Since the emergence of Mirai IoT botnet, there have been a noticeable increase in DDoS attacks (Distributed Denial of Service) and it looks like authorities are eager to take on culprits behind these attacks.
In a statement released by Europol’s press service on Monday, it has been announced that Europol itself and with the help of US and other European law enforcement agencies 34 culprits have been arrested and 101 suspects “interviewed and cautioned.”
Also Read: Turkish Hackers Offering Hacking Tools as Prizes for DDosing Political Websites
The operation that started on Monday 5th and ended on Friday 9th of December in which “young adults under the age of 20” were arrested on accusations including paying for DDoS tools like booters and stressers to others to conduct attacks for them.
“Europol and law enforcement authorities from Australia, Belgium, France, Hungary, Lithuania, the Netherlands, Norway, Portugal, Romania, Spain, Sweden, the United Kingdom and the United States carried out a coordinated action targeting users of Distributed Denial of Service (DDoS) cyber-attack tools, leading to 34 arrests and 101 suspects interviewed and cautioned,” the statement said.
“The teenagers that become involved in cybercrime often have a skill set that could be put to a positive use,” says Europol.
The head of Europol’s European Cybercrime Centre (EC3) Steven Wilson also commented on the issue stating that “Today’s generation is closer to technology than ever before, with the potential of exacerbating the threat of cyber crime. Many IT enthusiasts get involved in seemingly low-level fringe cybercrime activities from a young age, unaware of the consequences that such crimes carry. One of the key priorities of law enforcement should be to engage with these young people to prevent them from pursuing a criminal path, helping them understand how they can use their skills for a more constructive purpose.”
Also Read: New Botnet is Attacking the US West Coast with Huge DDoS Attacks
The raids came after European Commission Servers and Deutsche Telekom suffered a series of massive DDoS attack a couple of weeks ago. HackRead urges its readers not to indulge themselves in such criminal activities and use their skill for better as cyber security specialists are in high demand.
![[hlink][/hlink] CPDoS can be used to attack content delivery networks (CDNs) to serve error pages instead of legitimate sites through caching. Freshly termed as a Cache Poisoned Denial of Service (CPDoS) attack, two academics from the Cologne University of Applied Sciences in Germany have discovered [PDF] how content delivery networks can be attacked to serve error pages instead of legitimate sites through caching. In normal circumstances, when the user re-visits a website, they are served a cached version of it through a content delivery network such as Cloudflare. On the other hand, during the poisoning process, the attacker visits a website with the intention of generating a request for the web page from the CDN. However, the request, in this case, contains a malformed header which can be from the following 3 options: [wp_ad_camp_2] [wp_ad_camp_1] An HTTP Header Oversize (HHO) An HTTP Meta Character (HMC) An HTTP Method Override (HMO) Any of these, in turn, cause an error on the webserver. As a part of regular operations, the error page is then cached on the CDN and in turn served to legitimate users. Slowly, it spreads to other nodes of the CDN as they are updated hence giving the impression of the site being unavailable globally successfully completing the attack. This could cause both a reputational loss and financial losses as well for mission-critical websites. This was further confirmed by the researchers themselves along the lines of, To get a clearer picture on the real life impact of CPDoS attacks, we took some samples based on the URLs from the Alexa Top 500, DoD, and HTTP Archive data sets. Overall, we found twelve vulnerable resources within a few days. These also include mission-critical websites such as ethereum.org, marines.com, and nasa.gov which use CloudFront as CDN. At all these websites, we were able to block multiple resources including scripts, style sheets, images, and even dynamic content such as the start page. [hlink][/hlink] Example screenshot on Marines.com website: An example showcased by the researchers of a before and after scenario of the attack on Marines.com. For those of you wondering when your site is getting poisoned, you can relax and luckily take a series of precautions. The first one is that you could turn off the caching of HTTP error pages by default on your CDN service through predefined options or by editing your server's configuration files. Hence, the error page will never be distributed by the CDN en masse. [wp_ad_camp_2] [wp_ad_camp_1] Secondly, you could make sure your CDN provider is complying with standard caching protocols. One of these involves caching only certain error pages such as the "404 Not Found" but not others such as the "400 Bad Request" one which is generated because of such an attack. A table allowing one to analyze the errors different CDN providers cache. Continuing with the often seen pattern in the cybersecurity world, these revelations were also followed with responsible disclosure leading to companies like Microsoft and Amazon taking action to fix the problem at hand. However, some companies like Flask have still not responded according to the researchers and so it is yet to be seen how the customers of such firms will react. For users looking to do further research on the subject in more detail, they can visit a recently released website by the team at CPDOS. CPDoS variation - HTTP Header Oversize (HHO) from BleepingComputer.com on Vimeo. Did you enjoy reading this article? Kindly do like our page on Facebook and follow us on Twitter.](https://hackread.com/wp-content/uploads/2019/10/cache-poisoned-denial-of-service-cpdos-with-cdn.png)
