Slashdot Mirror

← Back to Stories (view on slashdot.org)

One Million IP Addresses Used In Brute-Force Attack On A Bank (softpedia.com)

Posted by EditorDavid on from the million-IP-march dept.

Cisco says in just one week in February they detected 1,127,818 different IP addresses being used to launch 744,361,093 login attempts on 220,758,340 different email addresses -- and that 93% of those attacks were directed at two financial institutions in a massive Account Takeover (ATO) campaign. An anonymous reader writes: Crooks used 993,547 distinct IPs to check login credentials for 427,444,261 accounts. For most of these attacks, the crooks used proxy servers, but also two botnets, one of compromised Arris cable modems, and one of ZyXel routers/modems. Most of these credentials have been acquired from public breaches or underground hacking forums. This happened before the recent huge data breaches such as MySpace, LinkedIn, Tumblr, and VK.com.
It's apparently similar to the stolen-credentials-from-other-sites attack that was launched against GitHub earlier this week.

50 comments

  1. One Million is nothing by Anonymous Coward · · Score: -1

    we owe 19 TRILLION dollars, thats 19 million million. America has been DESTROYED under obama's rule.

    TRUMP 2016

    1. Re: One Million is nothing by Anonymous Coward · · Score: 0

      One million is more than you have and probably more than that orange condom is actually worth.

    2. Re: One Million is nothing by Anonymous Coward · · Score: 0

      Nothing to worry about. Money is about as real as bitcoins. We can either print more, or just set the debt column to zero in Microsoft Excel.

    3. Re:One Million is nothing by Anonymous Coward · · Score: 1

      we owe 19 TRILLION dollars, thats 19 million million. America has been DESTROYED under obama's rule.

      So it's perfectly OK when Bush increased our national debt by 6 trillion, but not OK for Obama to increase it by 6.5 trillion ?

    4. Re:One Million is nothing by Imrik · · Score: 3, Insightful

      First, you should recheck your numbers. Second, Obama called it treasonous when Bush did it.

    5. Re: One Million is nothing by Beeftopia · · Score: 2

      Money is a measure of effort required to get a unit of it. It is also like a claim on goods and services. It is a logical construct, but it is not meaningless. The construct has persisted for millennia as a result of the benefits it provides to individuals.

      To a central bank which can have it printed, it can seem meaningless. And the effort required to obtain a unit of it by an agricultural field hand versus the CEO of a financial services company are obviously very different. Central banks can distribute it to desired companies via bond purchases and other enticements.

    6. Re: One Million is nothing by Anonymous Coward · · Score: 0

      You do know Congress sets spending...

    7. Re: One Million is nothing by Anonymous Coward · · Score: -1

      sorry to break it for you, money is fiction printed and controlled by people who control the things that really matters -to produce things you know-

    8. Re:One Million is nothing by Anonymous Coward · · Score: 0

      Damn, but you really are one special kinda retard.

    9. Re:One Million is nothing by Anonymous Coward · · Score: 0, Informative

      Conservative bullshit. You really are a special kind of idiot.

    10. Re:One Million is nothing by Anonymous Coward · · Score: 0

      I would say it was a moronic act by both. Evnetually it is going to bite the US on the arse in a big way, their is only so far you can keep kicking the debt down the road as the higher it goes the less money the government has (as it has to spend an ever increasing portion on interest repayments) and hence the more debt it needs. eventually just like any household debt it will quickly spiral out of control till something has to give.

    11. Re: One Million is nothing by bloodhawk · · Score: 1

      what a load of bullshit, you have been reading too much of the crap printed by those that put their faith in bitcoin or those that think it is a Zero sum game. money depending on country is backed by various securities or comodities and is a unit of effort or goods and is simply a substitute for having to directly barter goods or labour, you can think of money as an note or I Owe You, except being tied to an individual it is tied to any unit within a given economy that utilises that note.

    12. Re:One Million is nothing by Archangel+Michael · · Score: 1

      https://www.youtube.com/watch?...

      Name Calling vs Facts: Facts always win.

      --
      Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
    13. Re:One Million is nothing by slashdotwannabe · · Score: 1

      Here's a fact: Congress, and only Congress sets the spending of the country. While the Executive suggests a budget, Congress makes whatever changes they like to it, and is who passes it into law.

      Here's another: recessions cause Federal deficits to rise as tax revenues decrease while spending must remain relatively constant so as not to cause a much worse recession. If you're the type to look for someone to blame, blame the guy that started the recession through a complete failure to regulate risky bank activity, not the guy who inherited it.

      Here's another: starting two wars without the funding to pay for them and adding a huge new Medicare entitlement program without the funding to pay for it is "unpatriotic". Not gutting the Federal budget and sending the economy into a tailspin because you inherited a recession and the attendant deficit that comes with it is "prudent".

      --
      This comment is my opinion and does not represent an official position of Donald Trump or others I do not work for
    14. Re:One Million is nothing by Archangel+Michael · · Score: 1

      1) Recession started just after Bush got into office (less than one year) can we blame it on Clinton?
      2) Recession has continued for nearly 14 years straight, more or less. Can we blame Obama?
      3) The deficit was called Unpatriotic when Obama as criticizing GWB, and was half its current size
      4) Obama has ended all the wars, cut military spending, and yet the deficit has more than doubled in size under him
      5) While you can blame congress, you can blame the (D) and (R) parties both of whom don't give a rat's ass about spending, the (D) more so than the little (d) Republicans.
      6) Risky bank activity thanks to the Mandates of Frank(D)-Dodd (D)

      BTW, Risky Bank activity has happened under both (D) and (R) Presidents because greedy bastards in the bank have an "out" in FDIC and similar insurance. All the regulations designed to protect banking consumers have ended up only screwing banking consumers via Bank bailouts on Taxpayer dimes.

      And yes, I hate the (R) party for saying one thing, and never having the guts to actually do it. And now, with Obama's sequestration, he is blaming the (R) for allowing the budget to be punted every year down the road.

      To fix the problem we have to get rid of baseline budgeting and justify EVERY penny spent. There is a whole slew of budget items that while a minor droplet in the firehose of the budget, that should be gone. And you kill enough of those, and eventually you'll affect the firehose stream. And since the Federal Budget, including ALL "Entitlements" is mostly (over 1/2) off the table for cuts (as in cut in growth, not actual cuts), we're doomed to never reigning in the problem. Let it go long enough, and we'll end up like Greece, Venezuela or North Korea.

      There are sensible alternatives to "gutting" (or minor cuts in increases as I call them) spending. But as long as claim others want dead grannies and starvign children, we'll never actually address the problem.

      As for the recession, I have a fix. Lets have ONE year where congress reviews each and every regulation to see if it has had the desired effect and justify whatever is renewed.

      --
      Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
  2. Cloud Computing For The Win. by zenlessyank · · Score: 1

    What is the world record for cloud attacks? Cloud City needs some policing.

    1. Re:Cloud Computing For The Win. by h33t+l4x0r · · Score: 1

      This might be the record but just wait until ipv6

    2. Re:Cloud Computing For The Win. by antdude · · Score: 1

      Blame Lando!

      --
      Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
    3. Re:Cloud Computing For The Win. by Anonymous Coward · · Score: 0

      the banks failed this one, even more than the people who use same password on multiple sites and got fucked over by these recent breaches..

      by allowing (average) 430 login attempts (guessing most were invalid) to different accounts on a single ip address in that period of time... three in a day, 10 a week. that's what i'd shut it down at.. that would be enough to cover virtually all hotspot and other legitimate shared address scenarios.

      the banks also should have done what some other online services have done, and that's comb through these leaked files themselves and force-reset any affected accounts.

  3. Where's the fucking Chekov article!?!? by Anonymous Coward · · Score: -1

    This is supposed to be "news for nerds, stuff that matters". Both Star Trek and someone passing away for both those articles.

    First the gay shooting, and now this. The editors here need to be fired.

    1. Re: Where's the fucking Chekov article!?!? by Anonymous Coward · · Score: -1

      Agreed, the editors have really been dropping the ball for years. It takes them days to report on recent events. This is a big reason Slashdot is falling apart, people expect timely news and the editors here can't be bothered to try.

    2. Re:Where's the fucking Chekov article!?!? by Anonymous Coward · · Score: 0

      Star Wars news never had a problem reaching the frontpage.... just saying

    3. Re: Where's the fucking Chekov article!?!? by Jack_the_Tripper · · Score: 2

      Agreed, the editors have really been dropping the ball for years. It takes them days to report on recent events.

      Well...them IP addresses, they had to count them all. Now they know how many IPs it takes to fill the Albert Hall.

    4. Re: Where's the fucking Chekov article!?!? by Anonymous Coward · · Score: 0

      I'd love to turn you on

  4. Internet of Thieves by Black+Parrot · · Score: 4, Informative

    Didn't realize what IoT actually stands for.

    --
    Sheesh, evil *and* a jerk. -- Jade
    1. Re:Internet of Thieves by DaMattster · · Score: 3, Insightful

      This is why self-driving vehicles are a bad idea! One good penetration could turn a 80,000 lb semi into a lethal weapon.

    2. Re:Internet of Thieves by Anonymous Coward · · Score: 0

      Self driving doesn't have to be connected.

      If the vehicle is offline while operating, or always (yeah, I know it's not going to happen) and only updates over sneakernet, then the only fear is software bugs, not exploits.

    3. Re:Internet of Thieves by spire3661 · · Score: 3, Interesting

      "Self driving doesn't have to be connected." For the most part yes it will be forced. Your vehicle will be connected to the road, other cars (V2V) and the internet, possibly on separate links. The vehicle will only operate once authenticated by the road. To be road authenticated you will have to running the most current version of software, which will be updated very frequently. The future of driving is bleak and glorious all at the same time.

      --
      Good-bye
    4. Re:Internet of Thieves by Anonymous Coward · · Score: -1

      Self-driving vehicles may not be commercially sold yet, but they're already on the roads. None of the stuff that you're saying will be forced onto people exists or is being considered. None of the self-driving vehicles in development would recognize any of that stuff either.

      Stop pulling idiotic strawmen scenarios out of your ass.

    5. Re:Internet of Thieves by Anonymous Coward · · Score: 0

      Early prototypes are hardly the production vehicles of tomorrow. They only work under very narrow circumstances.

      I have worked in automotive for over twenty years and I happen to think this prediction of spire's is pretty good. You _will_ be forced to run the latest software with updates to prevent the latest unforeseen circumstances not covered under earlier versions, updated maps, traffic rules, construction locations, etc.

      You seem to have an attitude. Huh.

  5. I'm surprised this isn't happening more often by damn_registrars · · Score: 4, Interesting

    My own personal (as in, at home hosted on a cable modem) web server used to get these same kinds of distributed dictionary attacks, botnet attempts to gain access to whatever they can. There were times when I would see this type of thing almost once a month or so; then it started to taper off and I haven't seen it in some time. I figured the botnets were just doing other things (or had decomposed).

    And yes, I acknowledge that there is nothing important about my web server. I figured the botnets just occasionally go through every IP address they can find that accepts ssh connections and my number comes up every so often. I've never seen an IP address come up in both my web and ssh logs.

    And yes, I know I can do more to prevent this. People offer up plenty of suggestions. Frankly I don't care, and I actually enjoy seeing tons of blocked ssh traffic in my logs from time to time. As you might expect the vast overwhelming majority of traffic is Chinese script kiddies attempting dictionary attacks as root; I don't care about those as I don't allow remote root. I find the distributed, phone book, and distributed phone book attacks much more interesting. They even give me a chance to tune up my cron jobs that parse my server logs :)

    --
    Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
    1. Re:I'm surprised this isn't happening more often by pepsikid · · Score: 3, Interesting

      Yeah, one of the perks of running servers on a residential line is seeing firsthand all of the exploits. I'm fond of decrypting those mime-encrypted javascripts embedded in urls and finding the patebin page or hostname which it tries to fetch more scripts from; getting that shiat reported. If I were evil, i could build quite a library of exploits to use on others. They just send me these things haha!

    2. Re:I'm surprised this isn't happening more often by DaMattster · · Score: 1

      I used to host my own web/email server but since the cost of protected virtual servers has come down significantly, I decided to move my hosting to the cloud. I actually save on my electric bill too. LOL

    3. Re:I'm surprised this isn't happening more often by pepsikid · · Score: 4, Interesting

      I have my own cloud. I save on electricity by packing multiple servers into one box which is on 24/7 anyway. Having the servers physically located beside me relieves me of further concern that my hardware, website or forum might be seized or MitM'd. Also, the HOA can't sweet-talk some meddling corporation into kindly muzzling "that scofflaw." :)

    4. Re:I'm surprised this isn't happening more often by Anonymous Coward · · Score: 1

      I used to get tons of ssh break in attempts. Switching port 22 to another completely stopped it. Seems that most script kiddies are doing the hacking.

    5. Re:I'm surprised this isn't happening more often by Anonymous Coward · · Score: 1

      Not necessarily. After all, the real people just know that people who take the effort to move it to a different port probably take other steps to secure it. An ssh daemon left on the default port has a higher chance of being unsecured and doesn't have best practices in place, such as disabling root access and public key encryption.

    6. Re:I'm surprised this isn't happening more often by bloodhawk · · Score: 1

      why build a library, just download the kits like all the script kiddies are doing that are hitting you. They aren't hand crafting these against you they are just using the readily available exploit scanning kits.

    7. Re:I'm surprised this isn't happening more often by Anonymous Coward · · Score: 2, Insightful

      SO lets see. You are not saving energy by keeping a system on 24/7, you are spending more money on power and cooling than you would if you put that computer in a colocated datacenter (I have ran the numbers more than enough times, I'm using typical residental power rates of 9cents/kWhr). Second, having physical access to your servers doesn't increase security. Your 5 pin tumbler lock is no match to an advanced lockpick set compared to the IDing, fingerprinting, and biometric scanning most datacenters put you through. Finally, the corporation can sweet talk the HOA, your local police, and ISP into redirecting, restricting, or rejecting packets destined to or from your server.

      Do yourself a favor, either host in a datacenter somewhere or host at home. But don't fool yourself into thinking you are more secure, saving money, or run your own "cloud" on a single piece of hardware. You are doing none of the above.

    8. Re:I'm surprised this isn't happening more often by pepsikid · · Score: 1

      Rather strong language there, AC stranger. Too bad you're wrong. I said the pc is on 24/7 ANYWAY. Instead of 4 of them on all the time. Also, I have attached a duct which vents its heat right out the window, lol. Physical access to the servers prevents others from seizing control and taking them over to operate as their own. As in the case of an asshole HOA that wants to boot me off my forum and neighborhood site, and run them their way. Which they did once last year. Someone very resourceful might mitm the external traffic, but I know I can always regain direct admin access even if I get hacked. You have no idea how good the security is here. Suffice to say it is excellent.

  6. 3 backdoors? by Anonymous Coward · · Score: 4, Insightful

    How incompetent do you have to be as a company to have THREE backdoors in your own router, intentional or accidental....

    1. Re:3 backdoors? by Anonymous Coward · · Score: 0

      If you're talking about Arris, it looks more like malice than incompetence. The backdoors were put there on purpose. Lots of cable modems at ISP's PavlovMedia.com and Hargray.com seem to be pwned. Tons and tons of spam is coming from their IP's, either all their customers got infected with the same Trojan or they all use the same cable modem and I know which is more likely. I wonder if those ISP's were a big part of the bank attack?

    2. Re:3 backdoors? by MrL0G1C · · Score: 1

      And there's the fact that they allowed millions of attacks before shutting off the service (if they had the sense to actually shut it off).

      --
      Waterfox - a Firefox fork with legacy extension support, security updates and better privacy by default.
  7. Apparently I longer have the biggest list by raymorris · · Score: 1

    For long time, I had probably the largest database of active bots and open proxies. I haven't counted for a while, but I don't think I have a million. That's one hell of an attack. Typically we see hundreds to a few thousand used in each attack.

  8. Link with leaks by manu0601 · · Score: 1

    How documented is the link with MySpace, LinkedIn, Tumblr, and VK.com leaks? It is in Slashdot summary but not in referenced articles at Akamai and Softpedia.

  9. Bankers and Lawyers rip you off by definition. by Anonymous Coward · · Score: -1

    Spies are liars by definition and hackers.

    Now of lawyers, bankers, and spies who has the most capability to exercise these "attacks".

    Is there any evidence of contemporary collusion, infiltration, false flag lies, or subterfuge going on? Are there any media outlets that spew lies for money or fear of their own lives?

    9/11 was a huge production / lie and it seems George Bush Sr. former head of the CIA and President of the USA never really explained his deepest thoughts on it if you know what I mean.

    1. Re:Bankers and Lawyers rip you off by definition. by Anonymous Coward · · Score: -1

      What comes to mind is the hypocrisy of defending against so-called terrorism while simultaneously letting foreigners flood America.

      Every day you read stories about unprecedented numbers of illegals getting in and driver's licenses and voting and even recently the American Congress refused to prevent *illegal immigrants* from joining the military.

      America is messed up bad and it appears to be bold faced subterfuge from the inside. The media bias and lies are extraneous.

  10. oh boy by Anonymous Coward · · Score: 0

    better crack down on spoofing or better yet patent numbers.

    ipv6 is worse yet because it's as hard to read the firewall logs as it is systemd's binary shit

  11. Tell us again, there is a shortage of IP addresses by Anonymous Coward · · Score: 0

    a million alone for a brute force. Now think about the dangers of IPv6!!!

  12. Millions? Why not shut off at three? by AlanObject · · Score: 1

    Most sites that I use that have risk associated with them will shut down an account if more than three attempts are made with bad logins. It sounds like these banks' systems allowed unlimited login attempts. I have a hard time believing that they would have security that lax.

  13. My only question by Anonymous Coward · · Score: 0

    "For most of these attacks, the crooks used proxy servers, but also two botnets, one of compromised Arris cable modems, and one of ZyXel routers/modems."

    Why are banks using bot nets & proxy servers??