Attacks/Breaches
1/17/2013
10:39 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Large-Scale DDoS Attacks Grow Bigger and More Diversified According To Prolexic’s Latest Report

Seven 50+ Gbps attacks mitigated against financial, SaaS, and e-commerce firms

HOLLYWOOD, FL – (January 17, 2013) – Prolexic Technologies, the global leader in Distributed Denial of Service (DDoS) protection services, today announced that the scale and diversity of attacks increased against its global client base in Q4 2012. This is one of a number of key findings contained in the company's Quarterly Global DDoS Attack Report, which was published today.

While Q4 media reports focused on large DDoS attacks primarily against U.S. financial services companies, Prolexic also mitigated 50+ Gbps DDoS attacks against clients in the e-Commerce and software as a service (SaaS) sectors. While the itsoknoproblembro (BroDoS) toolkit was used against financial services firms in Q4, data shows it was also used against businesses in other sectors. Digital forensics by the Prolexic Security Engineering & Response Team (PLXsert) also found that malware besides Brodos was used in Q4 to generate equally large bandwidth attacks.

"The fourth quarter was defined by the increasing scale and diversity of DDoS attacks," said Prolexic CEO, Scott Hammack. "While bandwidth attacks of 20 Gbps were the story last quarter, 50 Gbps is more relevant now."

Highlights from Prolexic's Q4 2012 Global DDoS Attack Report

Compared to Q3 2012

· 27.5 percent increase in total number of attacks

· 17% increase in total number of infrastructure attacks; 72% rise in total number of application attacks

· 67% increase in average attack duration to 32.2 hours from 19.2 hours

· 20% increase in average attack bandwidth from 4.9 to 5.9 Gbps

· China retains its position as the top source country for DDoS attacks

Compared to Q4 2011

· 19% increase in total number of DDoS attacks

· 15% rise in total number of infrastructure attacks; 30% rise in total number of application attacks

· 6% decline in average attack duration to 32.2 hours from 34

· 13% increase in average attack bandwidth from 5.2 Gbps to 5.9 Gbps

Analysis and emerging trends

During Q4 2012, Prolexic mitigated seven attacks over 50 Gbps directed against clients in the financial services, e-Commerce and SaaS verticals. "A case could be made that the size of attacks that are being reported in the financial services industry really just reflects the normal growth in DDoS," said Hammack. "We are seeing similarly sized attacks in other verticals, but they don't make headlines because companies in these industries are not required to report it in the same way."

In addition to increasing attack sizes, attack volume grew in Q4 2012 and reached the highest number of attacks Prolexic has logged for one quarter. Like the previous quarter, traditional Layer 3 and Layer 4 infrastructure attacks were the favored attack type, accounting for 75% of total attacks during the quarter, with application layer attacks making up the remaining 25%. This split has remained consistent throughout 2012. This quarter, SYN (24 percent), GET (20 percent), ICMP (18 percent) and UDP (15 percent) floods were the attack types most often encountered during mitigation.

Average attack duration increased 67% from 19.2 hours in Q3 2012 to 32.2 hours this quarter. November was the most active month for attacks, however, the total number of attacks for all three months of the quarter were consistent, showing a less than 10% difference from month to month. The week of Nov. 26 was the most active of the quarter, although only by a narrow margin.

As is commonplace, the top 10 list of source countries responsible for launching the most DDoS attacks was fluid. However, this quarter China secured the top place in attack source country rankings by a wide margin. Compared to last quarter, the United States dropped down in the rankings, while two European countries, France and Germany, rejoined the top 10 list.

"The take away for businesses from this Q4 report is to make sure that their DDoS mitigation provider can handle attacks in excess of 50 Gbps in a single location," said Hammack. "When attacks are this large, it's important that the provider can mitigate this volume of attack traffic in one place and distribute it effectively so it does not compromise intermediary transit providers and affect others."

Data for the Q4 2012 report has been gathered and analyzed by the PLXsert. The group monitors malicious cyber threats globally and analyzes DDoS attacks using proprietary techniques and equipment. Through digital forensics and post-attack analysis, PLXsert builds a global view of DDoS attacks, which is shared with Prolexic customers. By identifying the sources and associated attributes of individual attacks, PLXsert helps organizations adopt best practices and make more informed, proactive decisions about DDoS threats.

A complimentary copy of the Prolexic Quarterly Attack Report for Q4 2012 is available as a free PDF download from www.prolexic.com/attackreports. Prolexic's Q1 2013 report will be released in the second quarter of 2013.

About Prolexic

Prolexic is the world's largest, most trusted Distributed Denial of Service (DDoS) mitigation provider. Able to absorb the largest and most complex attacks ever launched, Prolexic restores mission-critical Internet-facing infrastructures for global enterprises and government agencies within minutes. Ten of the world's largest banks and the leading companies in e-Commerce, SaaS, payment processing, travel/hospitality, gaming and other at-risk industries rely on Prolexic to protect their businesses. Founded in 2003 as the world's first in-the-cloud DDoS mitigation platform, Prolexic is headquartered in Hollywood, Florida and has scrubbing centers located in the Americas, Europe and Asia. To learn more about how Prolexic can stop DDoS attacks and protect your business, please visit www.prolexic.com, follow us on LinkedIn, Facebook and Google+ or follow @Prolexic on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.