Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Will Cloud Signaling Contain DDoS Attacks?

Arbor Networks' "Bat-signal" for distributed denial of service attacks culls your network service provider's resources to help stop it.

Is a distributed denial of service (DDoS) attack crippling your corporate network? Then signal your upstream service provider so it can filter out the attack using carrier-grade equipment.

That's the premise of "cloud signaling," which is a set of technical capabilities and mitigation strategies offered by network security vendor Arbor Networks. Announced in May, Arbor released the first related product in August, named Pravail, which it bills as an availability protection system.

A business that's already purchased DDoS defenses can typically mitigate small attacks, but those that flood the network pipe, or target the application level--including intrusion prevention systems and firewalls--may be much more difficult to stop. That's where cloud signaling comes in. "You can either set it to automatically signal your upstream provider, kind of like a Bat-signal--help me--and it will send help, sending all of the [attack] parameters" to the carrier, said Rob Malan, CTO of Arbor Networks, in an interview. Alternately, Pravail users can trigger the signaling manually.

[Businesses aren't ready to defend against the rising tide of sophisticated cyber attacks. Learn more: Advanced Threats Touch Two-Thirds Of Enterprises.]

Calling in the service provider brings carrier-grade packet-scrubbing power to bear on attacks, which means the attacks can be more easily eradicated by the service provider. "So maybe you've got one to 10 gigs of mitigation protection at the enterprise edge, but you have hundreds of gigs of mitigation protection at the carrier," said Malan.

He said the idea for cloud signaling arose during a late-night Denny's discussion he had with his Arbor co-founder, Farnam Jahanian, who now heads the National Science Foundation's computer & information science & engineering directorate. They hit upon the idea of "being able to hit a 'big red button' at the target of the DDoS attack, and signal all the way back upstream to the sources of the attack, automatically protecting the target."

But that discussion happened in 1999; what took 11 years for the idea to become reality? "While we always wanted to do this, you can't make a living selling a promise that it will be great in 10 years. So we needed to get a large install base," said Malan.

"The first major problem was getting the tool into all the carriers' hands so they could do coordinated troubleshooting. The second was getting it into the hands of the enterprise, so they could do coordinated troubleshooting back to the carrier. Once you have that infrastructure covered, you can hook them all together, all the way back to the carrier," he said.

One related step along this path was the Fingerprint Sharing Alliance, launched in 2002 as a way for network providers to share information with each other about large-scale attacks in progress. From there, it wasn't a big leap to having downstream customers share information about attacks that targeted their specific infrastructure.

Recent changes in DDoS attacks have also created an impetus for such information sharing. "The attacks changed in the last couple of years," said Malan. "Some kinds of attacks, you have to see the packets in line, and the only scalable way to do that is at the enterprise or data center edge--you can't sit up in the cloud and look at every packet, it's too packet-intensive; you've got to distribute that to the enterprise."

But when those defenses located at the edge of a business' infrastructure detect an attack, they can't always stop it. Notably, research from Arbor has found that the average DDoS attack bandwidth increased by 102% during 2010, and rose by 1,000% from 2005 to 2010.

When attackers do attempt to DDoS a business, it typically wouldn't take a data center operator long to pick up the phone and call their carrier, seeking a way to mitigate the attack. But with Pravail, said Malan, the process can be entirely automated, and attack signatures passed upstream at the first hint of trouble. That increases the chance that not only will the attack get quickly blocked, but also that the business won't even see an outage.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18216
PUBLISHED: 2019-10-20
** DISPUTED ** The BIOS configuration design on ASUS ROG Zephyrus M GM501GS laptops with BIOS 313 relies on the main battery instead of using a CMOS battery, which reduces the value of a protection mechanism in which booting from a USB device is prohibited. Attackers who have physical laptop access ...
CVE-2019-18214
PUBLISHED: 2019-10-19
The Video_Converter app 0.1.0 for Nextcloud allows denial of service (CPU and memory consumption) via multiple concurrent conversions because many FFmpeg processes may be running at once. (The workload is not queued for serial execution.)
CVE-2019-18202
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
CVE-2019-18209
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
CVE-2019-18198
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.