Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/19/2019
04:25 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

DDoS Attack Size Drops 85% in Q4 2018

The sharp decline follows an FBI takedown of so-called "booter," or DDoS-for-hire, websites in December 2018.

The average distributed denial-of-service (DDoS) attack size shrunk 85% in the fourth quarter of 2018 following an FBI takedown of "booter," or DDoS-for-hire, websites, in December 2018, researchers report.

Late last year, United States authorities seized 15 popular domains as part of an international crackdown on booter sites. Cybercriminals can use booter websites (also known as "stresser" websites) to pay to launch DDoS attacks against specific targets and take them offline. Booter sites open the door for lesser-skilled attackers to launch devastating threats against victim websites.

About a year before the takedown, the FBI issued an advisory detailing how booter services can drive the scale and frequency of DDoS attacks. These services, advertised in Dark Web forums and marketplaces, can be used to legitimately test network resilience but also make it easy for cyberattackers to launch DDoS attacks against an existing network of infected devices.

The shutdown of prominent booter sites made a pronounced difference in DDoS attack trends for the fourth quarter of 2018, researchers report in Nexusguard's DDoS Threat Report 2018 Q4. During the most recent quarter, the number of DDoS attacks fell nearly 11% year-over-year, and the maximum attack size decreased nearly 24%. The biggest difference was in attack size, which dropped 85%.

Booter sites are the origin for many DDoS attacks as they make it "fairly simple" for amateur hackers to take down websites, explains Donny Chong, product director at Nexusguard. While the shutdown of booter sites had a positive effect on DDoS trends year-over-year, the growing prevalence of the "bit-and-piece" technique caused attacks to grow quarter-over-quarter.

The bit-and-piece tactic avoids detection by injecting small pieces of malicious code into legitimate traffic across hundreds of IP prefixes, Chong explains. By using small bits of junk, adversaries avoid sounding the alarms that large traffic spikes would set off. Between third and fourth quarters of 2018, this method caused the number of attacks, and the maximum and average attack sizes, to increase 36%, 49%, and 3.75%, respectively, Nexusguard researchers found.

Nexusguard noticed the bit-and-piece trend emerge in the third quarter, when it was the focus of its threat report. Unlike in a typical DDoS attack, in which an actor identifies and targets a particular IP address, bit-and-piece attacks are spread across multiple IP addresses on the same prefix. Diffused traffic can cause service providers to miss large-scale DDoS attacks in progress.

SSDP Amplification Attacks Ramp Up
SSDP amplification attacks are the most popular bit-and-piece attack vector and increased by 3,122% year-over-year and 91.2% quarter-over-quarter, Nexusguard reports. This type of attack, which made up 48.3% of DDoS attacks overall, is launched over UDP via Universal Plug and Play devices (printers, webcams, routers, and servers, for example).

In SSDP amplification attacks, adversaries first scan exploitable devices and use botnets to send UDP packets with a target's spoofed IP address to UDP Port 1900 of all vulnerable devices. Devices "respond massively," researchers explain, and the target is overwhelmed with replies.

Will cybercriminals leverage bit-and-piece attacks in lieu of DDoS attacks following the booter site shutdown? "It's going to be very dependent on who they are attacking," says Chong. In the world of DDoS, where attackers really study their targets, some attacks could be more effective. He calls it a "cat-and-mouse" game between cyberattackers and defenders: Even as criminals adopt SSDP and UDP attacks, targets will start to catch on to their patterns and block them.

Chong believes DDoS-for-hire websites are sure to make a comeback. "Definitely," he notes, adding that the decline in DDoS attack size is likely to reverse itself in the future. "These booters represent only a surface of the entire problem. [They're] payment gateways, the shopping carts by which you activate those botnets." Further, he explains, the growth of consumer Internet of Things contributes to the number of vulnerable devices exposed to cyberattacks.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17185
PUBLISHED: 2019-12-09
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2019-12424
PUBLISHED: 2019-12-09
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2019-18380
PUBLISHED: 2019-12-09
Symantec Industrial Control System Protection (ICSP), versions 6.x.x, may be susceptible to an unauthorized access issue that could potentially allow a threat actor to create or modify application user accounts without proper authentication.
CVE-2019-19687
PUBLISHED: 2019-12-09
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, whic...
CVE-2019-19682
PUBLISHED: 2019-12-09
nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the ...