{"id":140200,"date":"2015-09-29T15:41:31","date_gmt":"2015-09-29T13:41:31","guid":{"rendered":"http:\/\/mybroadband.co.za\/news\/?p=140200"},"modified":"2015-09-29T15:42:35","modified_gmt":"2015-09-29T13:42:35","slug":"akamai-xor-ddos-warning","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/140200-akamai-xor-ddos-warning.html","title":{"rendered":"Akamai XOR DDoS warning"},"content":{"rendered":"<p>Akamai&#8217;s Security Intelligence Response Team <strong><a href=\"https:\/\/www.stateoftheinternet.com\/resources-web-security-threat-advisories-2015-xor-ddos-attacks-linux-botnet-malware-removal-ddos-mitigation-yara-snort.html\" target=\"_blank\">announced it is tracking XOR DDoS<\/a><\/strong>, a Trojan malware attackers use to hijack Linux machines to\u00a0include within a botnet.<\/p>\n<p>To date, the bandwidth of DDoS (distributed denial of service) attacks coming from the XOR DDoS botnet has ranged from a few gigabits per second to 150+ Gbps.<\/p>\n<p>The gaming sector is the primary target, followed by educational institutions.<\/p>\n<p>The botnet is attacking up to 20 targets per day, 90% of which are in Asia. Akamai recently mitigated two DDoS attacks orchestrated by the XOR DDoS botnet &#8211; one of 50Gbps, and the other of 100Gbps.<\/p>\n<p>Other recent examples of Linux-based malware includes the Spike DDoS toolkit (which also targeted Windows machines) and IptabLes and IptabLex malware.<\/p>\n<p>There are an increasing number of Linux vulnerabilities for malicious actors to target, such as the heap-based buffer overflow vulnerability found earlier in 2015 in the GNU C library. However, XOR DDoS does not exploit a specific vulnerability.<\/p>\n<p>SIRT&#8217;s research indicates the malware is of Asian origin, based on the command-and- control (C2) IP addresses and source IP addresses of the attack payloads.<\/p>\n<p>The malware does not spread via a host vulnerability. Rather, it populates via Secure Shell (SSH) services that are susceptible to brute-force attacks due to weak passwords.<\/p>\n<p>Once login credentials have been acquired, the attackers uses root privileges to run a Bash shell script that downloads and executes the malicious binary.<\/p>\n<h3 class=\"my-4\">More on DDoS attacks<\/h3>\n<p><strong><a href=\"http:\/\/mybroadband.co.za\/news\/security\/135794-a-new-ddos-reflection-attack-portmapper.html\">A new DDoS Reflection Attack: Portmapper<\/a><\/strong><\/p>\n<p><strong><a href=\"http:\/\/mybroadband.co.za\/news\/security\/134976-large-ddos-attacks-often-use-syn-and-udp-vectors.html\">Large DDoS attacks often use SYN and UDP vectors<\/a><\/strong><\/p>\n<p><strong><a href=\"http:\/\/mybroadband.co.za\/news\/security\/130644-massive-increase-in-ddos-attacks.html\">Massive increase in DDoS attacks<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Akamai&#8217;s Security Intelligence Response Team has released a threat advisory for XOR DDoS attacks.<\/p>\n","protected":false},"author":23,"featured_media":85121,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_facebook_post_id":"","_sma_instagram_post_id":"","_sma_threads_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27],"tags":[36,3340,2242,33122],"class_list":["post-140200","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-active","tag-akamai","tag-ddos","tag-xor-ddos"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/140200"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=140200"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/140200\/revisions"}],"predecessor-version":[{"id":140208,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/140200\/revisions\/140208"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/85121"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=140200"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=140200"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=140200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}