Slashdot Mirror
NASDAQ and BATS DDoSed
DMandPenfold writes with a quote from an article in Computer World: NASDAQ and BATS saw their sites disrupted during the day on Monday and Tuesday respectively. The sites host company news and share price data, as well as vital information on live service status on the exchanges. It is understood, however, that while the websites were affected, the stock exchanges continued to trade as normal with no change to trading. A spokesperson at BATS said the exchange's site had been hit with 'an external Distributed Denial Of Service incident.' Our trading systems were not affected and there were no exchange customer disruptions associated with the incident.' ... NASDAQ told the Wall Street Journal that on Tuesday it experienced 'intermittent service disruptions on our corporate websites.' It is not known who initiated the attacks. In 2010, NASDAQ's Directors Desk online scheduling application was compromised by hackers. An FBI investigation found that the stock exchange's aging software and out of date security patches played a key part in the problems."
You mean people on wall street take shortcuts? That's crazy talk.
What do I know, I'm just an idiot, right?
9:36 am - a story is posted on Slashdot: Megaupload Co-Founder Allowed Bail.
11:18 am - a story is posted about outages to high profile web sites.
And to think that people were asking what harm could it do to give the Megaupload guy access to the internet...
right ?
Read radical news here
I got $10 on it being robotraders.
Having to work for a living is the root of all evil.
I'd be curious to know if a particular application-level vulnerability was used in this event. There has been several vulnerabilities of late related to Java/Apache/PHP such as the hash-collision vulnerability with exploit code here http://www.securityfocus.com/bid/51193/info that has demonstrated to be very effective - so much so that a single host can bring down a relatively large site by exhausting CPU on the web server.... does anyone know the particulars of this event??
http://xkcd.com/932/
Ok, there are a lot of bean counters on Wall Street that like to keep operating costs at a bare minimum.
That being said, whenever you upgrade the main trading desks all members need to update theirs. And I know a lot of them are running under legacy systems. i.e. very hold, highly customize platforms, using lots of different systems, patched over the years, sketchy documentation, and some are still on big iron. So guaranteeing thousands of firms will shift over cleanly is kind of a big hurdle.
The exchanges do not like to update there systems.
The attack was directed against the web sites, not the trading machines. The original "notice" is here: http://pastebin.com/it77tAvs
This was a small bot net DDoS attack. Whether or not this could have been dealt with more efficiently by better routers/firewalls or HA configs, I don't know.
IMHO this is some script-kiddie types who are in it for the lulz. What it demonstrates is even the room-temperature IQ types can get a hold of some fairly potent DDoS tools. So, serious attention needs to be paid to upgrading their infrastructure and IT security in general.
It is a good time to be in the IT Security field, if you're looking for work.
Learning HOW to think is more important than learning WHAT to think.
Per my subject-line above (& yes, it IS "doable" even though "the infamous they" often state that a DoS/DDoS is the "unstoppable attack"... I state this, because you do NOT see either Microsoft OR Amazon "going down" to such attacks (they've got infrastructure to stop it)).
By "infrastructure", they have the settings I noted in place (I'll go into them later specifically), but, also such a VASTLY "overbuilt" setup networks + server failover redundancy & monitoring prepped for it. Examples from the "horses' mouth" are quoted next:
MS vs. DoS/DDoS & PERTINENT QUOTE/EXCERPT:
"At Microsoft we have robust mechanisms to ensure we don't have unpatched servers. We have training for staff so they know how to be secure and be wise to social engineering. We have massively overbuilt our internet capacity, this protects us against DoS attacks. We won't notice until the data column gets to 2GB/s, and even then we won't sweat until it reaches 5GB/s. Even then we have edge protection to shun addresses that we suspect of being malicious." from -> http://www.networkworld.com/community/blog/microsoft-were-not-vulnerable-ddos-attacks
* Below helps as well, per my subject-line...
APK
P.S.=> SETTINGS FOR "SECURITY-HARDENING" THE MICROSOFT IP STACK vs. DoS/DDoS:
http://msdn.microsoft.com/en-us/library/ff648853.aspx
Pay attention to the SYN ATTACK section there, because it demands the setting of several registry parameters that work in combination for DoS/DDoS resistance vs. SYN type DoS attacks...
Now - Couple THOSE with what was noted above in hardware, network, + security monitoring structure in place @ MS (Amazon's MUCH the same really in concept/theory @ least from what I understand too)? No small wonder one never really sees MS networks "go down" to such attacks (Amazon too)... read up, & enjoy! apk
Why Anonymous Can't Take Down Amazon.com:
http://tech.slashdot.org/story/10/12/14/1851240/why-anonymous-cant-take-down-amazoncom
* Straight from the /. horses' mouth this time... but, as I noted above earlier on how MS sets up their networks vs. DDoS? AMAZONE's pretty much got the same type of setups vs. that too!
APK
P.S.=> Enjoy the read, & see how EVERYONE'S NETWORK OUGHT TO BE SETUP vs. DoS/DDoS (especially the latter) - of course, it means money, but? That's the 'breaks', right?? Enjoy... apk