Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

8/14/2019
12:40 PM
50%
50%

Attackers Try to Evade Defenses with Smaller DDoS Floods, Probes

Cybercriminals are initiating more attacks using low-bandwidth techniques, but the tactics expand the gray area between DDoS attacks and popular methods of mass scanning.

Cybercriminals are increasingly targeting corporate networks, websites, and online services with low-bandwidth distributed denial-of-service (DDoS) attacks that exploit weaknesses in application infrastructure to disrupt business, Internet infrastructure firm Neustar stated in an August 14 threat report.

In its "Q2 2019 Cyberthreats & Trends" report, Neustar found that DDoS attacks using less than 5 Gbit/s make up a greater share of packet floods, with more than 75% of all attacks using less than 5 Gbit/s in the second quarter of 2019, up from less than 70% the previous year. The average attack consisted of a 0.99 Gbit/s stream of packets, so small that most companies may not notice the impact, says Michael Kaczmarek, vice president of product for Neustar Security.

"People think DDoS is going away," he says. "They think it is this unsophisticated brute-force attack, but by no means is it gone; it has just morphed."

Overall, DDoS attacks increased by 133%, more than doubling, according to Neustar's report. The trend is a reversal from last year, when security firms had documented a decrease in attacks for most of the year. The average attack also showed greater complexity, with 82% of attacks using two or more different threat vectors.

The different vectors aim to find a vulnerable spot in a company's infrastructure and abuse the weakness, Kaczmarek says.

"The attackers are getting more sophisticated in what they are targeting," he says. "They are going after not the most vulnerably guy, but the most vulnerable component of the infrastructure."

Most companies seem to have a pretty good response to attacks, however, with a quarter initiating DDoS mitigation within a minute and another 62% within five minutes. Only 11% of companies actually take longer than 5 minutes to respond to a DDoS attack.

In addition, companies are likely to detect multivector attacks, with only 14% of firms very unlikely or somewhat unlikely to notice smaller attacks.

Neustar argues in the report, however, that any response aside from "very likely to detect a smaller attack" is a security failure. "Fewer than 3 in 10 organizations are very likely to notice smaller multi vector attacks, suggesting that greater awareness would be beneficial," the company states in the report.

The study raises questions about what exactly can be defined as a distributed denial-of-service attack. The inclusion of much smaller attacks, of which seven in 10 companies are not certain to detect, suggests that DDoS attacks are merging with the standard tactic of scanning for vulnerabilities in security companies' lexicons. (The report appears to use a standard definition of DDoS as an attack that denies service.)

"The basic form and composition of the DDoS traffic may not have changed much, but the ability to precisely target these attacks has evolved markedly," the report states. "DDoS attacks can now be directed at specific services, gateways, applications, and Application Programming Interfaces (API), and as the target becomes smaller, less traffic is required to bring it down."

Most companies would likely, however, detect an interruption of service to some part of their infrastructure. Most of these attacks fall in the area of application-layer attacks, and not just denial of service, according to Kaczmarek, who included both credential-stuffing and SQL injection scans as potential examples.

"It could be the attack is targeting a specific resource that you were not aware of," he says. "It could be a billing app that is out there, or an API that is doing a communication between you and the bank. [Finding these attacks is] going to require a deeper investigation."

The upshot is that attackers are no longer focused on just denying service but on a range of goals that can be accomplished with scans, packet floods, and application attacks. For that reason, Internet infrastructure-security companies have followed suit with defenses.

"It goes back to the idea of what is valuable versus what is vulnerable," Kaczmarek says. "I may not notice these attacks immediately, but in the end, even the smaller ones will have a large impact overall."

Related Content

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
7 SMB Security Tips That Will Keep Your Company Safe
Steve Zurier, Contributing Writer,  10/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: The old using of sock puppets for Shoulder Surfing technique. 
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16330
PUBLISHED: 2019-10-17
In NCH Express Accounts Accounting v7.02, persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript.
CVE-2019-11253
PUBLISHED: 2019-10-17
Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming una...
CVE-2019-14423
PUBLISHED: 2019-10-17
A Remote Code Execution (RCE) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to execute system commands as root remotely via a simple HTTP request.
CVE-2019-14424
PUBLISHED: 2019-10-17
A Local File Inclusion (LFI) issue in the addon CUx-Daemon 1.11a of the eQ-3 Homematic CCU-Firmware 2.35.16 until 2.45.6 allows remote authenticated attackers to read sensitive files via a simple HTTP Request.
CVE-2019-15849
PUBLISHED: 2019-10-17
eQ-3 HomeMatic CCU3 firmware 3.41.11 allows session fixation. An attacker can create session IDs and send them to the victim. After the victim logs in to the session, the attacker can use that session. The attacker could create SSH logins after a valid session and easily compromise the system.