Attacks/Breaches
7/17/2014
02:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Website Hacks Dropped During World Cup Final

Hackers apparently took time off to watch the Germany-Argentina title match of the 2014 FIFA World Cup.

Apparently, the only time bad-guy hackers take a breather from hammering away at websites is during the World Cup final match.

That's the takeaway from new data gathered by Imperva from its customers via its threat intelligence service. It turns out that web attacks were heavier than normal during the quarterfinal and semifinal matches, but they were miniscule during the final, in which Germany beat Argentina in extra time.

Though he says he's no soccer fan, Barry Shteiman, director of security strategy for Imperva, immersed himself in the single-elimination playoff portion of the global soccer tournament in order to set the parameters for studying activity during the quarterfinal, semifinal, and final matches.

What he found after measuring attacks during a two-hour period for each match was there was nearly three times the attack volume on websites during the quarterfinals and semifinals than comparable times when no games were under way.

And during the Germany-Argentina final match, attack volume was only about 2% compared to the quarterfinal and semifinal matches.

"We were surprised. We thought that the attacks would be the same or even during the final," Shteiman says. "With a lot of attacks over the past few years... attackers [take advantage] of everyone turning from security operations to watching the game instead of the incoming attacks. They're not focused," so that's ideal time for hackers to do their dirty work.

Website attackers definitely took advantage of distracted security folk during the quarterfinal and semifinal matches. "They took advantage of them watching those matches, when they were distracted," he says. "But it appears the attackers were distracted during the final."

Also, the final was on a Sunday, which could in part account for the drop in activity, he says.

(Source: Imperva)
(Source: Imperva)

Imperva typically sees around 2,125.5 individual attacks per hour during the timeslots the games were played, along with 441 attack campaigns per hour.

There were 149 attacks during the final pregame period, 160.5 during the match itself, and 34 during the post-game timeframe. Attack campaign volumes were even lower, with 68 during the pregame, 53.5 during the match, and 22 in the post-game timeframe.

Attack activity was consistently high during the other matches in the single-elimination phase, especially during the third-place game between Brazil and the Netherlands and the lopsided Brazil-Germany semifinal, which Germany won 7-1.

(Source: Imperva)
(Source: Imperva)

Interestingly, Imperva didn't find any attacks originating from Germany or Argentina during the final match, either. A blog post with more details can be found here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/23/2014 | 10:29:14 AM
Re: World cup final every day
I definitely think your statement regarding the non-world cup average being lower than the other rounds is a valid argument. However, I think how drastically low the drop was during the final does support that that game most likely had something to do with the change.
Dr.T
50%
50%
Dr.T,
User Rank: Apprentice
7/22/2014 | 1:48:16 PM
Re: More world cups>
They may really be watching that, it may even be less attacks during that time :- )).
Dr.T
50%
50%
Dr.T,
User Rank: Apprentice
7/22/2014 | 1:45:55 PM
Re: World Cup
That goes in line with the young makes stereotyping of hackers. Just saying it.
Dr.T
50%
50%
Dr.T,
User Rank: Apprentice
7/22/2014 | 1:42:04 PM
World cup final every day
 

Hackers like world cup finals then. If we play world cup finals every day would our lives be better then? It is also surprising all other games are above non-world cup average. I would say the data does not really make that much sense, hope there is now flow in the statistics.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
7/22/2014 | 10:06:21 AM
Re: What about the Olympics?
I was wondering the same thing.  <sarcasm>I guess the hacker job application form looks something like this: reverse enginering, shell coding, Soccer fan....</sarcasm>
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
7/21/2014 | 10:22:50 AM
Re: More world cups>
@Kelly  ooOOOoo. That's awesome! Jealous.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
7/21/2014 | 10:20:11 AM
Re: What about the Olympics?
@Marilyn  Well there's definitely been plenty of research about malicious activity during the Super Bowl, and as I recall it's rather high -- but that's because it's only interesting to Americans. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/18/2014 | 3:17:12 PM
What about the Olympics?
Hmmm. Is soccer the sport of choice for hackers or has anyone done research on website hacks for other events like the Olympics? 
Whoopty
50%
50%
Whoopty,
User Rank: Moderator
7/18/2014 | 11:18:23 AM
World Cup
There's something about as final, when you know you're watching the best of the best that gets people excited. I'm no big football fan but I watched a few minutes of the final. Perhaps hackers are the same. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
7/18/2014 | 9:56:10 AM
Re: More world cups>
=) No, but several of us (her former 'mates) are planning to attend a match or two next year. 
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2595
Published: 2014-08-31
The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which all...

CVE-2013-2597
Published: 2014-08-31
Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges via an application that lever...

CVE-2013-2598
Published: 2014-08-31
app/aboot/aboot.c in the Little Kernel (LK) bootloader, as distributed with Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to overwrite signature-verification code via crafted boot-image load-destination header values that specify memory ...

CVE-2013-2599
Published: 2014-08-31
A certain Qualcomm Innovation Center (QuIC) patch to the NativeDaemonConnector class in services/java/com/android/server/NativeDaemonConnector.java in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.3.x enables debug logging, which allows attackers to obtain sensitive disk-encryption pas...

CVE-2013-6124
Published: 2014-08-31
The Qualcomm Innovation Center (QuIC) init scripts in Code Aurora Forum (CAF) releases of Android 4.1.x through 4.4.x allow local users to modify file metadata via a symlink attack on a file accessed by a (1) chown or (2) chmod command, as demonstrated by changing the permissions of an arbitrary fil...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.