Recently there has been an almost constant feed of news around distributed denial of service (DDoS) attacks, with banks, gaming organisations, governments, educational establishments and e-commerce vendors all being attacked. The DDoS threat has evolved considerably over recent years, with significant changes in the frequency and scale of attacks, and the motivations of cyber criminals. And, over a similar period, many organisations have become highly dependent on the availability of Internet services for their business continuity.
The end of 2014 and beginning of this year has seen a dramatic increase in DDoS attack activity with possibly the most concentrated storm of large attacks that has ever been seen on the Internet. The majority of these attacks leveraged a reflection amplification technique using the Network Time Protocol (NTP), with large numbers of significant attacks being detected all around the world.
Reflection amplification is a technique that allows an attacker to both magnify the amount of traffic they can generate, and obfuscate the original sources of that attack traffic. This technique relies on two unfortunate realities: firstly, around a half of service providers do not implement filters at the edge of their network to block traffic with a ‘forged’ (spoofed) source IP address; secondly, there are plenty of poorly configured and poorly protected devices on the Internet providing UDP services that offer an amplification factor between a query sent to them and the response which is generated.
Historically, DNS servers have been the most frequently utilised by attackers for reflection amplification, and in fact the largest attack ever seen on the Internet prior to 2014 was generated in this way – 309 Gbps, targeting Spamhaus in March 2013. However, in the latter part of 2013 and most of 2014, NTP has seen significant use with very large numbers of attacks in February and March 2014.
NTP is normally used to synchronise the clocks between devices on the Internet. This takes place with very little traffic, but some NTP servers have administrative functions open to the Internet and these offer very good (100s of times) amplification factors for attackers. Attacks leveraging NTP have been around for years on a small scale, but they really came into focus in late 2013. A number of gaming operators were targeted and news quickly spread, with plentiful media coverage of the successful attacks and the methodology used. Attack tools quickly circulated through the attacker community along with lists of servers generating good amplification factors, and even DDoS services started offering NTP reflection amplification as an option.
Arbor’s ATLAS system, which monitors events from 300+ network operators around the world, detected a new largest DDoS attack – 325Gbps, targeting a gaming operator in February 2014 – but it is the sheer of number of large attacks that is interesting. In Q1-Q3 2013 Arbor tracked 11 events over 100Gbps; in the same period of 2014 this had risen to 133. And, further down the scale (in terms of attack size) there was astonishing growth e.g. ATLAS tracked 1.5x the total number of attacks over 20Gbps in 2013 in just the first quarter of 2014.
However, NTP reflection amplification attacks started to reduce in April 2014 and although they are still significant they are not at previous levels. However, it appears that attackers have now moved on to Simple Service Discovery Protocol (SSDP). In Q2 only a handful of events utilising SSDP for reflection amplification were detected, in Q3 2014 Arbor’s ATLAS monitored nearly 30,000.
The use of large DDoS attacks to saturate the Internet connectivity of a target has been a key trend in 2013 and 2014, and this looks like it will continue in 2015. Attacks will likely continue to get larger and more frequent, and unfortunately many businesses are still unprepared for an attack. Any business that is reliant in any way on the Internet for day to day operations is at risk of attack, whether they derive revenue from the Internet, or simply use it to access cloud based data and application services, financial services and so on. The range of motivations behind attacks, and the ease which they can be generated, has made this a ubiquitous problem.
The answer is for Australian businesses to implement multi-layered DDoS protection solutions, using on-premise equipment coupled with cloud-based services. On premise DDoS protection solutions are able to proactively detect and mitigate all kinds of attacks, including the more stealthy application layer attacks (which represent about a fifth of attacks), but they cannot deal with large volumetric attacks which saturate Internet connectivity. To deal with these a cloud based service is needed, but these are often too slow to react to application and state-exhaustion attacks hence the need for the on-premise component. Ideally these two layers should work together and only then can Australian businesses get complete protection from the DDoS threat.
This article is brought to you by Enex TestLab, content directors for CSO Australia.
Upcoming IT Security Events
Feb 3rd, Feb 4th, Feb 6th 2015
Join @NirZuk #PaloAltoNetworks for Breakfast (lunch in Auckland) on keeping your enterprise safe from risk. Cyber attacks continue to increase in volume and sophistication leaving traditional security practices completely ineffective.
Register Today Seats are limited
March 3rd, March 5th, March 9th 2015
Read more: Record-pace app sales reinforce urgency of authorities' mobile app privacy push
Join CSO for the day@#csoperspectives and hear from @kimzetter @frankheidt
3 International Keynote speakers, 36 Key IT Security Industry Speaker, 21 Exhibitors, Security Analysts and many more.. Register today
Dont miss one of the biggest IT Security events in ANZ (registration is free, but seats are limited)