Distributed denial of service (DDoS) attacks are growing not only in frequency, but also in effectiveness, as the criminal world develop new techniques and capabilities in their usage. The impact can still range from a minor annoyance from disrupted services to entire web sites, applications, or even entire business taken offline.
DDoS attack symptoms
DDoS attacks can look like many of the non-malicious things that can cause availability issues, such as a downed server or system, too many legitimate requests from legitimate users, or even a cut cable. It often requires traffic analysis to determine what is precisely occurring.
“Businesses are no longer merely concerned with DDoS attacks on themselves, but attacks on the vast number of business partners, vendors, and suppliers on whom those businesses rely,” Mike Overly, Foley and Lardner LLP
advertisement 
In an attack that would forever change how denial-of-service attacks would be viewed, in early 2000, Canadian high school student Michael Calce, AKA “MafiaBoy”, whacked Yahoo! with a DDoS attack that managed to shut down one of the leading web powerhouses of the time. Over the course of the week that followed, Calce took aim, and successfully disrupted, other such sites as Amazon, CNN and eBay.
Certainly not the first DDoS attack, but that highly public and successful series of attacks transformed denial of service attacks from novelty and minor nuisance to powerful business disruptors in the minds of CISOs and CIOs forever.
Since then, DDoS attacks have become an all too frequent menace, as they are commonly used to exact revenge, conduct extortion, as a means of online activism, and even to wage cyberwar.
Size issues
They have also gotten bigger over the years. In the mid-1990s an attack may have consisted of 150 requests per second – and it would have been enough to bring down many systems. Today they can exceed 1,000 Gbps. This has largely been fuelled by the sheer size of modern botnets.
In October 2016, internet infrastructure services provider Dyn DNS (Now Oracle DYN) was stuck by a wave of DNS queries from tens of millions IP addresses. That attack, executed through the Mirai botnet, infected reportedly over 100,000 IoT devices, including IP cameras and printers. At its peak, Mirai reached 400,000 bots. Services including Amazon, Netflix, Reddit, Spotify, Tumblr, and Twitter were disrupted.
New technique
In early 2018 a new DDoS technique began to emerge. On February 28, the version control hosting service GitHub was hit with a massive denial of service attack, with 1.35 TB per second of traffic hitting the popular site. Although GitHub was only knocked offline intermittently and managed to beat the attack back entirely after less than 20 minutes, the sheer scale of the assault was worrying, as it outpaced the Dyn attack, which had peaked at 1.2 TB a second.
An analysis of the technology that drove the attack revealed that it was in some ways simpler than other assaults. While the Dyn attack was the product of the Mirai botnet, which required malware to infest thousands of IoT devices, the GitHub attack exploited servers running the Memcached memory caching system, which can return very large chunks of data in response to simple requests.
Memcached is meant to be used only on protected servers running on internal networks, and generally has little by way of security to prevent malicious attackers from spoofing IP addresses and sending huge amounts of data at unsuspecting victims. Unfortunately, thousands of Memcached servers are sitting on the open internet, and there has been a huge upsurge in their use in DDoS attacks. Saying that the servers are “hijacked” is barely fair, as they will cheerfully send packets wherever they are told without asking questions.
Just days after the GitHub attack, another Memecached-based DDoS assault slammed into a US service provider with 1.7 TB per second of data.
The Mirai botnet was significant in that, unlike most DDoS attacks, it leveraged vulnerable IoT devices rather PCs and servers, It is especially scary when one considers that by 2020, according to BI Intelligence, there will be 34 billion internet connected devices, and the majority (24 billion) will be IoT devices.
Unfortunately, Mirai will not be the last IoT-powered botnet. An investigation across security teams within Akamai, Cloudflare, Flashpoint, Google, RiskIQ and Team Cymru uncovered a similarly sized botnet, dubbed WireX, consisting of 100,000 compromised Android devices within 100 countries. A series of large DDoS attacks that targeted content providers and content delivery networks prompted the investigation.
DDoS attack tools
Typically, DDoS attackers rely on botnets — collections of a network of malware-infected systems that are centrally controlled. These infected endpoints are usually computers and servers, but are increasingly IoT and mobile devices. The attackers will harvest these systems by identifying vulnerable systems that they can infect through phishing attacks, malvertising attacks and other mass infection techniques. Increasingly, attackers will also rent these botnets from those who built them.
3 types of DDoS attacks
There are three primary classes of DDoS attacks — those that use massive amounts of bogus traffic to down a resource such as a web site or server, including ICMP, UDP, and spoof-packet flood attacks. Another class of DDoS attack uses packets to target the network infrastructure and infrastructure management tools. These protocol attacks include SYN Floods and Smurf DDoS, among others. Finally, some DDoS attacks target an organisation’s application layer and are conducted by flooding applications with maliciously crafted requests. The goal is always the same: make online resources sluggish or completely unresponsive.
How DDoS attacks evolve
As mentioned briefly above, it’s becoming more common for these attacks to be conducted by rented botnets. Expect this trend to continue.
Another trend is the use of multiple attack vectors within an attack, also known as Advanced Persistent Denial-of-Service APDoS. For instance, an APDoS attack may involve the application layer, such as attacks against databases and applications as well as directly on the server. “This goes beyond simply ‘flooding,’” attacks says Chuck Mackey, managing director of partner success at Binary Defense.
Additionally, Mackey explains, attackers often do not just directly target their victims but also the organisations on which they depend such as ISPs and cloud providers. “These are broad-reaching, high-impact attacks that are well-coordinated,” he says.
This is also changing the impact of DDoS attacks on organisations and expanding their risk. “Businesses are no longer merely concerned with DDoS attacks on themselves, but attacks on the vast number of business partners, vendors, and suppliers on whom those businesses rely,” says Mike Overly, cybersecurity lawyer at Foley and Lardner LLP. “One of the oldest adages in security is that a business is only as secure as its weakest link. In today’s environment (as evidenced by recent breaches), that weakest link can be, and frequently is, one of the third parties,” he says.
Of course, as criminals perfect their DDoS attacks, the technology and tactics will not stand still. As Rod Soto, director of security research at JASK explains, the addition of new IoT devices, rise of machine learning and AI will all play a role in changing these attacks. “Attackers will eventually integrate these technologies into attacks as well, making it more difficult for defenders to catch up with DDoS attacks, specifically those that cannot be stopped by simple ACLs or signatures. DDoS defence technology will have to evolve in that direction as well,” Soto says.
IDG News Service
Ltd
