Risk
11/27/2012
01:31 AM
Connect Directly
RSS
E-Mail
50%
50%

Evolving DDoS Attacks Force Defenders To Adapt

Distributed denial-of-service attacks get bigger and combine application-layer exploits, requiring defenders to be more agile

In the past, attackers using distributed denial-of-service (DDoS) attacks to take down websites or network servers typically adopted one of two tactics: flooding the site with a deluge of data, or overwhelming an application server with seemingly valid requests.

Companies concerned about denial-of-service (DoS) attacks have generally focused more on mitigating data floods, also known as volumetric or infrastructure attacks. Yet, increasingly, attackers are employing a hybrid approach, using multiple vectors to attack. The attacks that hit financial firms in September and October, for example, often used a massive flood of data packets that would overwhelm a victim's network connection, while a much smaller subset of traffic would target vulnerable applications functions, consuming server resources.

"It is almost like sending a whole squadron of tanks and then have an assault team that can go in and be more stealthy in taking out their targets," says Carlos Morales, vice president of global sales engineering and operations for network protection firm Arbor Networks. "It broke the model that people had for stopping these things."

The one-two punch is potent. Many financial firms thought they had defenses in place to defeat such attacks, but had problems staying accessible during the onslaught. Companies prepared to handle application-layer attacks or smaller volumetric attacks could not handle the 20 Gbps or more that saturated their Internet connections. Even a gateway that can keep up with a 10-Gbps connection speed cannot deal with twice as much -- or more -- traffic sent to the same server.

[The distributed denial-of-service (DDoS) attacks that caused disruptions at major banks did not emanate from the widespread home computers of hacktivists, but from hundreds to thousands of servers running vulnerable content management software. See Serious Attackers Paired With Online Mob In Bank Attacks.]

A recent report from network-security firm Prolexic found that the average attack bandwidth had increased to nearly 5 Gbps, with 20-Gbps attacks quite common. In a year, the average volume of attacks had doubled, the firm found.

"The late Sen. Ted Stevens got mocked for saying that the Internet is a 'series of tubes,'" says Matthew Prince, CEO of Cloudflare, a content-delivery and network-security firm. "But the Internet is a series of tubes, and you can only fit so much through it."

Companies must start creating a multilayered approach to stopping DDoS attacks, according to mitigation experts. The greatest amount of attack volume should be stopped inside of a provider's network, away from the company's links to the Internet. Trying to overprovision your network for the worst-case scenario will likely not work and will be very expensive, to boot.

"Even if you are a large bank in the U.S., you are doing less than 10 Gbps of traffic across all the properties of your network combined," Cloudflare's Prince says. "If you have to overprovision that by 10x, that is wasting a lot of resources."

By using a service provider to filter out most of the spurious traffic at the edge of the Internet, companies can pay attention to the data that actually enters their networks. Collecting information on the traffic can help a company to better develop defenses for future attacks as well, even if a company does not have the resources to identify attacks in real time.

Yet faster detection and more agile response can mean the difference between successful defenses and downtime.

"Seeing an impact and understanding that there is an attack happening is not necessarily going to happen at the same time," says Neal Quinn, chief operating officer for attack-mitigation service Prolexic.

For many companies, the threat of attacks is not over, but, rather, just beginning. The most recent attacks did not start with the financial industry; other industries have been hit by similar attacks for almost the past year. Companies should not expect it to end there, either. The holiday season tends to be a popular time for attackers to attempt to extort money from retailers by threatening DoS attacks.

"It is traditionally a very busy time of year for these attacks," Quinn says. "If anything, organizations should make themselves more aware of how well they can handle these attacks."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.