IT Security

Botnet-assisted DDoS attack report

by Mark Rowe

Activity by attack servers in western Europe and the number of the resources attacked in the region have both increased. The number of sophisticated DDoS attacks emanating from encrypted traffic has also grown, according to a report on botnet-assisted DDoS attacks for the third quarter of 2016, by an IT security product company.

Over the reporting period, resources in 67 countries were targeted by botnet-assisted DDoS attacks. The number of attacks on resources in Japan, the US and Russia increased noticeably, while the number of victims in China and South Korea fell says Kaspersky Lab. This quarter also saw three western European entries – Italy, France and Germany – among the top 10 countries most affected by botnet DDoS attacks for the first time in a year. These statistics correlate with the growing number of active C&C servers in Western Europe, particularly in the UK, France and the Netherlands.

Despite a decrease in the total number of attacks registered in China, the most targeted resources were Chinese – the largest number of attacks (19) was launched against a popular Chinese search engine, and a Chinese provider was subjected to the longest attack in the third quarter (184 hours). Meanwhile, the most active day for DDoS attacks registered over the last four quarters was 3 August. There were 1,746 botnet attacks on that day, with many of them targeting the servers of a single service provider located in the US.

In Q3 2016 the number of SYN-DDoS attacks continued to grow and accounted for 81 per cent of all registered attacks, while the share of TCP-DDoS and ICMP-DDoS attacks fell once again. The percentage of attacks by Linux-based DDoS bots also continued to grow, reaching 79 per cent – a record for the last year. This can be explained by the growing popularity of Linux-based IoT devices used for DDoS attacks, and will most probably be boosted further after the leakage of Mirai.

Kaspersky Lab also registered growth in the number of “smart” attacks using encryption of transmitted data. A typical example of such an attack is a relatively small number of queries being sent to the “load-heavy” parts of websites (such as search forms) via an encrypted connection. By residing in encrypted traffic and due to their low intensity, these attacks are very difficult for many specialised protection solutions to filter out.

Kirill Ilganaev, Head of Kaspersky DDoS Protection, said: “This method is growing in popularity because amplification attacks are becoming more complicated and inefficient for cybercriminals: the number of vulnerable servers is decreasing and security solutions have learnt to easily identify and filter out the majority of amplification attacks. Secondly, the Internet is seeing a steady migration away from classic HTTP to encrypted interaction between users and web resources. All this suggests that the number of encryption-based attacks will only grow, meaning developers have to immediately start revising their anti-DDoS protection measures, and owners of web resources need to take a responsible approach to choosing a security solution.”

Newsletter

Subscribe to our weekly newsletter to stay on top of security news and events.

© 2024 Professional Security Magazine. All rights reserved.

Website by MSEC Marketing