AA419 DDoS: India's Crisis with Cyber Security

The DDoS against AA419 is still ongoing. One issue that became clear early on in the DDoS, was that numerous botnets were attacking the AA419 web server.

Also extremely noticeable was that the bulk of the attack traffic was coming from India. As such we contacted CERT in India. 

CERT India's response was extremely quick, thanks to the marvels of electronic communication. They read our email within minutes of it being sent. We knew this based upon a read notify I had put on the email. Sadly that is where it stopped. From the 28th of March 2011 to date they have not even had the common courtesy to reply.

This left us with a difficult decision:
Do we take a blanket approach to minimize the damage to the rest of the world and simply block Indian ISPs?  

While that would make a lot of sense, we also need to consider that India is one of the the most highly targeted countries in West African fraud. Artists Against 419 needs to make the Indian public aware of scam sites that may potentially be targeting them. As such our website will be reachable, despite CERT India's silence.

If it sounds like we are unfairly singling out a country, judge for yourself.

Bot overview

Initially when we went live on the new server, we had a lot of work to do to mitigate the attack. One noticeable apect is their is no correlation between the number of attackers versus countries they are coming from.

Despite the 1st of April having the lowest originating countries for the attacking bots, it shows the second highest number of attackers for the day.

Bots by Region

 

Looking at the attacking systems, one experiences an optical illusion looking at the APNIC column. The column is not narrower than the rest. 

We clearly see the majority of the systems attacking us are coming from the APNIC region. Let us drill down into the APNIC region.

Bots by Country

This is quite shocking. We immediately see we have a serious issue with attacking systems coming from India. The number of bots from India are two orders of magnitude larger than any from any other country in this region. In fact on average 90% of all attacking IP addresses are coming from India.

A Reality Check

Apart from the attempt to disrupt the activities AA419, we should remember that the systems being used for this botnet:

• are also attacking other servers, trying to disrupt them (it has been verified)
• are not really under the owner's control, but comprised and under the malicious control of some other unknown third party
• poses a security risk to India and the rest of the world. We do not know what data on these systems has been compromised. Remember, these same systems may also be used to access bank accounts, government infrastructure, manage outsourced tasks or potentially access other sensitive infrastructure. Any system accessed from them is also potentially at risk.

All we can say to CERT India is that you are failing dismally in your mission:

Mission

To enhance the security of India's Communications and Information Infrastructure through proactive action and effective collaboration.

Here is the evidence you read the message that was sent to you with details:

This is a message receipt notification. The message sent on Mon Mar 28 2011 13:41:07 GMT+0530 (India Standard Time) to incident@cert-in.org.in with subject "Anybody from CERT India" has been displayed on the recipient's computer.

AA419 will have to seek to address the issue via other methods.

Spot the mistake!

Hint: Upper right corner!

Funny things happen when you steal from a Nigerian site without paying attention.

Were back and out to get them again

Well, while we are back and watching the lemmings bots destroy themselves, there is a big reason for concern for one specific country. But I'm getting ahead of myself....

The trip back was not a simple one. I suspect our old server lost all will to serve mankind any further after it saw how certain groups of miscreants were preying on their fellow human beings. We thanked it silently and laid it to rest.

A newer and stronger server had to be found and we found one thanks to our special friends. But it had to be kitted out to take on the scam wars, also a DDoS against AA419. New disks and memory we obtained. Our suppliers were great and made sure the new hardware arrived promptly. Unfortunately the memory has some issues. So with some loan memory, the server said hello to the world after a bit of time.

As we opened the gates, we were ready. Our friends and us did a bit of tweaking here, a bit of tweaking there, a bit of tweaking everywhere. On the 25th of March 2011 we officially opened the gates. We were not surprised at the reception as bot upon bot said hello to us, all 148 thousand of them,  trying to force us off the air again. It also quickly became clear that we were under attack from more than one botnet.

One serious issue we noticed was where 83% of the infected servers were located. However, this will be taken with the CERT of that country.

So, to all our loyal followers, we are back, now not only terminating scammer sites again, but also sending out reports to ISP's and the like on botnet activity for the time being.

To all those that attack us with your botnets, read the previous sentence again carefully. 

If the server is a bit slow, remember you are trying to reach the same location as 148,000 malicious bots.

For all those miscrants out there, this one is for you:


I mentioned friends:
As the saying goes, "I'll get by with a little help from my friends". We thank you, you know who you are, for helping us get by.

In the next day or two we will be publishing some attack statistics. It should make for some extremely fascinating reading.

We are back!

Many thanks to our techies and friends!



Hey, what's that? I think I've just heard a scammer crying in Festac Town after his precious bank website had been listed in our database and killed. Oops.

Hello World!

Contrary to popular belief AA419 is not dead. Our special friends from Vladistania currently use a botnet to attack us and other sites dealing with escrow fraud.

We'll be back. Soon.