Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

IoT, APIs, and Criminal Bots Pose Evolving Dangers

A pair of reports reach similar conclusions about some of the threats growing in cyberspace and the industries likely to be most affected.

A pair of research reports released today paint a picture of a cyberthreat landscape that is continuing to evolve in ways both expected and not. The reports, released by Netscout and Akamai, each look at the overall threat landscape from its own perspective and offer a slightly different view of what cybersecurity professionals face. Together, they reach similar conclusions about some of the threats growing in cyberspace and some of the industries likely to be most affected.

The "Netscout Threat Intelligence Report" focuses on large organizations, such as nation-state actors, and the the impact they're having on both statecraft and industries important to various nations. According to Richard Hummel, manager, Netscout Threat Intelligence, the number of groups working on behalf of national security organizations has skyrocketed.

"A couple of years ago, I would tell you that there were probably 35 to 40 different groups, and that's predominantly China, Iran, Russia — some of the really big names," he says. "But now with Netscout we're actively tracking at least 35 of these groups ourselves, and we know of at least 170 more different groups around the globe where you have these nation states adding cyberattack capabilities to their statecraft."

Those groups are growing in sophistication and broadening their target groups, as well. The report says academia, government, finance, and telecommunications are the targeted industries.

Another large and growing group of threat actors are criminal organizations that now have activities reaching around the globe. "The criminal organizations and the nation-state groups really have a lot of similarities," Hummel says. "They both have large-scale operations. They both have access to a lot of really skilled operators. They're able to throw money at their problems to fix it."

Those efforts are resulting in attacks that are both more frequent and larger in scale than those of last year or the year before.

In the distributed denial-of-service (DDoS) attack space alone, attacks were up 26%, according to the report. "Attacks in the 100–200 Gbps, 200–300 Gbps, and 300–400 Gbps [range] exploded, up 169 percent, 2,500 percent, and 3,600 percent, respectively," the report states.

Those attacks were aimed against strategic targets, with a "significant increase" in DDoS attacks on wireless telecommunications, satellite telecommunications, data processing, data hosting, television, libraries, and archive sites.

Akamai's "2019 State of the Internet" report points out that a growing number of these attacks are generated by networks populated by All-in-One bots, or AIOs. These bots can be rented to commercial clients for spamming inboxes or message clients, launching DDoS attacks, or credential stuffing. According to the Akamai report, the retail apparel market experienced 3.7 billion credential stuffing attempts in the eight months of 2018 used as the basis for the report.

Those attacks aren't coming from international actors, though the weapons used span the globe. "A lot of it's coming from Russia, a lot is coming from Canada, but it's largely Americans buying these botnets and running them against the sites," says Martin McKeay, security researcher and editorial director at Akamai.

The American criminals know their targets: McKeay says that 1.636 billion credential-stuffing attacks were launched against a single retail organization.

Both reports point out Internet of Things (IoT) devices as particularly vulnerable when it comes to recruitment into these criminal botnets. Netscout's report points out that IoT devices are especially vulnerable to brute-force attacks, since so many either have hard-coded user names and passwords or interfaces so primitive that they encourage owners to use simple credentials.

In Akamai's case, it uses data from its own network to show that API traffic, from IoT devices that range from smartwatches to televisions, now accounts for 83% of the traffic it sees versus 17% from browsers. While McKeay is quick to point out that not every network will see the traffic mix handled by Akamai, he does believe these broad analyses are applicable to the Internet as a whole and have significant implications for security.

Both Hummel and McKeay say the most important takeaways from their respective reports is the importance of cybersecurity professionals being aware of changing patterns so they can begin to deal with the implications. There's no indication, in either report, of the Internet becoming noticeably safer before the next version.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
Capital One Breach: What Security Teams Can Do Now
Dr. Richard Gold, Head of Security Engineering at Digital Shadows,  8/23/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15540
PUBLISHED: 2019-08-25
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
CVE-2019-15538
PUBLISHED: 2019-08-25
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a ...
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.