Language Selection

English French German Italian Portuguese Spanish

Rootkit Web sites fall to DDOS attack

Filed under
Security

Two prominent Web sites that specialize in remote access software known as "rootkits" have been taken offline by a large distributed denial of service (DDOS) attack. The take-down was allegedly ordered by a shadowy group of hackers and rootkit authors who took offense to criticisms of their software posted on the sites.

Rootkit.com, an established Web site run by security expert Greg Hoglund, has been offline for almost a week. Two other sites, operated by a prominent rootkit author known as "Holy Father" have also been taken down in the attacks, which are believed to be the work of a group of Bulgarian and Turkish hackers known as the SIS-Team, according to Hoglund, the chief executive officer of HBGary, Inc., an information technology software and services company.

The attack against rootkit.com began on Tuesday, April 5, after someone using the name "ATmaCA" posted an inflammatory message to one of the discussion groups on the site that advertised a number of malicious remote access software programs sold by SIS Team, including SIS-Downloader, ProAgent and SIS-IExploiter, Hoglund said.

The programs are powerful spyware tools that, when combined, enable remote attackers to secretly compromise other machines using attack Web pages. They are sold online at Web sites like www.spyinstructors.com and are popular with those behind spam campaigns, who use the tools to plant remote control programs that are then used to send out spam, Hoglund said.

The post by ATmaCA prompted curt responses from rootkit.com members, who objected to authors using the discussion forum as a venue to advertise their commercial software. Other rootkits discussed on rootkit.com are open source, and authors typically post links to their source code on the site, Hoglund said.

In the "flame war" that erupted between the SIS-Team members and the rootkit.com contributors, questions were also raised about the quality of the SIS-Team products. Some rootkit.com regulars alleged that the tools were poorly written and frequently crashed machines they ran on, Hoglund said.

Within hours of the first post from ATmaCA, the rootkit.com Web site was under attack by a network of more than 500 compromised computers, or bots, that flooded the site with about 170,000 requests a second, making it unreachable for most Internet users, he said.

Two rootkit-focused Web sites operated by Holy Father were also downed by DDOS attacks after that person posted remarks critical of ATmaCA and SIS-Team, according to an e-mail from Holy Father.

In both cases, extortion e-mail was sent to the Web site owner following the DDoS attacks saying that the Web site owners could end the attacks by posting public apologies to ATmaCA and SIS-Team on their Web sites, Hoglund and Holy Father said.

Hoglund, who is a noted security expert and author of the book "Exploiting Software," was working on Monday to bring the rootkit.com Web site back online. He expressed outrage at the attacks, which he said were instigated by a group of immature hackers, and said that he would have taken the inflammatory post about ATmaCA and SIS-Team off rootkit.com as a matter of policy.

"I find it very offensive that a public Web site that does nothing but share information is attacked by a bunch of immature children," he said. "These are hackers who can't stand on their own merits. They make claims for their software, and then can't argue about it, but just DDOS their critics off the Internet."

Rootkit.com has more than 25,000 registered users and about 30 regular contributors. Despite the reputation of rootkits as hacker tools, many of those who frequent the site are professional security experts and students who study computer security and use the rootkit source code available on the site to figure out ways to defend against rootkit programs, Hoglund said.

Source.

More in Tux Machines

today's leftovers

  • Why You Should Consider Open Sourcing Your Software
    Free & Open source software have grown so rapidly in the last few years. Just compare the situation of being ignored and considered like a nerds-movement in the early 2000’s to the situation today in 2017. We surly made a huge advancement so far. Thanks to the amazing ecosystem of open source which links both communities and enterprises together. However, when it comes to individuals, a lot of people are hesitant when it comes to open-sourcing their software. They think that the “secret” behind it will be stolen. They think that they will be releasing their work “for nothing in return” when they do so. That’s definitely false.
  • Caspia Projects and Thunderbird – Open Source In Absentia
    What does this have to do with Thunderbird? I sat in a room a few weeks ago with 10 guys at Clallam Bay, all who have been in a full-time, intensive software training program for about a year, who are really interested in trying to do real-world projects rather than simply hidden internal projects that are classroom assignments, or personal projects with no public outlet. I start in April spending two days per week with these guys. Then there are another 10 or so guys at WSR in Monroe that started last month, though the situation there is more complex. The situation is similar to other groups of students that might be able to work on Thunderbird or Mozilla projects, with these differences:1) Student or GSOC projects tend to have a duration of a few months, while the expected commitment time for this group is much longer.
  • Make Dragonfly BSD great again!
    Recently I spent some time reading Dragonfly BSD code. While doing so I spotted a vulnerability in the sysvsem subsystem that let user to point to any piece of memory and write data through it (including the kernel space). This can be turned into execution of arbitrary code in the kernel context and by exploiting this, we're gonna make Dragonfly BSD great again!

Desktop GNU/Linux

  • [Video] Litebook Alpha Review! | Unboxing, Apps, and Gaming!
  • Beginners Guide To Linux
    Curious about getting into Raspberry Pi or just Linux in general but you're not sure where to start? This post is for you. It's not intended to be a comprehensive guide, rather a gentle intro into the Linux world. I'm not a Linux expert, but I know from experience that it can be an intimidating platform to get started in. I want this post to show you what you need to know to get started with Linux.
  • [Video] 5 Reasons To Switch To Linux
  • System76 Provides Wireless Fixes for Ubiquity
    We are proud to have contributed to Ubiquity in such a way that we feel improves all users’ lives when using Ubuntu. We will continue improving the platform and hope that our users will see value in what we do.
  • GNOME 3.24 Released, See What`s New
    After being in development for six months, GNOME 3.24 was released today, bringing improvements such as Night Light, weather information in the date / time indicator, along with updates to its applications, and more.

Late Night Linux, Bad Voltage, and Effective Communication in Podcasting

  • Late Night Linux – Episode 06
    Jesse is back but this time Félim is in his sick bed so it’s a 3 man show yet again. Some heated debates about Nextcloud’s actions, Ubuntu extended support and PowerPC distros, followed by a deep dive into the world of HiDPI 4k support in Linux.
  • Bad Voltage Live at SCaLE 15x
    The Bad Voltage live stage show, from SCaLE 15x in Pasadena, March 2017!
  • Effective Communication in Podcasting
    When I got serious about doing Linux videos on YouTube, I drew on all of that Old Media experience plus I took a few classes to make sure I knew what I was talking about before handing out advice to others. That has led to the EzeeLinux project. The goal of EzeeLinux is to educate folks about Linux and get them started on the right path to success… I have been truly humbled by the response it has gotten. That said, I don’t feel like I’m competing with anyone – the more, the merrier! I honestly feel that Linux and Open Source Software are arguably one of the few truly good things happening in the world today. It brings people from all over the world together and provides a means to get cutting edge technology into the hands of anyone, anywhere who wants to take the time to learn how to use it regardless of their financial situation. That is the kind of power that can quite literally change the world, folks. No one should be left behind in this Information Age. Come to think of it, Ed Murrow would probably do a documentary about Linux if he was still around today… It would be right up his street, I think. It’s the kind of thing he liked to talk about.

Leftovers: Software

  • [Video] Linux Audio Programs Compared 2017
    I made this video for those that are new to, or just interested in making music on the Linux OS. I go over the features, goods and bads of Rosegarden, LMMS, Ardour, Mixbus, and EnergyXT, as well as touch on Qtractor. I don't don't go much into details of the particular versions I am using, but the video was made in the early part of 2017 and I'm running Ubuntu 16.04LTS.
  • Green Recorder: A Simple Desktop/Screen Recorder for Linux
    Green Recorder is a simple, open source desktop recorder developed for Linux systems built using Python, GTK and FFmpeg. It supports most of the Linux desktop environments such as Unity, Gnome, Cinnamon, Mate, Xfce and so on. Recently it has been updated to work with Wayland too in Gnome session.
  • Komorebi: A New Way To Enhance Your Desktop Using Animated/Parallax Wallpapers
    In past there were applications that allowed us to run videos/Gif as wallpaper on the desktop and make desktop look much cooler but than all of sudden the development of such Apps stopped and I can't name any App that exist for this purpose. Komorebi is fairly new application designed to make your desktop experience much better and make desktop cool as well, we can say it is kind of 'live wallpaper' situation here or 3D wallpaper. It is developed by Abe Masri and available under GPL license for free.
  • Stacer Sytem Optimizer: A Must Have Application For Ubuntu/Linux Mint
    There are multiple ways to optimize your Linux, the most geeky way is using Terminal, there are also applications available that performs such actions like Bleachbit, Ubuntu cleaner and so on. Stacer is simple, open-source, quick and new application designed to offer you all-in-one optimizer for your Ubuntu/Linux Mint (It's alternative to CCleaner but only for Linux).
  • Qtox: Open Source and Fully Secure Skype Replacement for Linux
    Long years ago, we've talked about a Skype alternative called Tox which was still in its early developmental stages. Tox was supposed to become the anti-thesis of Skype by being a fully open-source video and voice chat client that placed user privacy and security at its center. Well, guess what, there are now fully active and well-maintained chat clients that are built on top of Tox protocol. qTox is one of them.
  • Rclone 1.36 Released With SFTP And Local Symlinks Support, More
    Rclone 1.36 was released recently, bringing support for SFTP, local symbolic links support, mount improvements, along with many other new features and bug fixes. For those not familiar with Rclone, this is a cross-platform command line tool for synchronizing files and folders to multiple cloud storages, which supports Dropbox, Google Drive, Amazon S3, Amazon Drive, Microsoft One Drive, Yandex Disk, and more. It can be used to sync files either from your machine or from one cloud storage to another.
  • Streamlink Twitch GUI 1.2.0 Adds Support For Communities And Team Pages, Basic Hotkeys
    Streamlink Twitch GUI (previously Livestreamer Twitch GUI) is a multi-platform Twitch.tv browser. The application is powered by Node.js, Chromium and Streamlink, though it can still use Livestreamer (which is no longer maintained) too.
  • Code Editor `Brackets` 1.9 Released, Available In PPA
    Brackets is a free, open source code editor focused on front-end web development (HTML, CSS and JavaScript).
  • Terminix Terminal Emulator Renamed To Tilix, Sees New Bugfix Release
    [Quick update] Terminix, a GTK3 tiling terminal emulator, has been renamed to Tilix due to some trademark issues.