #OS #application #SCAP #standard

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.

vRx 2022

How to Prevent DDoS Attacks in Your Company?

There are several methods by which malicious agents attack websites and destabilize network services and resources. One of the most widely used techniques is the DDoS attack, which means distributed denial-of-service.

Through this attack, a website ends up becoming inoperable and overloaded with malicious traffic. However, DDoS attacks can also be made against all types of network resources, such as virtual applications, data centers, enterprise servers, and APIs.

Traffic overload can cause a variety of problems for your company, from bottlenecks in accessing important data to the unavailability of all digital tools in the corporation. Therefore, it is important to be attentive and know how to prevent DDoS attacks.

There are several ways to prevent DDoS attacks on your company servers. In this text, we will explain in more detail what DDoS attacks are and how they can affect your business. Moreover, we will show you how to prevent DDoS attacks on your company.

To make our article clearer, we divided our content into topics. These are:

What Are DDoS Attacks?
How Can DDoS Attacks Affect Your Business?
How to Prevent DDoS Attacks?
About senhasegura
Conclusion

Enjoy the read!

What Are DDoS Attacks?

Before specifying what DDoS attacks are and how to avoid them, we must understand what DoS (denial-of-service) attacks are in general.

A DoS attack is a way of rendering a network resource unusable. The attack is usually carried out with a traffic overload, directing a series of superfluous requests to render the website unusable.

Through these malicious requests, the system ends up being overloaded and unable to process legitimate requests.

In the DDoS attack, the traffic maliciously directed to the resource comes from several sources. By multiplying the source of the attack, the method makes it impossible to avoid overloading by blocking a single source.

DDoS attacks are often used as a criminal mechanism. By making the system unusable, hackers can blackmail large organizations, so it is important to know how to prevent DDoS attacks.

There are numerous techniques for performing a DDoS attack. The simplest way to do this type of attack is through a specialized tool, such as Slowloris or Stacheldraht. This type of tool is included in several types of malware and can carry out an attack without the knowledge of the system administrator.

The best way to understand an attack like this is through the following metaphor: imagine a group of people crowding into a shop entrance, preventing access to legitimate consumers. In this way, the store itself becomes inaccessible.

How Can DDoS Attacks Affect Your Business?

DDoS attacks are intended to make legitimate use of websites and web resources in general unavailable. Thus, the attacker is able to disrupt the activity of the attacked organization.

The main targets of these attacks are online services that we use frequently and contain sensitive data, such as internet banking, media, educational tools, medical management systems, e-commerce, etc.

The motivations behind attackers vary. Different groups have different reasons for carrying out DDoS attacks.

Attacks are sometimes carried out as a form of political activism. When government agencies are the victims, the agents generally seek to cause some type of economic or social instability.

In the case of massive attacks organized by large groups, DDoS can be used as a distraction tactic, directing the attention of authorities and technical teams to smaller attacks.

In other cases, the motivations may be strictly financial. For example, a malicious competitor could order a DDoS attack to make its service more attractive to consumers.

Or, more directly, the attacker can use the DDoS attack to extort a company and gain illicit profits.

In these cases, the malicious agent produces an attack to disable some digital service and charges a ransom to return the system to normality. These are the attacks known as RDDoS (ransom distributed denial-of-service).

Another tactic is to just threaten the organization with an attack. To convince the company to pay the ransom, the attacker can make an attack demonstration, a “sneak peek”, proving its disruptive capacity and thus increasing their chances of profiting from the fear and panic produced, especially in people who do not even imagine how to prevent DDoS attacks.

Unfortunately, the company does not always have an adequate protection system. Furthermore, contacting law enforcement authorities can be a time-consuming solution and cause even more trouble with invaders.

Most of the time, hackers are not even tracked because they use cryptocurrency wallets to receive ransoms.

Besides, there is a whole lot of calculation to be done in the event of ransomware attacks. In fact, the answer to the simple question “should I or should I not pay the ransom?” may be more complicated than you think.

The consequences of a DDoS attack can be disastrous. The instability of internal systems, for example, can make the production process more expensive or even totally hindered. On the other hand, the unavailability of websites accessed by the public can make it impossible to attract customers and make sales.

How to Prevent DDoS Attacks?

However, the development of DDoS attacks has also given rise to a number of defense techniques.

In fact, there is a way to know how to prevent DDoS attacks. Defenses against these attacks involve a combination of detection technologies, traffic classification, and response tools.

Basically, the goal is to block traffic identified as malicious and only allow traffic classified as legitimate.

About senhasegura

We, from senhasegura, are a company specializing in digital security. Through our services, we seek to give companies sovereignty over their actions and privileged information.

Our job is to fight corporate cyberattacks and data theft by protecting one company from others who track the actions of network administrators, databases, and internal servers through an integrated PAM solution.

We also work to comply with demanding audit requirements and other standards, such as the Sarbanes-Oxley Act.

Conclusion

By reading this article, you saw that:

A DDoS attack consists of distributed denial-of-service;
These DDoS attacks can be made against websites and all types of network resources;
The attack is usually performed with a traffic overload;
In the DDoS attack, the traffic maliciously directed to the resource comes from several sources;
There are numerous techniques for performing a DDoS attack and the attackers’ motivations are also varied;
DDoS attacks allow attackers to disrupt an organization’s operations. Hence the importance of knowing how to prevent DDoS attacks;
To prevent DDoS attacks, it is necessary to combine detection technologies, traffic classification, and response tools.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Segura®
Segura® strive to ensure the sovereignty of companies over actions and privileged information. To this end, we work against data theft through traceability of administrator actions on networks, servers, databases and a multitude of devices. In addition, we pursue compliance with auditing requirements and the most demanding standards, including PCI DSS, Sarbanes-Oxley, ISO 27001 and HIPAA.

2022 Segura