Following the news that Discord, a free VoIP service designed for gaming communities, has had its chat servers abused to host malware, security experts from MWR Infosecurity, Imperva, FireMon, Plixer, Synopsys and Tripwire commented below.
Adam Horsewood, Senior Security Consultant at MWR Infosecurity:
“As to why the East coast is being specifically targeted, it may be that it isn’t. Cloud services make use of a technology called anycasting. Before anycasting, when you visited a website, it was like making a long distance trip to a specific location. With any-casting, the journey is cut down, as there are many copies of the location, distributed globally. As an analogy, instead of traveling for 20 minutes to go to a large supermarket, you could just go to your local corner shop, of which there are many similar copies. This makes these services quick to respond, and more resilient to attack, as they don’t exist in one single place anymore.
“The traffic that is causing the problem will likely go to the nearest copy of Dyn’s services, following their ISP’s routing, something they don’t control. The maps could indicate where the majority of the traffic is sourced or the nearest Dyn node to it.
“Assuming that Dyn advertise their service equally in different locations, what you are likely to be seeing is a large amount of source attacks in the region going to the nearest Dyn node or copy, indicating the source of the majority of the traffic is likely to be the US.
“Looking at http://downdetector.com/status/level3/map/, there appear to be smaller outages occurring in the UK, which is probably where the traffic from the EU is heading too. If the US’s east coast is targeted, the attacker would need to be targeting something specific to the east coast, which may be possible, but would require more of an investigation to facilitate.
“There are many types of attacks that fall under the DDOS banner, the most common of which is sheer volume. Botnets, a group of machines under the control of an attacker, often without their owner’s knowledge, can make use of badly configured services in their attack. They send a small request to these services, pretending to be their actual target. The services then respond, sending traffic on mass to the actual target. This has the added benefit of hiding the actual source of the attack from the victim.
“DDOS network resource exhaustion attacks are hard to protect against, as you have to accept a large amount of traffic before you can even do anything with it. You need to accept the traffic, and then strip out all the illegitimate or unwanted requests.
“Often this protection is outsourced to dedicated providers, who scrub the data clean. They may find something in the attack data that allows them to fingerprint the attack traffic specifically. But until they find something to differentiate the attack traffic from legitimate traffic, it can be difficult to distinguish one from the other.”
Marc Gaffan,General Manager, Incapsula at Imperva:
Igal Zeifman, Security Evangelist, Incapsula at Imperva:
.
.
Paul Calatayud, CTO at FireMon:
“What causes me to pause and reflect most in regards to this breaking news is that Dyn DNS is a DNS SaaS provider. Its core job is to host and manage DNS services for its clients. The impact and harm has a ripple effect attributed to the various clients Dyn services. As attackers evaluate their targets, and organizations run to the proverbial cloud for various reasons, it introduces interesting targets for the bad guys.
“So, what can be done? First, evaluating dependency on cloud providers remains a risk you cannot outsource. Begin to plan for situations where cyber-attacks against you may never be directed at you, but rather organizations you come to rely upon. In the case of this attack and DNS, having a secondary DNS service operating at the same time may have mitigated the impact to your organization even when your primary provider goes down. Cloud Governance becomes an element of a CISO security program.”
Thomas Pore, Director of IT at Plixer:
Mike Ahmadi, Global Director, Critical Systems Security at Synopsys:
Craig Young, Security Researcher at Tripwire:
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.