10 Massive Security Breaches

Between the first and second half of 2010, distributed denial-of-service (DDoS) attacks grew to surpass SQL injection attacks as the number-one attack vector against large businesses and organizations, according to a report from information security vendor Trustwave.

The study released Monday found that the principle drivers for Web attacks appear to be to causing Web site downtime (in 33% of cases), defacement (15%), stealing information (13%), planting malware to infect end clients (9%), and spreading disinformation (9%).

Despite the prevalence of downtime, most attacks appear to be profit-driven, and the Trustwave study found that attack outcomes largely mirrored this goal. For financial sector organizations, for example, 64% of attacks resulted in monetary loss, with 59% of firms admitting that they lacked robust enough authentication, and 36% saying that they'd been hacked using stolen credentials. Meanwhile, in the retail sector, 27% of attacks resulted in credit card data leakage, and SQL injection attacks were the principle method of attack.

Likewise, government Web sites most frequently fell due to SQL injection attacks (used in 24% of cases) and because of improper Web application input handling (for 26% of organizations). Thankfully, the principle outcome (in 26% of cases) was only Web site defacement.

As noted, DDoS attacks have become the principle hacking technique (in 32% of cases), followed by SQL injection (21%) and cross-site scripting (9%). Brute force, cross-site request forgery, process automation, and known vulnerability attacks were also seen, though less frequently.

Unfortunately, DDoS attacks are becoming harder to stop. In particular, newer types of attacks often target the Web application layer. Instead of overwhelmingly a network with packets, attackers can employ a smaller number of specially crafted requests -- using HTTP, HTTPS, SMTP, FTP, and similar protocols -- to produce a denial of service. For example, Slowloris, a free tool released in 2009, uses time-delayed HTTP headers to prevent HTTP connections from expiring, until servers simply run out of bandwidth.

According to Trustwave's report, "the bottom line is that the overall amount of traffic needed to potentially take down a Web site is much less than is required to flood the network pipe leading to the Web server."

Trustwave isn't the first firm to spot the rise in DDoS attacks or variation in techniques. Last month, an Arbor Networks study blamed botnets for a noticeable increase in DDoS attack sophistication and frequency. Notably, it found that DDoS attack bandwidth increased by 102% during 2010, and rose by a staggering 1,000% from 2005 and 2010.