Top IT Security Bloggers

Arbor Networks

  • FCC advised on Remediation of Server-based DDoS Attacks

    Arbor Networks
    Yesterday, the Communications Security, Reliability and Interoperability Council (CSRIC), a federal advisory committee to the Federal Communications Commission (FCC), submitted its final report on Remediation of Server-based DDoS Attacks.
    The CSRIC’s Working Group 5 was tasked with developing recommendations for communications providers to enable them to mitigate the impact of high volume DDoS attacks launched from large data center and hosting environments.
    The final report includes a comprehensive look at the DDoS threat landscape, covering everything from the massive size [...]

  • Let’s Talk About NewPosThings

    Arbor Networks
    by Dennis Schwarz and Dave Loftus
    NewPosThings is a point of sale (PoS) malware family that ASERT has been tracking for a few weeks. It operates similarly to other PoS malware by memory scraping processes looking for credit card track data and then exfiltrating the spoils to a command and control (C2) server. Based on compilation times, it has been in active development since at least October 20, 2013—with the latest timestamp being August 12, 2014. Since we haven’t come across [...]

  • IPv4 Is Not Enough

    Arbor Networks
    Last week in Chicago, at the annual SIGCOMM flagship research conference on networking, Arbor collaborators presented some exciting developments in the ongoing story of IPv6 roll out.  This joint work (full paper here) between Arbor Networks, the University of Michigan, the International Computer Science Institute, Verisign Labs, and the University of Illinois highlighted how both the pace and nature of IPv6 adoption has made a pretty dramatic shift in just the last couple of years. This study is a thorough, well-researched, effective analysis and [...]

  • Five Sinkholes of newGOZ

    Arbor Networks
    By Dennis Schwarz and Dave Loftus
    It has been a few weeks since news broke of the Zeus Gameover variant known as newGOZ. As has been reported, the major change in this version is the removal of the P2P command and control (C2) component in favor of a new domain generation algorithm (DGA).
    The DGA uses the current date and a randomly selected starting seed to create a domain name. If the domain doesn’t pan out, the seed is incremented and the [...]

  • DDoS and Geopolitics – Attack analysis in the context of the Israeli-Hamas conflict

    Arbor Networks
    Since its inception, the ASERT team has been looking into politically motivated DDoS events [1] and continues to do so as the relationship between geopolitics and the threat landscape evolves [2]. In 2013, ASERT published three situational threat briefs related to unrest in Syria [3] and Thailand [4] and threat activity associated with the G20 summit [5].  Recently, other security research teams, security vendors and news agencies have posited connections between “cyber” and geopolitical conflicts in Iraq [6], Iran [7], [...]

  • The Citadel and Gameover Campaigns of 5CB682C10440B2EBAF9F28C1FE438468

    Arbor Networks
    As the infosec community waits for the researchers involved to present their Zeus Gameover take down spoils at the next big conference; ASERT wanted to profile a threat actor that uses both Citadel, “a particularly sophisticated and destructive botnet”, and Gameover, “one of the most sophisticated computer viruses in operation today”, to steal banking credentials.
    Citadel Campaign
    When a threat actor decides that they would like to start a Citadel campaign they: buy the builder software, build the malware, distribute [...]