Attacks/Breaches
7/17/2014
02:50 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Website Hacks Dropped During World Cup Final

Hackers apparently took time off to watch the Germany-Argentina title match of the 2014 FIFA World Cup.

Apparently, the only time bad-guy hackers take a breather from hammering away at websites is during the World Cup final match.

That's the takeaway from new data gathered by Imperva from its customers via its threat intelligence service. It turns out that web attacks were heavier than normal during the quarterfinal and semifinal matches, but they were miniscule during the final, in which Germany beat Argentina in extra time.

Though he says he's no soccer fan, Barry Shteiman, director of security strategy for Imperva, immersed himself in the single-elimination playoff portion of the global soccer tournament in order to set the parameters for studying activity during the quarterfinal, semifinal, and final matches.

What he found after measuring attacks during a two-hour period for each match was there was nearly three times the attack volume on websites during the quarterfinals and semifinals than comparable times when no games were under way.

And during the Germany-Argentina final match, attack volume was only about 2% compared to the quarterfinal and semifinal matches.

"We were surprised. We thought that the attacks would be the same or even during the final," Shteiman says. "With a lot of attacks over the past few years... attackers [take advantage] of everyone turning from security operations to watching the game instead of the incoming attacks. They're not focused," so that's ideal time for hackers to do their dirty work.

Website attackers definitely took advantage of distracted security folk during the quarterfinal and semifinal matches. "They took advantage of them watching those matches, when they were distracted," he says. "But it appears the attackers were distracted during the final."

Also, the final was on a Sunday, which could in part account for the drop in activity, he says.

(Source: Imperva)
(Source: Imperva)

Imperva typically sees around 2,125.5 individual attacks per hour during the timeslots the games were played, along with 441 attack campaigns per hour.

There were 149 attacks during the final pregame period, 160.5 during the match itself, and 34 during the post-game timeframe. Attack campaign volumes were even lower, with 68 during the pregame, 53.5 during the match, and 22 in the post-game timeframe.

Attack activity was consistently high during the other matches in the single-elimination phase, especially during the third-place game between Brazil and the Netherlands and the lopsided Brazil-Germany semifinal, which Germany won 7-1.

(Source: Imperva)
(Source: Imperva)

Interestingly, Imperva didn't find any attacks originating from Germany or Argentina during the final match, either. A blog post with more details can be found here.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
7/23/2014 | 10:29:14 AM
Re: World cup final every day
I definitely think your statement regarding the non-world cup average being lower than the other rounds is a valid argument. However, I think how drastically low the drop was during the final does support that that game most likely had something to do with the change.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/22/2014 | 1:48:16 PM
Re: More world cups>
They may really be watching that, it may even be less attacks during that time :- )).
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/22/2014 | 1:45:55 PM
Re: World Cup
That goes in line with the young makes stereotyping of hackers. Just saying it.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
7/22/2014 | 1:42:04 PM
World cup final every day
 

Hackers like world cup finals then. If we play world cup finals every day would our lives be better then? It is also surprising all other games are above non-world cup average. I would say the data does not really make that much sense, hope there is now flow in the statistics.
Robert McDougal
50%
50%
Robert McDougal,
User Rank: Ninja
7/22/2014 | 10:06:21 AM
Re: What about the Olympics?
I was wondering the same thing.  <sarcasm>I guess the hacker job application form looks something like this: reverse enginering, shell coding, Soccer fan....</sarcasm>
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
7/21/2014 | 10:22:50 AM
Re: More world cups>
@Kelly  ooOOOoo. That's awesome! Jealous.
Sara Peters
50%
50%
Sara Peters,
User Rank: Author
7/21/2014 | 10:20:11 AM
Re: What about the Olympics?
@Marilyn  Well there's definitely been plenty of research about malicious activity during the Super Bowl, and as I recall it's rather high -- but that's because it's only interesting to Americans. 
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/18/2014 | 3:17:12 PM
What about the Olympics?
Hmmm. Is soccer the sport of choice for hackers or has anyone done research on website hacks for other events like the Olympics? 
Whoopty
50%
50%
Whoopty,
User Rank: Moderator
7/18/2014 | 11:18:23 AM
World Cup
There's something about as final, when you know you're watching the best of the best that gets people excited. I'm no big football fan but I watched a few minutes of the final. Perhaps hackers are the same. 
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
7/18/2014 | 9:56:10 AM
Re: More world cups>
=) No, but several of us (her former 'mates) are planning to attend a match or two next year. 
Page 1 / 2   >   >>
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5242
Published: 2014-10-21
Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter in a get_template action.

CVE-2012-5243
Published: 2014-10-21
functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request.

CVE-2012-5702
Published: 2014-10-21
Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) callback parameter in a color_selector action, (2) field parameter in a date_format action, or (3) company_name parameter in an addedit action to i...

CVE-2013-7406
Published: 2014-10-21
SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2531
Published: 2014-10-21
SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.14 build 577 allows remote authenticated users to execute arbitrary SQL commands via the i parameter in a search action to the (1) NodeWorx , (2) SiteWorx, or (3) R...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.