Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/19/2019
04:25 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

DDoS Attack Size Drops 85% in Q4 2018

The sharp decline follows an FBI takedown of so-called "booter," or DDoS-for-hire, websites in December 2018.

The average distributed denial-of-service (DDoS) attack size shrunk 85% in the fourth quarter of 2018 following an FBI takedown of "booter," or DDoS-for-hire, websites, in December 2018, researchers report.

Late last year, United States authorities seized 15 popular domains as part of an international crackdown on booter sites. Cybercriminals can use booter websites (also known as "stresser" websites) to pay to launch DDoS attacks against specific targets and take them offline. Booter sites open the door for lesser-skilled attackers to launch devastating threats against victim websites.

About a year before the takedown, the FBI issued an advisory detailing how booter services can drive the scale and frequency of DDoS attacks. These services, advertised in Dark Web forums and marketplaces, can be used to legitimately test network resilience but also make it easy for cyberattackers to launch DDoS attacks against an existing network of infected devices.

The shutdown of prominent booter sites made a pronounced difference in DDoS attack trends for the fourth quarter of 2018, researchers report in Nexusguard's DDoS Threat Report 2018 Q4. During the most recent quarter, the number of DDoS attacks fell nearly 11% year-over-year, and the maximum attack size decreased nearly 24%. The biggest difference was in attack size, which dropped 85%.

Booter sites are the origin for many DDoS attacks as they make it "fairly simple" for amateur hackers to take down websites, explains Donny Chong, product director at Nexusguard. While the shutdown of booter sites had a positive effect on DDoS trends year-over-year, the growing prevalence of the "bit-and-piece" technique caused attacks to grow quarter-over-quarter.

The bit-and-piece tactic avoids detection by injecting small pieces of malicious code into legitimate traffic across hundreds of IP prefixes, Chong explains. By using small bits of junk, adversaries avoid sounding the alarms that large traffic spikes would set off. Between third and fourth quarters of 2018, this method caused the number of attacks, and the maximum and average attack sizes, to increase 36%, 49%, and 3.75%, respectively, Nexusguard researchers found.

Nexusguard noticed the bit-and-piece trend emerge in the third quarter, when it was the focus of its threat report. Unlike in a typical DDoS attack, in which an actor identifies and targets a particular IP address, bit-and-piece attacks are spread across multiple IP addresses on the same prefix. Diffused traffic can cause service providers to miss large-scale DDoS attacks in progress.

SSDP Amplification Attacks Ramp Up
SSDP amplification attacks are the most popular bit-and-piece attack vector and increased by 3,122% year-over-year and 91.2% quarter-over-quarter, Nexusguard reports. This type of attack, which made up 48.3% of DDoS attacks overall, is launched over UDP via Universal Plug and Play devices (printers, webcams, routers, and servers, for example).

In SSDP amplification attacks, adversaries first scan exploitable devices and use botnets to send UDP packets with a target's spoofed IP address to UDP Port 1900 of all vulnerable devices. Devices "respond massively," researchers explain, and the target is overwhelmed with replies.

Will cybercriminals leverage bit-and-piece attacks in lieu of DDoS attacks following the booter site shutdown? "It's going to be very dependent on who they are attacking," says Chong. In the world of DDoS, where attackers really study their targets, some attacks could be more effective. He calls it a "cat-and-mouse" game between cyberattackers and defenders: Even as criminals adopt SSDP and UDP attacks, targets will start to catch on to their patterns and block them.

Chong believes DDoS-for-hire websites are sure to make a comeback. "Definitely," he notes, adding that the decline in DDoS attack size is likely to reverse itself in the future. "These booters represent only a surface of the entire problem. [They're] payment gateways, the shopping carts by which you activate those botnets." Further, he explains, the growth of consumer Internet of Things contributes to the number of vulnerable devices exposed to cyberattacks.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
6 Top Nontechnical Degrees for Cybersecurity
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/21/2019
Anatomy of a BEC Scam
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18610
PUBLISHED: 2019-11-22
An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary syste...
CVE-2019-9536
PUBLISHED: 2019-11-22
Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'. An attacker with physical access to the device can install arbitrary firmware.
CVE-2013-6811
PUBLISHED: 2019-11-22
Multiple cross-site request forgery (CSRF) vulnerabilities in the D-Link DSL-6740U gateway (Rev. H1) allow remote attackers to hijack the authentication of administrators for requests that change administrator credentials or enable remote management services to (1) Custom Services in Port Forwarding...
CVE-2013-6880
PUBLISHED: 2019-11-22
Open redirect in proxy.php in FlashCanvas before 1.6 allows remote attackers to redirect users to arbitrary web sites and conduct cross-site scripting (XSS) attacks via the HTTP Referer header.
CVE-2019-15652
PUBLISHED: 2019-11-22
The web interface for NSSLGlobal SatLink VSAT Modem Unit (VMU) devices before 18.1.0 doesn't properly sanitize input for error messages, leading to the ability to inject client-side code.