Hackers Deface Web Sites; FBI Issues DDoS Warning

[InfoSec News <isn () C4I ORG>]

http://www.internetnews.com/wd-news/article/0,,10_760451,00.html

By Ryan Naraine and Michael Singer
May 7, 2001

Web page defacement attacks by hackers have escalated dramatically in
the last 24 hours, with technology news site CNET, Webex and game
developer Blizzard.com among those hit this morning.

At 2:00 p.m today, 153 defacements were reported by Alldas.de a site
which archives posts mirrors of hacking attacks around the world.

Executives at Web-based meeting center, WebEx say they can't explain
the defacement of their home page Monday.

"We have no idea why anyone would be interested in attacking us," says
one WebEx executive who asked not to be identified.

Visitors to the site were greeted to a black page with bold red
letters slamming both the U.S. government and another group of
cybervandals.

"f*** USA Government - f*** PoizonBOx," read the message along with an
email contact to a Chineese Yahoo! e-mail account.

A copy of the defaced site was immediately posted at Attrition.org, a
site where hackers also sometimes post their exploits.

The San Jose-based company runs an online service that lets you run
real-time meetings right through your Internet browser.

As to why a separate hacking group would be named during a defacement,
Attrition spokesperson Modify could only give these thoughts.

"Because he/she/they have been defacing .tw sites (Taiwan)," says
Modify.

In March, the British government launched an investigation into
PoizonBOx after a chain of UK government Web sites had their
information replaced with graffiti showing a self-styled logo.

Web Attacks On Upswing

Today's defacement barrage comes just days after a hacking group
calling itself "Prime Suspectz" hit three Microsoft sites. The latest
round of attacks also include pro-Chinese slogans and seemed to be
targeting U.S commercial and government Web sites.

Last week, the Federal Bureau of Investigations (FBI) issued a warning
that U.S sites faced hacking attacks from pro-Chinese groups. The FBI
said Chinese hacker groups planned to retaliate against U.S attacks on
Chinese government-owned sites.

This week's attacks coincided with the recent political standoff
between the two countries and the second anniversary of the NATO
bombing of a Chinese embassy in Belgrade, according to the FBI.

In the recent round of attacks, Web pages owned by the Inter-American
Defense Board, The U.S Fish and Wildlife Service, the Department of
Health and Human Services and several universities in Washington, D.C
were hit with defacements.

Explicit anti-American messages were posted and defacements included
the flags of Russia and China.

Separately, the FBI warned there would be ongoing attempts to disrupt
Web access to several sites. The National Infrastructure Protection
Center (NIPC), which acts as the FBI's cybercrime unit, said hackers
planned to use distributed denial-of-service (DDoS) attacks to cripple
targeted Web sites.

Denial-of-service attacks typically flood Web sites with excess
traffic, effectively slowing or blocking access to targeted sites.

"The activity has been seen from several networks, and consists
entirely of fragmented large UDP packets directed at port 80. Analysis
indicates that this activity may be intended to bypass standard
port/protocol blocking techniques, as certain major routing equipment
manufacturer's products will block the first fragment of a large UDP
packet, but may not block subsequent packets, thereby permitting the
denial of service to continue," the NIPC said in a warning issued over
the weekend.

The unit advised systems and network administrators to inspect their
facilities (firewall logs) for the presence of fragmented UDP packets
directed at port 80.

"Inbound packets of this type indicate that a denial of service to the
network in question may be underway. Outbound packets of this type
indicate that there is a high likelihood that system(s) on the network
in question are compromised and that DDOS tools are installed.
Attempting to block this traffic at the IP-only level (as opposed to
protocol-specific level like UDP) may have improved effectiveness," it
said.

To determine if a computer system has been infected with a DDoS agent,
the NIPC has posted a "Find DDoS" tool on its Web site. The tool may
be downloaded from the NIPC site.

The FBI has also called on targeted sites to report computer
intrusions to their local FBI office.

Incidents may also be reported online or by dialing
202-323-3204/3205/3206.

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".