DDoS Attack Bandwidth Jumps 718%

Anonymous: 10 Things We Have Learned In 2013

The average bandwidth seen in distributed denial-of-service (DDoS) attacks has recently increased by a factor of seven, jumping from 6 Gbps to 48 Gbps. Furthermore, 10% of DDoS attacks now exceed 60 Gbps.

Those findings come from a new report released Wednesday by DDoS mitigation service provider Prolexic Technologies, which saw across-the-board increases in DDoS attack metrics involving the company's customers.

"Average packet-per-second rate and average bit rate spiked in the first quarter and both are growing at a fast clip," said Prolexic president Stuart Scholly in a statement. "When you have average -- not peak -- rates in excess of 45 Gbps and 30 million packets per second, even the largest enterprises, carriers and, quite frankly, most mitigation providers, are going to face significant challenges."

In the first three months of 2013, 77% of DDoS attacks targeted bandwidth capacity and routing infrastructure, while 23% were application-level attacks that didn't overwhelm targeted networks through packet quantity, but rather by disrupting critical applications or processes running on a server.

[ Congress has it wrong on cybersecurity. Read Laws Can't Save Banks From DDoS Attacks. ]

The report also found that between the fourth quarter of 2012 and the first quarter of 2013, the total number of attacks increased marginally -- by only 2% -- while attack duration increased by 7%, from 32.2 hours to 34.5 hours. But the greatest number of DDoS attacks continue to be launched from China, although the volume of such attacks has recently declined. While 55% of all attacks came from China at the end of last year, by March 2013 that had dropped to 41%, followed by the United States (22%), Germany (11%), Iran (6%) and India (5%).

The source of attacks doesn't mean that a country's government or even criminal gangs are directly responsible for launching DDoS campaigns. For example, the Operation Ababil bank disruption campaign being run by al-Qassam Cyber Fighters relies in part on hacking into vulnerable WordPress servers and installing such DDoS toolkits as "itsoknoproblembro" -- aka Brobot. Attackers then use command-and-control servers to issue attack instructions to the toolkits, thus transforming legitimate websites into DDoS launch platforms.

Given that situation, it's no surprise that China, the United States and Germany -- which all sport a relatively large Internet infrastructure -- are also tops for DDoS attack origin. But Prolexic's report said it's odd that Iran, which has a very small Internet architecture by comparison, should be the source of so many attacks. "This is very interesting because Iran enforces strict browsing policies similar to Cuba and North Korea," according to Prolexic's report.

As DDoS attack sizes increase, so do fears of an Armageddon scenario, in which the attack not only disrupts a targeted site, but every site or service provider in between. According to Prolexic's report, the largest single attack it's mitigated to date occurred in March, when an "enterprise customer" was hit with an attack that peaked at 130 Gbps. While that wasn't equal to the 300 Gbps attack experienced by Spamhaus, it still represents well more than most businesses can handle, unless they work with their service provider or third parties to build a better DDoS mitigation defense.

On that front, some businesses tap dedicated DDoS mitigation services from the likes of Arbor Networks, CloudFlare, Prolexic and Verisign.

"There are a number of DDoS mitigation technologies out there, and we see organizations that are deploying the technologies in their own infrastructure and in their own environments," as well as working with service providers, said Chris Novak, managing principal of the RISK Team at Verizon Enterprise Solutions, speaking recently by phone.

"Like so many things in the security space, the layered approach is the most effective for most organizations," he said.