DDoS Attacks Stopping Websites from Working Summer 2013

There used to be a misconception that if everyone flushed their toilet at the same time, the water supply demand would break. The same idea was behind a strike of buying gas when the prices go up - stop buying gas to protest the price increase. We hope that democratic societies allow for voting to get a certain politician into office works the same way.
That same concept - for many members of a group to cause a strong effect on a few, is used in the computer / Internet world. Specifically the 'bad guys' who are trying to get notoriety for respect, or earn money for doing bad things on behalf of others, have devised a similar idea in the Internet world.

The Internet is a lot like automobile roads and traffic. It was designed to handle a huge amount of traffic and do so through routes that are shortest path to their destination.  Hackers have figured out that they can take control of many computers and use them to attack a few machines at specific locations - like Visa, Bank of America, Macy's, government web sites, or even Internet providers like Comcast and website hosting places like GoDaddy.

HOW DDoS WORKS
Simply explained - the attack is easy to understand; an individual has control over a bunch of 'drone' or 'zombie' computers (which have previously been infected with a Botnet, allow hackers to control them from anywhere in the world, whenever they want) to attempt to go to a website.
Typically websites are designed to handle 30 to 75 people looking at a website at once. Bigger companies can handle much more simultaneous traffic.  When the amount of people looking at the same time goes up to 10,000, it may be difficult to 'serve' those 'webpage requests' all at once. Hackers will employ tens of thousands of machines to view a website, at the same time, which in effect with cripple the website from displaying.  This effect is called a Distributed Denial of Service Attack (DDoS) attack.  Other attacks are based around attacking the machines which help route a PC to the particular page they are trying to visit. This second explanation is what has just happened over the past several months. (BIND 9 has been patched for a vulnerability.)

Recently layman's tools to command and control these kinds of Botnet infected PC's have become readily available. As recently as mid-June 2013 through August 2013, many many websites are made unavailable because of DDoS attacks, or intercepting an unpatched website look up machine.  The effect of which is over 700,000 websites stopped working in July 2013.

MOTIVATION OF HACKERS
In some cases, their motivation is political - to free a political prisoner, or to represent ideologies.  But the DDoS tools are so common today that many attacks are now done because 'it can be done,' and it will provide credibility to various hackers for respect of other, more powerful hackers. I do not want to get into the childish psychology of these 'younger' hackers, but in general it is no longer just for a specific political purpose. It is for personal gain and an individual's ranking in a type of hacker social stratum. 

Neustar has created a helpful infographic showing the 2012 DDoS statistics, as compared to 2011 DDoS data. Kaspersky Labs has created this infographic to help understand how Botnet's effect your computer as well as the Internet at large.

For more detailed information on DDoS attacks, here are a few websites explaining the types, trends, technologies and effect on the world:

ArborNetworks.com Live Threat Portal
NetworkComputing.com DDoS Attacks Getting Bigger, Report Finds
ComputerWeekly.com  New Threat Portal pegs DDoS Attacks at 2570 per Day
Rivalhost.com 12 Types of DDoS Attacks Used by Hackers
Akamai.com The Challenge: Safeguarding Against DDoS Attacks
Verizon Enterprise 2013 Data Breach Investigations Report
Rivalhost.com Understanding Web Threats: Denial of Service Attacks
eWeek.com How Do Booters Work? Inside a DDoS Attack for Hire
Circleid.com 5 Steps to Prepare for a DDoS Attack
Bankinfosecurity.com Who's Really Behind DDoS?

Snall Business Is Still a Hacker's Main Target

Recent reports still show that the hacking community is still targeting small business for their lack of regularly updated security practices in IT. So if you are operating a small business and have not taken your computer security seriously, you should.

Rackspace Hosted Exchange SMTP Changes

Rackspace has decided to improve their email security for their clients and resellers. This means SOME people who have been using their SMTP servers (secure.emailsrvr.com) as CRAM-MD5, will have to reconfigure their email clients to new outgoing email server settings.

This update will only effect users of the following email clients:
 - Mozilla Thunderbird
 - Apple Mail Client (Apple Mail app on iMac's)
 - Older Apple iPad's, iPhones and iPod's that have not upgraded to iOS 6.x


Here is the official announcement and details:

On June 26, 2013, Rackspace will be performing a maintenance on the Rackspace Email and Microsoft Hosted Exchange environments which will remove the ability for mail clients to send mail using the legacy authentication protocol, CRAM-MD5. Once removed, a very small portion of our customers may lose the ability to send mail until their mail client's SMTP authentication method is changed.

Why is Rackspace making this change? Rackspace is continually striving to improve the quality, usability, and security of our mail offering. While CRAM-MD5 is a secure authentication protocol, the industry as a whole has been migrating away from using this mechanism. The recommended method for sending mail today is to use PLAIN/PASSWORD authentication over an SSL or TLS connection.

Will I be impacted? Our extensive testing in preparation for this maintenance has proven that the vast majority of mail clients do not use CRAM-MD5 by default. It is very difficult to pinpoint each and every mail client, version, device, etc that could be impacted, although we do know that if you are running one of the following configurations you could be impacted by this change:

- Thunderbird
- Apple Mail (Mac Mail)
- Apple devices still running legacy iOS versions (prior to IOS 6.x)

* NOTE: Customers using iPhones with Mobile Sync enabled will NOT be impacted.

I'm impacted / will be impacted... How do I fix this? If you feel you may be impacted, or after the maintenance is complete you are no longer able to send mail from your client, you can resolve this issue using one of the following means:

1) Re-configure your mail client so it does not use CRAM-MD5 authentication for SMTP (sending). We also suggest connecting to our system via SSL or TLS when sending mail. Instructions for setting up your mail client can be found at https://help.emailsrvr.com. Please refer to this article http://www.rackspace.com/knowledge_center/article/end-of-support-for-smtp-authentication-using-cram-md5 for instructions on changing the SMTP authentication method.

2) Of course, Fanatical Support is always an option! You can call or chat with a member of our support team and we can walk you through the process.

Is there a workaround while I'm trying to set this up properly? Absolutely! You can always login to webmail to access and send email like normal should you experience issues and need to send something quickly. The webmail login can be accessed here: https://apps.rackspace.com/. You may also read the frequently asked questions below.

...

Frequently Asked Questions

Q: Can you tell if I’m affected?
A: Unfortunately, we have no way of identifying which users specifically are connecting with CRAM-MD5 authentication.

As long as your users are connected with PLAIN/PASSWORD authentication over an SSL or TLS connection, they will not see an impact.  It's always best to double check on the mail clients in question.

Q: Why are only certain clients affected?
A: While we do not know for sure every email client and/or version that could be affected, email clients will be affected if configured using CRAM-MD5.  We have put together instructions for the most common clients and devices that we are aware of that could be configured using CRAM-MD5. As far as we can tell, outlook users will not have any issues. Please refer to this article http://www.rackspace.com/knowledge_center/article/end-of-support-for-smtp-authentication-using-cram-md5 for instructions on changing the SMTP authentication method.

Q: What will happen if I do nothing and I’m affected?
A: Your incoming emails will still be delivered as normal.  You will receive an error, however, when attempting to send emails using SMTP.  As a work-around, you can always use webmail to send/receive at apps.rackspace.com