DDoS: Deceptive Denial Attacks

Distributed Denial of Service (DDoS) attacks are often quite unsophisticated, brute force attempts to disable a website or network by barraging it with traffic, but the damage they can do to victims can be considerable.

When it comes to DDoS attacks, it’s easy to get distracted by the record-breaking size of the latest attacks.  Like a strength tester fairground game, we are all mesmerised by the gigantic numbers involved as new DDoS attacks break previous records, such as the huge 470GBps attack on a Chinese gambling site earlier this year, or the reported 602GBps attack against the BBC last year.

But what do these numbers really mean? In truth, the increasingly sophisticated techniques that bad actors deploy are making the reported sizes of attacks increasingly redundant.

For example, amplification techniques can intensify the size of attacks and simultaneously mask the source of attack traffic. This means that a 100GBps attack with a small upscale of 10x could actually harness the same power as a terabit-sized attack, while a sub-saturating 2GBps attack which might not even be detected by your DDoS mitigation system could knock all your firewalls offline.

The vast majority of these attacks are less than five minutes in duration and under 1GBps in size. So why do they pose such a threat?

The truth is that hackers are using these small attacks to experiment with new techniques without being spotted by security teams. This is due to the fact that the majority of legacy DDoS mitigation tools can only be deployed out-of-band and are therefore limited to only inspecting events that cross certain bandwidth thresholds.

Additionally, since they rely on coarse sampling followed by traffic redirection, which takes time, these DDoS scrubbing solutions are only capable of investigating events of more than five minutes in duration, meaning that hackers can use short-lived and low-bandwidth attacks to trial the success of new techniques under the radar.

Once attackers have perfected their new methods in private, they can then wield enormous power by deploying these tactics at wide range. When executed, these strategies catch organisations on the back foot, because the techniques haven’t been seen before, security teams have not set up any firewall or DDoS protection rules to defend against them, and they are therefore left scrambling around trying to find a solution when an attack is already in place.

This is particularly concerning in light of the increased use of amplification techniques, which allow bad actors to intensify the size of their attacks, and to simultaneously mask the source of attack traffic.  Using this method, attackers typically spoof look-up requests to domain name system (DNS) servers to hide the source of an attack, and re-direct the response to their target.

By relaying the original request through a botnet, and utilising a high percentage of large packet fragments, an attacker can amplify the size of their attack to up to 100 times larger than its original size.

So how can organisations protect themselves?  

The first step to greater security is to familiarise yourself with the trends in the DDoS landscape and to start looking more closely at lower level activity within your environment.

Small-scale, sub-saturating DDoS attacks are truly the calm before the storm, and observing them in real-time is the best way to prepare your organisation from the plethora of new techniques that attackers are experimenting with.

Second, the most effective way to protect your organisation’s entire security infrastructure in the event of an attack is to have DDoS protection installed in-line, at the Internet edge.

This eliminates the need to manually analyze events and re-route traffic for cleaning, and ensures that the time from detection to mitigation of an attack shrinks to almost nothing. This type of protection can usually be purchased as-a-service through your Internet Service Provider, which allows customers to take advantage of the increased visibility of their entire network infrastructure.

Because it is always on, this type of automatic attack mitigation provides continuous visibility and forensics, and means that there is no need to resign ourselves to the ever-changing threat of DDoS attacks.

Information Age

 

« Internet of Insecure Things
Work Traveling - You’re a Prime Hacker Target »

ManageEngine
CyberSecurity Jobsite
Check Point

Directory of Suppliers

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

ZenGRC

ZenGRC

ZenGRC (formerly Reciprocity) is a leader in the GRC SaaS landscape, offering robust and intuitive products designed to make compliance straightforward and efficient.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

Advanced Resource Managers (ARM)

Advanced Resource Managers (ARM)

ARM provide specialist recruitment services for technology and engineering including cyber security.

CIO Dive

CIO Dive

CIO Dive provides news and analysis for IT executives in areas including IT strategy, cloud computing, cyber security, big data, AI, software, infrastructure, dev ops and more.

SGBox

SGBox

SGBox is a highly flexible and scalable solution for IT security. Choose the modules which your company needs and implement it without any modification to your network infrastructure.

Dice

Dice

Dice is a leading recruitment platform, helping technology professionals manage their careers and employers connect with highly skilled tech talent in specialist areas including cybersecurity.

OffSec

OffSec

OffSec have defined the standard of excellence in penetration testing training. Elite security instructors teach our intense training scenarios and exceptional course material.

NetSPI

NetSPI

NetSPI is an information security penetration testing and vulnerability assessment management advisory firm.

Palmchip

Palmchip

Palmchip is a Cyber Security, SOC and Software consulting company. We design and develop high performance and secure applications.

ARIA Cybersecurity Solutions

ARIA Cybersecurity Solutions

The ARIA ADR Automatic Detection & Response solution was designed to find, verify, and stop all types of attacks - automatically and in real time.

Avalanchio Technologies

Avalanchio Technologies

The Avalanchio platform gives you a complete solution to collect, process, and analyze security data to detect threats in real-time and analyze historical data using security DSL or SQL.

Casepoint

Casepoint

Casepoint is the legal technology platform of choice for corporations, government agencies, and law firms to meet their complex eDiscovery, investigations, and compliance needs.

Hartman Executive Advisors

Hartman Executive Advisors

Hartman Executive Advisors is an unbiased IT and cyber advisory firm uniquely designed to help mid-market executives maximize their IT investments.

VAST Data

VAST Data

The VAST Data Platform delivers scalable performance, radically simple data management and enhanced productivity for the AI-powered world.

Health Sector Cybersecurity Coordination Center (HC3) - USA

Health Sector Cybersecurity Coordination Center (HC3) - USA

HC3 was created by the US Department of Health and Human Services to aid in the protection of vital, controlled, healthcare-related information.

National Cybersecurity Competence Center (NC3) - Luxembourg

National Cybersecurity Competence Center (NC3) - Luxembourg

The purpose of the is to strengthen the Country's ecosystem facing cyber Luxembourg National Cybersecurity Competence Centerthreats and risks.

Spektion

Spektion

Spektion are transforming how organizations meet the challenge of third-party software risk.

Greenway Solutions

Greenway Solutions

Greenway Solutions are trusted advisors relied upon by our clients to combat sophisticated adversaries in the fraud and security domain.