Slashdot Mirror
Mirai Botnet Attackers Are Trying To Knock Liberia Offline (zdnet.com)
Zack Whittaker, reporting for ZDNet: One of the largest distributed denial-of-service attacks happened this week and almost nobody noticed. Since the cyberattack on Dyn two weeks ago, the internet has been on edge, fearing another massive attack that would throw millions off the face of the web. The attack was said to be upwards of 1.1 Tbps -- more than double the attack a few weeks earlier on security reporter Brian Krebs' website, which was about 620 Gbps in size, said to be one of the largest at the time. The attack was made possible by the Mirai botnet, an open-source botnet that anyone can use, which harnesses the power of insecure Internet of Things devices. This week, another Mirai botnet, known as Botnet 14, began targeting a small, little-known African country Liberia, sending it almost entirely offline each time. Security researcher Kevin Beaumont, who was one of the first to notice the attacks and wrote about what he found, said that the attack was one of the largest capacity botnets ever seen. One transit provider said the attacks were over 500 Gbps in size. Beaumont said that given the volume of traffic, it "appears to be the owned by the actor which attacked Dyn." An attack of that size is enough to flatten even a large network -- or as was seen this week, a small country. Update: 11/03 19:37 GMT: The title of the story (same as the ZDNet's story) was updated to mention the name of the country. The summary was updated to reflect the same, as well.
Doubtful.
".....which harnesses the power of insecure Internet of Things devices."
Unsecured? I'm auditing at work today, so I'm in that mode.
Is that too hard to put in the post, which country?
It's Liberia.
Leave us with a big wall of texe, but make no mention of what country.
Yeah, an obscure African country indeed!
Liberia. There you go.
Given the last response, anyone else have a bad feeling that on November 8th we're going to have a Blackout in America?
Anybody getting the feeling like the Internet is going to implode at some point in the near future?
It's open & accessible nature which makes it so valuable is also at the same time it's biggest flaw.
How about putting the country name in the summary? Little known country? Who has made it through high school, and has not heard of Liberia?
That's racist! /ducks
seriously, I'm astoundingly impressed that this magnitude of data can bring an entire country's infrastructure to it's knees. The power that this botnet has is unprecedented, this is a digital Godzilla (DigiZilla?) running rampant on the streets of LIberia with the only defense some antiquated machine guns.
/hope they catch these guys //electrocute them with cattle prods ///then toss them in a shark tank ////PPV $99.99 make it happen
I'm not condoning this by any stretch of the means but I damn sure am amazed from a spectator's point of view.
Wheel of Time: Book by Book and Sumview (summary review) Bigdady92 style: http://bigdady92.blogspot.com/
I was hoping it would be Denmark.
I'd have enjoyed a sensible chuckle if South Park had been spot on yet again.
And no one notices, did the DDOS happen at all ?
Second - if your country/service/IP gets ddos-ed - go for a walk. Unless you're a day trading company, who gives a fuck.
It's not just the post: the linked article fails to name the country until the 7th paragraph.
Re: "small, little-known African country":
-- Liberia has more land area than Portugal or Hungary or Austria.
-- Liberia is well-known to USers as a destination for freed slaves in the 19th century.
Seems like the author of the article could use a broader perspective.
What devices are in the Mirai botnet?
In my opinion, this demonstrates some simple things.
If the IoT creators cannot be bothered to properly secure their devices out of the gate, then they need to give some nonvolatile storage of some kind that can hold the files in /etc, and perhaps /home.
It does not need to be big. 2mb would be spacious.
Just enough that the init system can be tailored, the root password can be changed, and the cryptokeys can be regenerated and retained.
That way somebody can honest to god actually secure their device after purchase. You know, disable that open Telnet daemon, change the default root password, and use some hard to crack 4096bit keys for SSH that aren't all over the damn net.
They could do this the way eg, OpenWRT does it, with a pivot root. It could be reset to the "Factory insecure state" by holding in the reset button that way, preventing users from breaking it on a misconfiguration. If it would cost too much to make the devices properly secure out of the box, then at least give them enough real internal storage that mounts properly on boot, that people that DO know what they are doing can fix their fuckups after purchase, and have it stick.
Why do I have the feeling that this is a dry run, with bigger target(s) in mind?
Liberia was supposed to be the America of Africa, until the locals DID NOT WANT. In fact it's capitol was named after one of our presidents.
Not exactly "little known"
Liberia is not a shithole. At least it wasn't supposed to be one.
It was supposed to be a country where African-Americans came back to their roots, to their original homeland.
Where they would bring back their education, knowledge, and experiences from USA, and create an example for Africa that would help fix their chaotic Sub-Saharan continent.
Of course, what was brought back was rap, bling, drive-by shootings, and basically a national level of gang wars and destruction.
Why don't affected organizations simply publish a host file for people to use until DNS service has been restored?
The attack was said to be upwards of 1.1Tbps -- more than double the attack a few weeks earlier on security reporter Brian Krebs' website, which was about 620Gbps in size,
It's easy enough to do in your head - 1.1Tbps is less than half 620.Gbps. It would have had to be more than 1.24 Tbps, more than 10% larger than the claimed "upwards of 1.1Tbps", and there's no indication in the original story that it ever got anywhere near that high. Aside from satellite connections, the single fibre connection s the only way in or out. That is confirmed by the article stating that the attack was directed against one of the two companies cooperatively operating the fibre.
One transit provider said the attacks were over 500Gbps in size.
So from the story, it's an attack on one company, and Level 3 reported far less. In an email, Dale Drew, chief security officer at Level 3 Communications, confirmed it had "witnessed an attack against a telecommunications company in Liberia" from the Mirai botnet.
Far less than 1.24 Tbps, and no facts cited to even make it more than 620 Gbps. There is no actual data in the article to justify the claimed size, irrespective of the bad math. So, Zack Whittaker at ZDNet needs to go back to school to learn basic math and to not include speculative figures that he made out of his head, without citing any facts to justify them, in his clickbait "reports."
F'ing internet. This is a story worthy of Facebook, not slashdot ... at least not the old slashdot at the turn of the century.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
IMHO it is possible to execute it better, but not without a license-to-breed and otherwise forced abortions. Even voluntary free abortions would be a good start. Also, drugs and guns would have to be cheap and legal, thereby leaving little opportunity for gangs to proliferate.
You say Liberia is a little known country. But every Liberian I've asked today knows lots about it!
Hey Look! We took an entire country offline.
It's not against Liberia it's who is in Liberia...There is a certain country to which Liberia is of massive strategic milatary importance. I didn't quite get why until recently. It's a valuable staging point to many different current and future conflict zones. It's obvious who they are testing or attacking.
> Both are true. The devices are insecure by design, and are not secured in practice.
Insecurely Designed Internet Of Things
Acronym... IDIOT
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Besides South Africa, most of the African countries are shit holes, and South Africa is eager to follow suit.
i took argentina off for a whole week back then..imagine what i can do with this tech lol