How Cybercriminals Attack The Cloud

[Excerpted from "How Cybercriminals Attack the Cloud," a new report posted this week on Dark Reading's Cloud Security Tech Center.]

The adoption of cloud-based computing shows no signs of slowing. Indeed, cloud services are expanding at an incredible rate across all sectors of the economy, with the market for public cloud services expected to grow to $210 billion by 2016, according to Gartner.

And it's no wonder: The cloud is a compelling proposition for businesses and government agencies alike, offering easy access to shared, elastically allocated computing resources. The model creates savings on capital expenditures and reduces the running costs of operating a network, allowing enterprises to focus more on their core operations instead of IT.

However, what makes cloud computing so attractive to businesses -- the sharing of resources to achieve economies of scale -- also makes the model attractive to cybercriminals.

Cloud services concentrate so much data in one place that they become very attractive targets, justifying a large investment in a hacker's time and resources. Recent researchby the European Network and Information Securit Agency has led it to warn, "The proliferation of cloud computing and the sheer concentration of users and data on rather few logical locations are definitely an attractive target for future attacks."

What types of attacks are most common against cloud environments? Volumetric attacks aim to overwhelm a network's infrastructure with bandwidth-consuming

traffic or resource-sapping requests.

State-exhaustion attacks, such as TCP SYN flood and idle session attacks, abuse the stateful nature of TCP to exhaust resources in servers, load balancers and firewalls. Several cloud providers saw their firewalls fail last year during DDoS attacks.

Techniques such as amplification magnify the amount of bandwidth that can be used to target a potential victim. Suppose an attacker is able to generate 100 Mbps of traffic with his botnet. This may inconvenience or block access to a small site, but it would not impact a well-protected cloud hosted site or service.

The attacker could go to a botnet herder to rent access to its botnet, but this could get expensive. The attacker also could use manual and automated coordination techniques similar to those used by the Anonymous group, which notifies fellow "anons" of the time to start an attack so that it's big enough to affect the victim's resources.

By using an amplification technique called DNS reflection, an attacker's botnet can send out a DNS query of about 60 bytes to an open recursive DNS resolver that will gener-ate a response message sent to the victim of up to 4,000 bytes, increasing the amount of attack traffic by a factor of more than 60. The DNS protocol is ideal for this type of attack because queries can be sent with a spoofed source address -- using User Datagram Protocol, which doesn't require a handshake -- and a DNS response is significantly larger than the query itself.

To learn more about the different types of attacks made on cloud computing environments -- and what you can do about them -- download the free report.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.