DoS attack knocks tens of thousands of Texans offline...
SecureInfo.com is blaming PoisonBOx for leaving tens of thousands of San Antonians without Internet access the day before. Hackers targeted a commercial customer of STIC.NET, a San Antonio-based Internet service provider, but it created a domino effect that brought Internet access to a halt for 18 hours Wednesday.
"For a little ISP in San Antonio, this is the biggest we've ever seen," said Dave Robertson, president of STIC.NET, which has 10,000 to 20,000 local customers. Robertson declined to identify the victimized customer but described the denial-of-service attack as "close to catastrophe." STIC.NET went down at 2:40 a.m. and started coming back online at 4:15 p.m. with full service - except for the hackers' target - restored by 8:05 p.m. Wednesday, Robertson said.
Hackers hit S.A. provider ; Attack on business customer interrupts STIC.NET access
BYLINE: Don Sheron
BODY: But Robertson said hackers were continuing their assault on the target even into early Thursday morning.
"This wasn't a drive-by. It's still an ongoing attack.
"They're not hurting me (as an ISP) because that particular (targeted) arena is still shut down," Robertson said Thursday.
Other Internet-related companies in San Antonio did not report hacking attacks, although they say Internet access was slow Wednesday.
Southwestern Bell reported slow Internet access Wednesday for about a half-hour, but it was related to a new router the company installed for its high-speed Internet DSL customers, which would have affected only about 2 percent of Southwestern Bell's customers, spokesman Bill Noble said. Dial-up access was not affected, he added.
Meanwhile, the hacking attack that shut down STIC.NET has been traced to the Milwaukee operations center of Time Warner Telecom, whose Internet customers include STIC.NET.
"It's hard to tell the exact number of hits," said Bob Meldrum, Time Warner Telecom's senior director of marketing and communications.
"But it's widespread enough that it affected several customers in San Antonio," Meldrum said.
The FBI office in Milwaukee office has been notified about the attack, STIC.NET's Robertson said. "Other networks in other states have (said) that they've been taken over and utilized to focus the attack on us," Robertson said.
Officials of the FBI in Milwaukee and Washington, D.C., could not be reached for comment.
If the culprits are identified, "we're ready to prosecute to whatever degree is appropriate," Robertson said.
No one has claimed responsibility for the hacking attack, but the culprits may be members of the group known as PoizonBOx, according to SecureInfo Corp., a e-security firm in San Antonio.
If PoizonBOx is responsible, it's the same hacker group that recently defaced Chinese Web sites after a U.S. spy plane collided with a Chinese fighter jet and was forced to land in China.
PoizonBOx also had defaced a Navy Web site Wednesday, said Michael Garcia, a spokesman for SecureInfo.
Within the past several months, PoizonBOx has defaced hundreds of Web sites by using an automated hacking tool called sadmind, Garcia said.
The watchdog group CERT, based at Carnegie Mellon University, issued an alert about sadmind in May.
Sadmind works in the background. When Web surfers access a site, that site may not be defaced, but sadmind automatically will scan the surfer to access to the user's IP address. Sadmind spreads when Web surfers access other Web sites that have not patched their vulnerabilities.
"This combination (of hacking tool and worm) is going to be a very big thing in the future," Garcia said.
Garcia urged that Internet users make sure that their anti-virus software is updated.
"Small businesses should update their server software all the way," he added
SNP.
