A reversal? Large

Massive denial of service attacks were largely missing from the internet this summer.

Massive denial of service attacks were largely missing from the internet this summer, according to new research from Akamai.

The second quarter of 2017 marks the first time in three years that the company didn’t see a denial of service attack measuring over 100 gigabits per second. That’s down from two such attacks at the beginning of 2017, Akamai’s Martin McKeay told CyberScoop.

The biggest attack of the quarter saw PBot DDoS malware used to launch a 75 gigabits per second attack using 400 nodes against a financial organization. That’s an extraordinarily small number of nodes compared to the usual scope of these attacks, which can reach into the tens of thousands. Even so, the weaponized traffic was significant.

The small number of nodes but large traffic from the PBot attack was characteristic of trends throughout the quarter. Akamai saw a 28 percent increase in DDoS attacks, but the number of unique IP addresses used fell, suggesting at least a temporary shift away from the kind of mass take-overs of various IoT devices exemplified by the Mirai botnet spotted throughout 2016.

The Mirai botnet has been used in multiple attacks, including most famously last October attack against the Domain Name System provider Dyn that brought down major websites including Twitter, Amazon and the New York Times.

For reference, the 2016 Mirai denial of service attack against journalist Brian Krebs reached 620 Gbps.

“We aren’t certain, but our research into the Pbot malware suggests that we’re going back to a cycle where the attacks are coming from servers, rather than IoT devices,” McKeay said. “The largest attack this quarter only used 400 IP addresses, compared to the thousands used in an IoT based attack.”

Targets range widely, but the gaming industry is taking more punches than normal. According to Akamai, who say the frequency of attacks targeting this industry is up to “81 percent of all volumetric DDoS attacks.” The extreme sensitivity of video game servers to lag make it an obvious target. Additionally, the number of DDoS attacks recorded spiked in June suggesting the possibility that, for a lot of people, this is an after-school activity. One of Akamai’s customers suffered 558 attacks.

Whatever Akamai learned in recent months, they put little stock in stagnation. Change is a constant in this arena.

“DDoS is a cyclic phenomenon,” the researchers wrote. “The chaos we’ve seen in the DDoS field over the past year has been monumental, and there’s little reason to believe the evolution has reached a stable plateau.”

Officials seize 53 DDoS-for-hire domains in ongoing crackdown

Operation PowerOFF’s latest globally coordinated action identified more than 75,000 alleged cybercriminals. Officials warned each of them to stop jamming up traffic.

Officials gain control of Rapper Bot DDoS botnet, charge lead developer and administrator

Pro-Russian DDoS group NoName057(16) disrupted by international law enforcement operation

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure