Arbor: DDoS attacks growing faster in size, complexity

The size of distributed denial of service attacks continued to grow at a faster rate than ever last year, and the attacks also increased in frequency and complexity, according to Arbor Networks' latest Worldwide Infrastructure Security Report.

The size of distributed denial of service attacks continued to grow at a faster rate than ever last year, and the attacks also increased in frequency and complexity, according to Arbor Networks’  latest Worldwide Infrastructure Security Report.

The 12th annual report, published Tuesday, is based on a survey of 365 internet service providers, as well as other types of network operators from around the world, and on internet data from Nov. 2015 through Oct. 2016. Because Arbor provides services to so many large internet providers, it has visibility into about a third of all global internet traffic.

Distributed denial-of-service, or DDoS, attacks are at one level the most basic kind of cyberattack — compromised devices, like personal computers infected by a virus, are marshaled into huge robot networks or botnets, and flood the targeted website or other system with junk data, slowing real traffic to a crawl or stopping it altogether.

The largest attack seen during the period covered in the report aimed 800 gigabits per second, or GbPS, of data at the target — a 60 percent increase over the largest attack from the prior year. Since Arbor first began producing the report in 2005, maximum DDoS attack size has grown at a compound annual growth rate of 44 percent. But in the past five years, since 2011, that rate has been 68 percent, the company said in a release.

The report says the massive growth in attack size has been driven by two factors. Firstly, “the emergence and weaponization” of botnets based on compromised IoT devices or home routers, rather than computers; and secondly the increased use of “reflection amplification” by attackers. Reflection amplification leverages internet infrastructure like the domain name system or the network time protocol “to multiply attack traffic by hundreds of times, while hiding the original source.”

In a reflection attack, an attacker can “send 1GbPS of initial traffic, [and] 100 GbPS is delivered to the target.”

As the frequency of attacks rises, “the chances of being hit by a DDoS attack have never been higher,” states the report.

Fifty-three percent of service providers said they are seeing more than 21 attacks per month — up from 44 percent in the prior year. Frequency grew much faster for other sectors. Twenty-one percent of data center respondents see more than 50 attacks per month versus only 8 percent last year, for instance.

Also rising: complexity. While the basic DDoS attack is very straightforward, using internet traffic to overwhelm web-facing servers; there are other forms of DDoS that can be aimed at different aspects of victims’ infrastructures, like the application layer or the connection state tables in firewalls, web application servers, and other infrastructure components. This last kind of attack is called a state-exhaustion or protocol attack.

A multi-vector attack is when several different attack modes are combined. These attacks are popular with hackers “because they can be difficult to defend against and are often highly effective,” states the report. The proportion of respondents seeing multi-vector attacks on their networks increased significantly in the period covered by the report, up to 67 percent from 56 percent the prior year and 42 percent the year before that.

Officials seize 53 DDoS-for-hire domains in ongoing crackdown

Operation PowerOFF’s latest globally coordinated action identified more than 75,000 alleged cybercriminals. Officials warned each of them to stop jamming up traffic.

Officials gain control of Rapper Bot DDoS botnet, charge lead developer and administrator

Pro-Russian DDoS group NoName057(16) disrupted by international law enforcement operation

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure