Slashdot Mirror
Bitcoin Extortion Group DD4BC Now Targeting Financial Services
An anonymous reader writes: Akamai is detailing the activities of DD4BC, a cyber-extortionist group that has launched distributed denial-of-service (DDoS) attacks against numerous organizations and demanded Bitcoin payments to stop the attacks. The group is sending ransom emails requiring payments of 25 to 100 Bitcoin, which is about $6,000 — $24,000 (€5,350 — €21,400). Social media shaming is also part of the deal, threatening to expose the DDOS on Twitter if payment is not made.
Simply find them and kill them with extreme brutality.
Religion: The greatest weapon of mass destruction of all time
in exposure about being attacked by a bunch of dipshits? I lean more towards empathy and rage when hearing about things like this. I would wager paying to keep your services operational is a step higher on the list of priorities than making sure assholes don't have a field day on twitter.
And paying is just bad. Showing they can have some success in manipulating the organization.
What moron would be shamed by being under a DDoS attack?
The entire premise is stupid and the credibility of this story is highly questionable. Here's what really happens:
Morons attack Bank Of America. Threaten shaming.
BoA contacts upstream providers and filters that shit.
BoA states, enjoy the FBI investigation at the CIA black site, Mother Fuckers.
Business as usual.
So, extortion, but with Bitcoin. meh.
"National Security is the chief cause of national insecurity." - Celine's First Law
you go larry... good thing (for the psychopath genociders, & most of the rest of us) the only real justice is based entirely on mercy..... add morrissette & chomsky to the brew as ecological mom & popists..... spirit of creation all ++++++ we invented the minus feature..
Publishing this story is doing no favors to anyone. As many others have pointed out in the past, if your company receives one of these emails, the best strategy is to ignore it.
These extortionists will send emails to hundreds or thousands of different companies, but they can't DDOS all of them at once. Furthermore, they have no idea if their emails even make it past the spam filters of their targets. So how do they decide who to DDOS? By seeing who responds to the blackmail message. Once you respond, and they know you are listening to them, you are now in their sights - not just this time, but the next time they decide to shake you down.
Ignore them. If they DDOS you, deal with it, but never acknowledge their demands. They can never be certain that you are receiving their emails, and if you never respond to them, eventually they'll move on to someone else.
What would be the point of this? "We're going to shame you to show that we're trying to extort you and you're not giving in." Is this suppose to cause peer pressure to force the financial institutions to settle? Or to garner sympathy for the attackers?
Why is this a Bitcoin extortion group? Should it not read: Extortion Group DD4BC uses Bitcoin for extortion payment system?
Has anybody suggested any kind of solution to these DDoS attacks that the structure of the Internet allows? Current approach seems to accept DDoS as a fact of life and moan when it happens, with the only solution to the problem being to wait it out. When the Internet can gang up on pretty much any other participant (even Google, given enough bots) somebody should at least fire a few shots in the dark in an attempt to find solutions, but I haven't encountered anything on this yet.
"Everybody's naked underneath" -- The Doctor
Microsoft Windows NT-based OS settings vs. DDoS/DoS:
Protect Against SYN Attacks
FROM -> http://msdn.microsoft.com/en-u...
A SYN attack exploits a vulnerability in the TCP/IP connection establishment mechanism. To mount a SYN flood attack, an attacker uses a program to send a flood of TCP SYN requests to fill the pending connection queue on the server. This prevents other users from establishing network connections.
To protect the network against SYN attacks, follow these generalized steps, explained later in this document:
Enable SYN attack protection
Set SYN protection thresholds
Set additional protections
Enable SYN Attack Protection
---
The named value to enable SYN attack protection is located beneath the registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters.
Value name: SynAttackProtect
Recommended value: 2
Valid values: 0, 1, 2
Description: Causes TCP to adjust retransmission of SYN-ACKS. When you configure this value the connection responses timeout more quickly in the event of a SYN attack. A SYN attack is triggered when the values of TcpMaxHalfOpen or TcpMaxHalfOpenRetried are exceeded.
---
Set SYN Protection Thresholds
The following values determine the thresholds for which SYN protection is triggered. All of the keys and values in this section are under the registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters
These keys and values are:
Value name: TcpMaxPortsExhausted
Recommended value: 5
Valid values: 0?65535
Description: Specifies the threshold of TCP connection requests that must be exceeded before SYN flood protection is triggered.
Value name: TcpMaxHalfOpen
Recommended value data: 500
Valid values: 100?65535
Description: When SynAttackProtect is enabled, this value specifies the threshold of TCP connections in the SYN_RCVD state. When SynAttackProtect is exceeded, SYN flood protection is triggered.
Value name: TcpMaxHalfOpenRetried
Recommended value data: 400
Valid values: 80?65535
Description: When SynAttackProtect is enabled, this value specifies the threshold of TCP connections in the SYN_RCVD state for which at least one retransmission has been sent. When SynAttackProtect is exceeded, SYN flood protection is triggered.
---
Set Additional Protections
All the keys and values in this section are located under the registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters. These keys and values are:
Value name: TcpMaxConnectResponseRetransmissions
Recommended value data: 2
Valid values: 0?255
Description: Controls how many times a SYN-ACK is retransmitted before canceling the attempt when responding to a SYN request.
Value name: TcpMaxDataRetransmissions
Recommended value data: 2
Valid values: 0?65535
Description: Specifies the number of times that TCP retransmits an individual data segment (not connection request segments) before aborting the connection.
Value name: EnablePMTUDiscovery
Recommended value data: 0
Valid values: 0, 1
Description: Setting this value to 1 (the default) forces TCP to discover the maximum transmission unit or largest packet size over the path to a remote host. An attacker can force packet fragmentation, which overworks the stack.
Specifying 0 forces the MTU of 576 bytes for connections from hosts not on the local subnet.
Value name: KeepAliveTime
Recommended value data: 300000
Valid values: 80?4294967295
Description: Specifies how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet.
---
Lastly, of cou
These clowns did a DDoS on the financial co where I work. They managed to get to about 400Mbs (although they claimed 15Gbps) and never came back. The good thing that came out of it was that we realised our Arbor DDoS wasn't configured right on one of the nodes so that's fixed up now. Our sensors picked it up straight away, the Security Operations Centre reacted in the first few minutes and so most staff/customers/partners didn't even realise.
Their MOO was to try and find email addresses in linkedin/online for various random members of staff at the company and sent out the demand letters a few hours in advance - except we're worldwide and so by the time the letters were centrally understood, it was already pretty much too late.
If nobody notices a DDOS attack did it really happen?
Don't you miss those times where you could just waste someone messing with you, your family or business?
Those wild west times long ago where the law was but a child, clueless.
Yeah, crime wasn't organized or widespread back in those days. People looked out for each other. Everyone had each others back.
But then things changed. People became distrustful. The law became weak as well. No more death penalties, no more long sentencing!
Now you have "get out after good behavour" these days, people getting out in half their terms because obviously a person can't play an act for several decades, I heard it on my Big Brother by TV psycholomists!
Ah, yeah. Those were the days.
#bringBackTheRoaring90s.
See subject & e.g. Open DNS resolvers http://www.circleid.com/posts/...
APK
P.S.=> Just clarifying this for him w/ an "e.g."... apk
and the weasels started DDOSsing me, I'd say, go ahead and put it on Twitter. we can then go to Federal court and find out who owns the account, and send a bill collector over. one of those effective bill collectors from a Jersey "social club." one of those guys who knows how to work concrete.
if this is supposed to be a new economy, how come they still want my old fashioned money?