Assault on Westboro Baptist Church Website Continues

The denial of service (DoS) attack initiated by The Jester (th3j35t3r) on a website operated by the Westboro Baptist Church has now exceeded two full weeks in duration.

The sustained DoS attack, which began on February 21st, represents a record for the hactivist who is best known for repeated DoS attacks on militant Jihadi websites (video), as well as an attack on the WikiLeaks website in late November that forced the organization to shuffle Internet hosting providers.

According to data from NetCraft, Westboro Baptist Church's controversial "www.godhatesfags.com" website has shown no activity for over two weeks:



The Jester has tweeted several messages regarding the attack, the last (as of the writing of this article) was on March 6th and described the attack as being a "no holds barred assault".

Another of the tweets mentions that the strategy behind the sustained attacks differs from those aimed at jihadi sites because "Some people people just need to stay down, they have no value in intel terms".



In an interview in 2010, The Jester elaborated on his anti-jihadi methodology:

"By knocking out the jihadi sites for random short periods, it causes them to be unable to rely on the site for recruitment, or co-ordination, this in turn will have the effect of drawing them out into the open and in person to do the recruiting, where the CT agencies really come into their own doing what they do best, which is intercepting and apprehending suspects".

The Jester uses a DoS tool he calls XerXeS to perform an application level attack on the targeted servers.
Where traditional TCP-based DoS attacks require multiple machines sending a large number of packets, the XerXeS attack can be performed by a single low-spec machine with relatively few packets.

On the development of XerXeS, The Jester remarked that "the aim is to create a single cohesive attack platform that will knock out with precision and no side-effects anything it comes up against, for any specified period."


How long will the WBC operation carry on? For now, the answer looks to be indefinitely.

[InfoSecIsland]

Further attacks on WordPress under investigation

 
Following a massive attack on WordPress.com on 3 March, WordPress was hit by a second attack in the early hours of the morning of 4 March. Apparently there was some speculation that the attacks might be connected to the current unrest in the Middle East, but investigation now appears to show that these attacks originated in China, with some traffic from Korea and Japan.

The Automattic status page which displays the operating status for WordPress and other services still shows the two outages. A note on the second attack states, "Unfortunately, the DDoS attack from yesterday returned in a different form this morning and affected sitewide performance,The good news is that we were able to mitigate it quickly and performance returned to normal around 11:15 UTC. We are continuing to monitor the situation closely."

WordPress founder Matt Mullenweg commented to TechCrunch that one of the targeted sites was a Chinese-language site that was also blocked on Baidu, leading to the initial assumption that the attack was political. Later he said that closer investigation showed it more likely to have been business related, although there has been no response from the site's owner.

[H-Online]

WordPress Hit by Second Massive Attack in Two Days

The main WordPress.com site was the target of a major DDoS attack yesterday that knocked the popular blogging platform offline for a couple of hours, and another attack that hit the site again Friday morning. The service is back online now, but the attacks may be an indication that the service could be collateral damage in some politically motivated attacks against WordPress blogs.

The first attack hit WordPress in the early afternoon on Thursday, and WordPress officials said that at its peak the attack traffic was in the range of several Gigabits per second, according to a report by TechCrunch.

"WordPress.com is currently being targeted by a extremely large Distributed Denial of Service attack which is affecting connectivity in some cases. The size of the attack is multiple Gigabits per second and tens of millions of packets per second," officials said in a statement during the attack.

Officials at WordPress and Automattic, which owns WordPress, did not say whether they'd identified the source of the attack, but they hinted about what may have been behind it.

"This is the largest and most sustained attack we’ve seen in our 6 year history. We suspect it may have been politically motivated against one of our non-English blogs but we’re still investigating and have no definitive evidence yet," Matt Mullenweg, founder of WordPress and Automattic, told TechCrunch.

A second attack hit WordPress early Friday morning Eastern time, severely hampering the site's availability. According to uptime and availability graphs provided by Automattic, WordPress.com availability plunged from 100 percent to roughly 66 percent at about 5 a.m. Friday.

"Unfortunately, the DDoS attack from yesterday returned in a different form this morning and affected site-wide performance. The good news is that we were able to mitigate it quickly and performance returned to normal around 11:15 UTC. We are continuing to monitor the situation closely," a statement from Automattic on the site says.

WordPress is far and away the most popular blogging platform on the Web and is the hosting provider for some of the more highly trafficked media sites, including CBS and TechCrunch itself.

[ThreatPost]

South Korea hit by cyber attacks

South Korea has been hit by a series of cyber attacks which have targeted some of the country's leading websites.

Government ministries, the National Assembly, the military headquarters, US Forces in Korea and major banks were among those hit.

It is believed that the attackers injected malware into two peer-to-peer file-sharing websites.
The attacks are similar to those that targeted South Korean websites in July 2009.

Some 29 institutions were affected by so-called distributed denial-of-service attacks (DDoS) which overload a site with data causing it to fall over.

The web page of the Financial Services Commission, the country's financial regulator, was overloaded and an online stock trading system was shut down for a few minutes but both soon recovered, according to government sources.

North Korea


"There was a DDoS attack, but no damage was done," said an official from the presidential office.
South Korean security firm AhnLab expected another wave of attacks on Friday, targeting up to 40 government and corporate websites.

It estimates that up to 11,000 personal computers were infected by malware and recruited for the attack. It is distributing free software to clean PCs.

The South Korean cyber investigation unit has sent investigators to the two file-sharing sites that are believed to have spread the malicious code, according to the National Police Agency.

The cyber attacks against South Korea in 2009 were blamed on North Korea, although no link has been proven.

South Korean media outlets have, in the past, accused North Korea of running an internet warfare unit aimed at hacking into US and South Korean military networks.

[BBC]

WordPress.com Suffers Largest DDoS Attack In Its History

You have no idea how hard it was to get this post up, as WordPress.com, our blog host, is currently under a denial of service attack. It’s been almost impossible to access the TechCrunch backend for the past 10 minutes (everything seems to be stable now) and users have been receiving a “Writes to the service have been disabled, we will be bringing everything back online ASAP” error message.

From the VIP blog post:

WordPress.com is currently being targeted by a extremely large Distributed Denial of Service attack which is affecting connectivity in some cases. The size of the attack is multiple Gigabits per second and tens of millions of packets per second.
We are working to mitigate the attack, but because of the extreme size, it is proving rather difficult. At this time, everything should be back to normal as the attack has subsided, but we are actively working with our upstream providers on measures to prevent such attacks from affecting connectivity going forward.
We will be making our VIP sites a priority in this endeavor, and as always, you can contact us via xxxxx@wordpress.com for the latest update. We will also update this post with more information as it becomes available

WordPress did not mention the origin of the attack (DDoS =! Anonymous) and I have contacted founder Matt Mullenweg for more information. WordPress.com currently serves 30 million publishers, including VIPs TED, CBS and TechCrunch, and is responsible for 10% of all websites in the world.

WordPress.com itself sees about 300 million unique visits monthly.

Update: Automattic and WordPress founder Matt Mullenweg tells us that this is the largest attack WordPress.com has ever seen, and is likely to be politically motivated:

“There’s an ongoing DDoS attack that was large enough to impact all three of our datacenters in Chicago, San Antonio, and Dallas — it’s currently been neutralized but it’s possible it could flare up again later, which we’re taking proactive steps to implement.


This is the largest and most sustained attack we’ve seen in our 6 year history. We suspect it may have been politically motivated against one of our non-English blogs but we’re still investigating and have no definitive evidence yet.”


You can check here for the latest status updates.

[TechCrunch]

Jester claims credit for knocking Westboro Baptist Church offline

Patriot hacker The Jester has claimed credit for denial of service attacks against the controversial Westboro Baptist Church.

The self-proclaimed activist revealed in a twitter update that he had torn into the Church's website in protests against its pickets on the funerals of American servicemen with anti-gay signs. "www.godhatesfags.com – TANGO DOWN. Temporarily. For celebrating the death of US troops – honeypot fail btw" the update read.

The Jester shot to fame with denial of service attacks against WikiLeaks around the time the site released US diplomatic cables late last year.

It's still unclear whether Westboro Baptist Church itself or sections of Anonymous were the first to post threats against the church last weekend. The threats were later disavowed by members of Anonymous as a massive troll and a honeypot operation designed to capture IP addresses for subsequent lawsuits. The assaults on the church's GodHatesFags site have remained ongoing during the week and the site remained unreachable (at least from Europe) on Thursday afternoon.

The Jester is known to have helped develop an application layer attack tool for assaulting jihadist sites, called XerXeS, a utility he has taken to applying to a range of targets, including WikiLeaks, and also, it is suspected, the controversial church, led by fire-and-brimstone minister Fred Phelps. The tool attacks sites at the application level and is therefore more sophisticated than the packet-flooding LOIC that's become the main artillery piece in assaults by Anons against those who have earned the loosely knit group's collective displeasure over recent months. ®

[The Register]

DDoS attack forces Dutch bank offline

The outage of Dutch bank Rabobank last weekend was caused by a massive DDoS attack. The perpetrators are still unknown. The bank reports the attack to the police.

After two days of mystery surrounding the outage Rabobank gave Dutch IDG-title Webwereld a statement explaining the breakdown of both its website and its e-banking services. The Dutch bank was hit by a large DDoS attack (Distributed Denial of Service). The outage of Rabobank happened saturday evening and again sunday afternoon. The website and e-banking services were inaccessible for desktop and mobile users.


Domino effect

The DDoS attack also caused an outage in the Dutch central payment system iDeal. That alternative to PayPal was flooded with returned transaction messages from the attacked bank. This DoS-'attack' (Denial of Service) caused the payment system to go partially down.

A spokesperson for iDeal-operator Currence tells Webwereld that the buffer of one of its two platforms was filled up. Banks that were connected to that affected platform were also unable to process iDeal payments.

Attackers

Rabobank has now stated that is was under attack by unknown parties. The website Rabobank.nl was bombarded with large amounts of traffic and subsequently collapsed. This was done with intent, says the bank. It will therefore file a police report about this DDoS attack. A spokesman could not tell Webwereld where the DDoS attack originated. "That is part of the investigation, about which we wil make no statements."

The bank already suspected that the outage was caused by malicious intent. It did not utter this suspension publicly until tuesday evening after it had confirmed the cause of the breakdown. Questions from Webwereld about the nature of the problem and the countermeasures had therefore not been answered yet.


Customers cut off

Rabobank's e-banking service was unreachable during the weekend on both saturday and sunday. To deflect the attack Rabo altered the DNS (domain name system) records for it's website. As a result the site was unreachable for the attackers but also for the general public.

Dutch customers of the bank have been complaining about the site and e-banking system being down long after the actual outage had been resolved. The bank was in discussions with local telecoms companies and internet providers to provide connections to Rabobank for their respective customers. This took until monday. Customers outside of the Netherlands were cut of until at least tuesday afternoon.


Government site hit by DDoS

Last week the centralized website of the Dutch government (Rijksoverheid.nl) was hit by a massive DDoS attack. A spokesperson told Webwereld that the attack originated "from a foreign country", but refused to specifiy that claim. The government website was offline for several hours. During that attack the website of the government organisation Rijkswaterstaat.nl was also hit, albeit only for a short time. The government has filed a police report.

[idg.no]