Attacks/Breaches
3/16/2011
01:46 PM
50%
50%

Denial Of Service Attacks Increased Sharply In 2010

DDoS attacks surpass SQL injection to become most prevalent attack vector, security vendor Trustwave reports.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches

Between the first and second half of 2010, distributed denial-of-service (DDoS) attacks grew to surpass SQL injection attacks as the number-one attack vector against large businesses and organizations, according to a report from information security vendor Trustwave.

The study released Monday found that the principle drivers for Web attacks appear to be to causing Web site downtime (in 33% of cases), defacement (15%), stealing information (13%), planting malware to infect end clients (9%), and spreading disinformation (9%).

Despite the prevalence of downtime, most attacks appear to be profit-driven, and the Trustwave study found that attack outcomes largely mirrored this goal. For financial sector organizations, for example, 64% of attacks resulted in monetary loss, with 59% of firms admitting that they lacked robust enough authentication, and 36% saying that they'd been hacked using stolen credentials. Meanwhile, in the retail sector, 27% of attacks resulted in credit card data leakage, and SQL injection attacks were the principle method of attack.

Likewise, government Web sites most frequently fell due to SQL injection attacks (used in 24% of cases) and because of improper Web application input handling (for 26% of organizations). Thankfully, the principle outcome (in 26% of cases) was only Web site defacement.

As noted, DDoS attacks have become the principle hacking technique (in 32% of cases), followed by SQL injection (21%) and cross-site scripting (9%). Brute force, cross-site request forgery, process automation, and known vulnerability attacks were also seen, though less frequently.

Unfortunately, DDoS attacks are becoming harder to stop. In particular, newer types of attacks often target the Web application layer. Instead of overwhelmingly a network with packets, attackers can employ a smaller number of specially crafted requests -- using HTTP, HTTPS, SMTP, FTP, and similar protocols -- to produce a denial of service. For example, Slowloris, a free tool released in 2009, uses time-delayed HTTP headers to prevent HTTP connections from expiring, until servers simply run out of bandwidth.

According to Trustwave's report, "the bottom line is that the overall amount of traffic needed to potentially take down a Web site is much less than is required to flood the network pipe leading to the Web server."

Trustwave isn't the first firm to spot the rise in DDoS attacks or variation in techniques. Last month, an Arbor Networks study blamed botnets for a noticeable increase in DDoS attack sophistication and frequency. Notably, it found that DDoS attack bandwidth increased by 102% during 2010, and rose by a staggering 1,000% from 2005 and 2010.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4403
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.ph...

CVE-2012-2930
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers...

CVE-2012-2932
Published: 2015-04-24
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the (1) selitems[] parameter in a copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/...

CVE-2012-5451
Published: 2015-04-24
Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.

CVE-2015-0297
Published: 2015-04-24
Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methos via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.