CYBERSPACE — One of the newest and most innovative examples of Web2.0 social networking technology has become the target of what may be one of the newest and most innovative examples of the Koobface malware. Or not.According to Paul Henry, security analyst for Lumension, “The speculation is that the onslaught of bogus messages that are directing users to malicious pages may, in fact, be overwhelming Twitter.
A new version of Koobface was found in the wild on Thursday using both Twitter and Facebook messages in order to lure potential victims into Web traps.
Coincidentally, Thursday also saw the opening of the annual Defcon hacker convention.
The Twitter.com status page still read “Site is down” on August 7th, although the most recent date stamp was from the prior day. While some users of the 140 character or less communication tool have been able to resume their conversations, others can read but not post directly to the site and still others continue to complain about Twitter clients working irregularly or not at all.
CNet.com proposed yesterday that the attack may be related to a Georgian blogger whose Twitter, LiveJournal, Facebook, Google Blogger, and YouTube accounts were all simultaneously targeted in a denial-of-service attack on Thursday.
Max Kelly, chief security officer for Facebook told CNET News that “It was a simultaneous attack across a number of properties targeting him to keep his voice from being heard. We’re actively investigating the source of the attacks, and we hope to be able to find out the individuals involved in the back end and to take action against them, if we can.”
In addition to bringing Twitter to its knees at approximately 6:00 am PT on Thursday, Facebook also reported uptime challenges, stating at one point that “Earlier this morning, we encountered issues within our network that resulted in a short period of degraded site experience for some visitors. No user data was at risk and the matter is now resolved for the majority of users.”
Later in the day, Facebook revised its statement to acknowledge that it had suffered a DoS attack.
If launched from a botnet, as is often the case with DDos attacks, resolution may be problematic, as it can be difficult to determine which incoming communications are legitimate and which are hostile. Blocking IP addresses can lead to frustrated users finding themselves silenced along with the thug messages.
Although once the preferred harassment route of organized criminals, denial-of-service attacks are losing their popularity, replaced by aggressive use of internet traffic instead of attempts to restrict it. Bot herders are known to now rent their botnets to spammers and malware distributors, which puts them at less risk of discovery than the previously popular and higher profile DoS.
If an attempt to suppress the Georgian blogger is at the root of this problem, it is the first time that a coordinated attack of the sites has been undertaken. The number of DoS attacks and website defacements committed against both Russian and Georgian entities has vastly increased during the last year, paralleling hostilities between the two nations.
