Hackers BlackMailing popular websites, held for Ransom!

15 replies
  • OFF TOPIC
  • |
Meetup.com Still Offline, Refuses to Pay $300 Ransom to Hackers - NBC News

Meetup.com Would Rather Stay Offline Than Pay $300 Ransom To Hackers

Record-Breaking DDoS Attack Nears 400 Gbps | News & Opinion | PCMag.com Record-Breaking DDoS attack 400 Gbps
Experts now warn that this attack could be just the tip of the iceberg.

Social networking website Meetup.com is fighting a sustained battle against cyber attackers who are demanding only $300 to call off a campaign that has kept the site offline for much of the past four days.

The site, which enables strangers to meet for activities of shared interest such as sports and other hobbies, could not be accessed early Monday afternoon.

A Meetup blog said that the company was a victim of a distributed denial of service (DDOS) campaign, a type of attack that knocks websites offline by overwhelming them with incoming traffic.

It said that no personal data, including credit card information, had been accessed.

Meetup's co-founder and CEO, Scott Heiferman, said on the company's blog that it was the first such attack in the site's 12-year history. He defended the move not to pay the paltry ransom.

"We made a decision not to negotiate with criminals," he said. "Payment could make us (and all well-meaning organizations like us) a target for further extortion demands as word spread in the criminal world."

He said the small amount was likely a trick and that the perpetrators of the sophisticated attacks would likely demand more, a point internet security analyst Kevin Johnson agreed with.

Meetup represents a soft target for online criminals, who often attempt to extort companies in return for calling off DDOS attacks, said Johnson, chief executive of cybersecurity consultancy Secure Ideas.

"It's very common for this sort of attack to start off with a small demand," Johnson said. "It's not like Meetup can write a check for a million dollars."

Heiferman's blog post said the site should be able to protect itself over time, even though it has struggled to stay online since the attacks began on Thursday morning.

He said Meetup spent millions of dollars a year to secure its systems.

The Meetup site and related mobile apps have been intermittently unavailable since Thursday.
-- Reuters
#blackmailing #hackers #held #poplular #ransom #websites
  • Profile picture of the author Paul Myers
    "We made a decision not to negotiate with criminals"
    Kudos to them.

    If they're going to put money into it, they should spend it on someone to find these creeps and break their legs. Or their hands, since they can still operate the botnets from a wheelchair.
    Signature
    .
    Stop by Paul's Pub - my little hangout on Facebook.

    {{ DiscussionBoard.errors[9001118].message }}
  • Profile picture of the author seasoned
    Yeah, many "hackers" aren't hackers in the traditional sense anyway. They are just troublemakers that want a name and to get some easy cash.

    Pay it, and they'll just keep coming back. The DDoS tries to restrict resources or maybe crash the system. If they block odd IPs, and get cooperation from others, they can maybe limit its effects for many. They're up now though.

    Steve
    {{ DiscussionBoard.errors[9001165].message }}
  • Profile picture of the author Dennis Gaskill
    Originally Posted by rambo9600 View Post

    Social networking website Meetup.com is fighting a sustained battle against cyber attackers who are demanding only $300 to call off a campaign that has kept the site offline for much of the past four days.

    ...He defended the move not to pay the paltry ransom.
    That's written to sound like, "...it's such a small amount, what's the big deal?"

    When in reality those demanding the ransom have no right to demand payment, and in fact, are cyber-terrorists and should be treated accordingly.
    Signature

    Just when you think you've got it all figured out, someone changes the rules.

    {{ DiscussionBoard.errors[9001199].message }}
    • Profile picture of the author Joe Mobley
      I wonder if this is what happened to AWeber and some other sites over the last few days?

      Joe Mobley
      Signature

      .

      Follow Me on Twitter: @daVinciJoe
      {{ DiscussionBoard.errors[9001358].message }}
      • Profile picture of the author rambo9600
        Originally Posted by Joe Mobley View Post

        I wonder if this is what happened to AWeber and some other sites over the last few days?

        Joe Mobley
        http://consumerist.com/2014/03/03/me...om-to-hackers/

        I'm 99% sure it is.

        They're even going after the BlackHat sites, lol.

        I've seen at least a dozen sites down in the last week, aWeber, GetResponse, etc... I knew something was seriously wrong.

        I was an Affiliate for a big launch last week and it was a complete FAILURE. We should have done mid 6 figures, but instead we got a pittance because we couldn't send out any eMail blast. I'm still fuming over this.

        I will say this, these guys really know where to Hit so the PAIN is intense. Very internet savvy, IMHO.

        Now that I see MeetUp down, a very large site that makes big money on a daily basis, then I knew the problem is widespread.

        I'm curious as to why they haven't hit the Warrior Forum yet?

        These cyber terrorist really piss me off, I almost feel they're one of us since they understand the Internet and how important it is to those in our business.

        When the BlackHat sites got hit I said "oh boy, even these guys aren't safe," WTF?

        I'm 99% sure these Cyber F**ks have visited the WF and may even be members.
        {{ DiscussionBoard.errors[9001400].message }}
  • Profile picture of the author HeySal
    I don't understand this at all. At all. I can see how someone might hack into our personal computers -- but how can they do this to a website without the server being able to stop them? Seems the server would be able to pull the plug on anything happening on any website in it's servership (or whatever it's called).
    Signature

    Sal
    When the Roads and Paths end, learn to guide yourself through the wilderness
    Beyond the Path

    {{ DiscussionBoard.errors[9001493].message }}
    • Profile picture of the author yukon
      Banned
      Originally Posted by HeySal View Post

      I don't understand this at all. At all. I can see how someone might hack into our personal computers -- but how can they do this to a website without the server being able to stop them? Seems the server would be able to pull the plug on anything happening on any website in it's servership (or whatever it's called).
      When a site/page is hit with a boatload of page request (fake traffic) all at once, it bogs down the server.
      {{ DiscussionBoard.errors[9001531].message }}
      • Profile picture of the author HeySal
        Originally Posted by yukon View Post

        When a site/page is hit with a boatload of page request (fake traffic) all at once, it bogs down the server.
        Oh........okaaaay. That clears up .......um..........nothing.

        When my site was chewed up the server just went in and pulled their files. I still had to build it back, etc - but the server was able to get rid of the threat.
        Signature

        Sal
        When the Roads and Paths end, learn to guide yourself through the wilderness
        Beyond the Path

        {{ DiscussionBoard.errors[9001606].message }}
        • Profile picture of the author yukon
          Banned
          Originally Posted by HeySal View Post

          Oh........okaaaay. That clears up .......um..........nothing.

          When my site was chewed up the server just went in and pulled their files. I still had to build it back, etc - but the server was able to get rid of the threat.
          Looks like your talking about something completely different, like someone gained access to a server. You don't need access for a DoS attack, it's simply fake traffic hammering the server load.

          Search Google SERPs real fast a bunch of times, they'll do a temporary IP block, the reason they do that temp. IP block is to cut down on unnecessary server load. It's basically a very small scale DoS attack as far as Google is concerned... which is why Google hates proxies (unnecessary server load).
          {{ DiscussionBoard.errors[9001635].message }}
          • Profile picture of the author Kay King
            What is needed are hackers to trace back to the group conducting these attacks. This isn't one person or random events - they look coordinated.

            The low ransom requests don't make sense unless it's a group trying for massive shutdowns and a tsunami of quick payments.

            The attack, targeting one of CloudFlare's clients, peaked yesterday "just shy" of 400 gigabits per second,
            That's an OMG level - somebody built a new toy.
            Signature
            Saving one dog will not change the world - but the world changes forever for that one dog
            {{ DiscussionBoard.errors[9001644].message }}
            • Profile picture of the author yukon
              Banned
              Originally Posted by Kay King View Post

              What is needed are hackers to trace back to the group conducting these attacks. This isn't one person or random events - they look coordinated.

              The low ransom requests don't make sense unless it's a group trying for massive shutdowns and a tsunami of quick payments.



              That's an OMG level - somebody built a new toy.
              That $300 is weird.

              It's probably either a 3rd world person with a bot or someone with a bigger plan phishing for account info. connected to that $300.
              {{ DiscussionBoard.errors[9001659].message }}
            • Profile picture of the author Joe Mobley
              One of the thoughts that ran through my mind was "If they scale this up a bit, could they take the whole Internet down?"

              Interesting, we'll see what happens.

              Joe Mobley
              Signature

              .

              Follow Me on Twitter: @daVinciJoe
              {{ DiscussionBoard.errors[9001667].message }}
              • Profile picture of the author seasoned
                Originally Posted by Joe Mobley View Post

                One of the thoughts that ran through my mind was "If they scale this up a bit, could they take the whole Internet down?"

                Interesting, we'll see what happens.

                Joe Mobley
                Well, it is actually not possible to have it run full bore over the whole internet. Parts most stressed and the cheapest will shut down from the stress, or human intervention, and shut down whole subnets disabling potentially all of their activity. ALSO, they have to have enough nets that can hold enough connections open long enough to stop their target. I STILL never bothered to check what tey did to MY server, but it COULD have been used to create a DDoS attack. If so, I got rid of like 1Gbps of potential! With a DDoS attack, they have several systems attack ONE system to flood that one system and hurt performance.

                One old way to do that was use icmp Internet Control Message Protocol - Wikipedia, the free encyclopedia so many companies disabled that, which devalued ping as a test. ANOTHER way, of course, is a server request, but I guess that is harder. Anyway, a lot of it could be blocked. From what I understand, IPv6 could conceivably be blocked early on and tracked, so this stuff may eventually drop to practically NOTHING.

                Steve
                {{ DiscussionBoard.errors[9001725].message }}
  • Profile picture of the author yukon
    Banned
    The sad part is such an established site like meetup was taken down by a small timer asking for $300.

    Maybe they should move over to Amazon cloud & let them deal with DoS attacks.
    {{ DiscussionBoard.errors[9001522].message }}
  • Profile picture of the author seasoned
    BTW sometime around 2003 or so, there WAS a huge attack that was akin to a DDoS. It was WORLD WIDE and affected major corporations. It was the SQL Slammer Worm! SQL Slammer - Wikipedia, the free encyclopedia So what did people do? They found the offending systems, shut down their email and M/S SQL SERVERS, and purged them. They complained to foreign sysops. They handled it much like you would handle a DDoS. If an outside system didn't stop, you could disable access through that network.

    Steve
    {{ DiscussionBoard.errors[9001753].message }}

Trending Topics