Attacks/Breaches
1/17/2013
10:39 AM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%

Large-Scale DDoS Attacks Grow Bigger and More Diversified According To Prolexic’s Latest Report

Seven 50+ Gbps attacks mitigated against financial, SaaS, and e-commerce firms

HOLLYWOOD, FL – (January 17, 2013) – Prolexic Technologies, the global leader in Distributed Denial of Service (DDoS) protection services, today announced that the scale and diversity of attacks increased against its global client base in Q4 2012. This is one of a number of key findings contained in the company's Quarterly Global DDoS Attack Report, which was published today.

While Q4 media reports focused on large DDoS attacks primarily against U.S. financial services companies, Prolexic also mitigated 50+ Gbps DDoS attacks against clients in the e-Commerce and software as a service (SaaS) sectors. While the itsoknoproblembro (BroDoS) toolkit was used against financial services firms in Q4, data shows it was also used against businesses in other sectors. Digital forensics by the Prolexic Security Engineering & Response Team (PLXsert) also found that malware besides Brodos was used in Q4 to generate equally large bandwidth attacks.

"The fourth quarter was defined by the increasing scale and diversity of DDoS attacks," said Prolexic CEO, Scott Hammack. "While bandwidth attacks of 20 Gbps were the story last quarter, 50 Gbps is more relevant now."

Highlights from Prolexic's Q4 2012 Global DDoS Attack Report

Compared to Q3 2012

· 27.5 percent increase in total number of attacks

· 17% increase in total number of infrastructure attacks; 72% rise in total number of application attacks

· 67% increase in average attack duration to 32.2 hours from 19.2 hours

· 20% increase in average attack bandwidth from 4.9 to 5.9 Gbps

· China retains its position as the top source country for DDoS attacks

Compared to Q4 2011

· 19% increase in total number of DDoS attacks

· 15% rise in total number of infrastructure attacks; 30% rise in total number of application attacks

· 6% decline in average attack duration to 32.2 hours from 34

· 13% increase in average attack bandwidth from 5.2 Gbps to 5.9 Gbps

Analysis and emerging trends

During Q4 2012, Prolexic mitigated seven attacks over 50 Gbps directed against clients in the financial services, e-Commerce and SaaS verticals. "A case could be made that the size of attacks that are being reported in the financial services industry really just reflects the normal growth in DDoS," said Hammack. "We are seeing similarly sized attacks in other verticals, but they don't make headlines because companies in these industries are not required to report it in the same way."

In addition to increasing attack sizes, attack volume grew in Q4 2012 and reached the highest number of attacks Prolexic has logged for one quarter. Like the previous quarter, traditional Layer 3 and Layer 4 infrastructure attacks were the favored attack type, accounting for 75% of total attacks during the quarter, with application layer attacks making up the remaining 25%. This split has remained consistent throughout 2012. This quarter, SYN (24 percent), GET (20 percent), ICMP (18 percent) and UDP (15 percent) floods were the attack types most often encountered during mitigation.

Average attack duration increased 67% from 19.2 hours in Q3 2012 to 32.2 hours this quarter. November was the most active month for attacks, however, the total number of attacks for all three months of the quarter were consistent, showing a less than 10% difference from month to month. The week of Nov. 26 was the most active of the quarter, although only by a narrow margin.

As is commonplace, the top 10 list of source countries responsible for launching the most DDoS attacks was fluid. However, this quarter China secured the top place in attack source country rankings by a wide margin. Compared to last quarter, the United States dropped down in the rankings, while two European countries, France and Germany, rejoined the top 10 list.

"The take away for businesses from this Q4 report is to make sure that their DDoS mitigation provider can handle attacks in excess of 50 Gbps in a single location," said Hammack. "When attacks are this large, it's important that the provider can mitigate this volume of attack traffic in one place and distribute it effectively so it does not compromise intermediary transit providers and affect others."

Data for the Q4 2012 report has been gathered and analyzed by the PLXsert. The group monitors malicious cyber threats globally and analyzes DDoS attacks using proprietary techniques and equipment. Through digital forensics and post-attack analysis, PLXsert builds a global view of DDoS attacks, which is shared with Prolexic customers. By identifying the sources and associated attributes of individual attacks, PLXsert helps organizations adopt best practices and make more informed, proactive decisions about DDoS threats.

A complimentary copy of the Prolexic Quarterly Attack Report for Q4 2012 is available as a free PDF download from www.prolexic.com/attackreports. Prolexic's Q1 2013 report will be released in the second quarter of 2013.

About Prolexic

Prolexic is the world's largest, most trusted Distributed Denial of Service (DDoS) mitigation provider. Able to absorb the largest and most complex attacks ever launched, Prolexic restores mission-critical Internet-facing infrastructures for global enterprises and government agencies within minutes. Ten of the world's largest banks and the leading companies in e-Commerce, SaaS, payment processing, travel/hospitality, gaming and other at-risk industries rely on Prolexic to protect their businesses. Founded in 2003 as the world's first in-the-cloud DDoS mitigation platform, Prolexic is headquartered in Hollywood, Florida and has scrubbing centers located in the Americas, Europe and Asia. To learn more about how Prolexic can stop DDoS attacks and protect your business, please visit www.prolexic.com, follow us on LinkedIn, Facebook and Google+ or follow @Prolexic on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-0334
Published: 2014-10-31
Bundler before 1.7, when multiple top-level source lines are used, allows remote attackers to install arbitrary gems by creating a gem with the same name as another gem in a different source.

CVE-2014-2334
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2335
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2336.

CVE-2014-2336
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the Web User Interface in Fortinet FortiManager before 5.0.7 and FortiAnalyzer before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2014-2334 and CVE-2014-2335.

CVE-2014-3366
Published: 2014-10-31
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.