OpOperadoras

Background

In an effort to fight for the rights of digital consumers throughout South America, the hacktivist group Anonymous has launched OpOperadoras,i coordinated cyber assault against Brazilian telecommunication companies in response to a fixed broadband provision that would ban unlimited data plans in Brazil. ii

The provision has enraged millions of Internet usersiii throughout South America.

The first organization struck was ANATEL – The National Telecommunications Agency. ANATEL suffered a large-scale DDoS attack that reached 40Gbpsiv of traffic generated via international bots, in parallel to SQL injections that resulted in extraction of confidential informationv regarding executives at various telecommunication companies.vi

Hackers have posted a sample of the database on Ghostbin and are threating to release more data.

Attack Analysis

This attack was unique as perpetrators executed it using the smoke screen technique. To create confusion and misdirection, attackers overwhelm the security personnel with irrelevant traffic, slowing down unrelated applications or filling logs with irrelevant data. While the security team is kept busy, the primary attack is launched.

This time – various DDoS bursts of 4-40Gbps as well as SQL injections to infiltrate servers and extract sensitive data.


Figure 1: Attackers respond to ANATEL's president comment "internet users spending too much time playing games"

The attackers published a DDoS tutorial for participantsvii, explaining how to achieve a Denial-of-Service state using low and slow attacks (hack tools include: LOIC, Web Loic, SlowLoris and PyLoris).

Targets

Communication Channels

Video

IRC

Tutorials Suggested via Op

How to Identify a Smoke-Screen Attack?

If an anomaly is identified, review the following questions:

Then take the following steps:

  1. Check logs and perhaps filter out vectors once they've been ruled them out.

  2. Check additional assets and collaborate with other departments throughout the organization to ensure that nothing else appears wrong.

  3. Tune the Web Application Firewall (WAF), as it can help prevent data theft and manipulation of sensitive corporate data in addition to safeguarding customer information.

  4. Combining WAF with an on-premise detection and behavioral analysis solution lets you mitigate smokescreen attacks while protecting customer data.

It is absolutely critical that organizations adopt layered security models to protect their websites and databases. DDoS mitigation appliances can protect you from the smoke screens. Firewalls and a strong perimeter can secure access. Make use of the tools and forensic data that you have available. Remember: things aren't always what they seem and a smoke screen attack just might be real intent of obvious network events.


Figure 2: ANATEL's acknowledges the abnormal behavior followed by a DDoS attack

Effective DDoS Protection Elements:

Effective Web Application Protection Elements

(against web intrusions, defacement and data leakage):

Radware's hybrid attack mitigation solution provides a set of patented and integrated technologies designed to detect, mitigate and report the most advanced threats. Dedicated hardware and cloud solutions protect against attacks in real time and help ensure service availability.

Under Attack and in Need of Expert Emergency Assistance?

Radware offers a full range of solutions to help networks properly mitigate attacks similar to these. Our attack mitigation solutions provide a set of patented and integrated technologies designed to detect, mitigate and report todays most advanced DDoS attacks and cyber threats. With dedicated hardware, fully managed services and cloud solutions that protect against attacks, Radware can help ensure service availability. To understand how Radware's attack mitigation solutions can better protect your network contact us today.