Attacks/Breaches

3/1/2018
02:45 PM
50%
50%

GitHub Among Victims of Massive DDoS Attack Wave

GitHub reports its site was unavailable this week when attackers leveraged Memcached servers to generate large, widespread UDP attacks.

GitHub has informed users of a distributed denial-of-service (DDoS) attack, which brought down the site from 17:21 to 17:26 UTC and made it sporadically unavailable from 17:26 to 17:30 UTC. The incident did not compromise the confidentiality or integrity of users' data, it reports.

In a first, attackers last month exploited unsecured Memcached servers to amplify DDoS attacks against target organizations. Memcached is open-source software used among many businesses to increase servers' performance speed; however, it's not always used securely. Organizations often deploy Memcached hosts so they're accessible to the public Internet and all attackers have to do is search for hosts and use them to direct high-volume DDoS traffic.

GitHub identified and mitigated the Feb. 28 attack, which came from more than 1,000 unique autonomous systems (ASNs) across tens of thousands of different endpoints. The amplification attack used the memcached approach and peaked at 1.35Tbps via 126.9 million packets per second. One facility had an increase in inbound transit bandwidth exceeding 100Gbps.

The site tells users it's investigating the use of monitoring infrastructure to automate enabling DDoS mitigation providers.

Read more details here.

 

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
50%
50%
Joe Stanganelli,
User Rank: Ninja
3/1/2018 | 4:27:23 PM
And yet...
Ironically, this DDoS attack may have made the net more secure as a whole, considering the vast number of data breaches that have stemmed from the compromise of crucial credentials stored in GitHub repositories. lol.
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
6 CISO Resolutions for 2019
Ericka Chickowski, Contributing Writer, Dark Reading,  12/10/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: New camera 2FA closed loop!
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20059
PUBLISHED: 2018-12-11
jaxb/JaxbEngine.java in Pippo 1.11.0 allows XXE.
CVE-2018-20056
PUBLISHED: 2018-12-11
An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. There is a stack-based buffer overflow allowing remote attackers to execute arbitrary code without authentication via the goform/formLanguageChange currTime parameter.
CVE-2018-20057
PUBLISHED: 2018-12-11
An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter.
CVE-2018-20058
PUBLISHED: 2018-12-11
In Evernote before 7.6 on macOS, there is a local file path traversal issue in attachment previewing, aka MACOSNOTE-28634.
CVE-2018-20050
PUBLISHED: 2018-12-10
Mishandling of an empty string on the Jooan JA-Q1H Wi-Fi camera with firmware 21.0.0.91 allows remote attackers to cause a denial of service (crash and reboot) via the ONVIF GetStreamUri method and GetVideoEncoderConfigurationOptions method.