DDoS: Deceptive Denial Attacks

Distributed Denial of Service (DDoS) attacks are often quite unsophisticated, brute force attempts to disable a website or network by barraging it with traffic, but the damage they can do to victims can be considerable.

When it comes to DDoS attacks, it’s easy to get distracted by the record-breaking size of the latest attacks.  Like a strength tester fairground game, we are all mesmerised by the gigantic numbers involved as new DDoS attacks break previous records, such as the huge 470GBps attack on a Chinese gambling site earlier this year, or the reported 602GBps attack against the BBC last year.

But what do these numbers really mean? In truth, the increasingly sophisticated techniques that bad actors deploy are making the reported sizes of attacks increasingly redundant.

For example, amplification techniques can intensify the size of attacks and simultaneously mask the source of attack traffic. This means that a 100GBps attack with a small upscale of 10x could actually harness the same power as a terabit-sized attack, while a sub-saturating 2GBps attack which might not even be detected by your DDoS mitigation system could knock all your firewalls offline.

The vast majority of these attacks are less than five minutes in duration and under 1GBps in size. So why do they pose such a threat?

The truth is that hackers are using these small attacks to experiment with new techniques without being spotted by security teams. This is due to the fact that the majority of legacy DDoS mitigation tools can only be deployed out-of-band and are therefore limited to only inspecting events that cross certain bandwidth thresholds.

Additionally, since they rely on coarse sampling followed by traffic redirection, which takes time, these DDoS scrubbing solutions are only capable of investigating events of more than five minutes in duration, meaning that hackers can use short-lived and low-bandwidth attacks to trial the success of new techniques under the radar.

Once attackers have perfected their new methods in private, they can then wield enormous power by deploying these tactics at wide range. When executed, these strategies catch organisations on the back foot, because the techniques haven’t been seen before, security teams have not set up any firewall or DDoS protection rules to defend against them, and they are therefore left scrambling around trying to find a solution when an attack is already in place.

This is particularly concerning in light of the increased use of amplification techniques, which allow bad actors to intensify the size of their attacks, and to simultaneously mask the source of attack traffic.  Using this method, attackers typically spoof look-up requests to domain name system (DNS) servers to hide the source of an attack, and re-direct the response to their target.

By relaying the original request through a botnet, and utilising a high percentage of large packet fragments, an attacker can amplify the size of their attack to up to 100 times larger than its original size.

So how can organisations protect themselves?  

The first step to greater security is to familiarise yourself with the trends in the DDoS landscape and to start looking more closely at lower level activity within your environment.

Small-scale, sub-saturating DDoS attacks are truly the calm before the storm, and observing them in real-time is the best way to prepare your organisation from the plethora of new techniques that attackers are experimenting with.

Second, the most effective way to protect your organisation’s entire security infrastructure in the event of an attack is to have DDoS protection installed in-line, at the Internet edge.

This eliminates the need to manually analyze events and re-route traffic for cleaning, and ensures that the time from detection to mitigation of an attack shrinks to almost nothing. This type of protection can usually be purchased as-a-service through your Internet Service Provider, which allows customers to take advantage of the increased visibility of their entire network infrastructure.

Because it is always on, this type of automatic attack mitigation provides continuous visibility and forensics, and means that there is no need to resign ourselves to the ever-changing threat of DDoS attacks.

Information Age

 

« Internet of Insecure Things
Work Traveling - You’re a Prime Hacker Target »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

ON-DEMAND WEBINAR: Harnessing the power of Security Information and Event Management (SIEM)

ON-DEMAND WEBINAR: Harnessing the power of Security Information and Event Management (SIEM)

Join our experts as they give the insights you need to power your Security Information and Event Management (SIEM).

ON-DEMAND WEBINAR: 2024 and beyond: Top six cloud security trends

ON-DEMAND WEBINAR: 2024 and beyond: Top six cloud security trends

Learn about the top cloud security trends in 2024 and beyond, along with solutions and controls you can implement as part of your security strategy.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Sophos

Sophos

Sophos is a worldwide leader in next-generation cybersecurity, protecting more than 400,000 organizations of all sizes in more than 150 countries from today’s most advanced cyberthreats.

RedTeam Security

RedTeam Security

RedTeam Security is a provider of Penetration Testing, Social Engineering, Red Teaming and Red Team Training services.

CyberPolicy

CyberPolicy

CyberPolicy is a cyber protection solution for small businesses. It combines three important components against cyber threats - Cyber Plan, Cybersecurity and Cyber Insurance.

Junglemap

Junglemap

Junglemap provide nanolearning training courses on ransomware, information security and GDPR.

Signifyd

Signifyd

Signifyd is the world's largest provider of Guaranteed e-Commerce Fraud Protection.

Seqrite

Seqrite

Seqrite offers a highly advanced range of enterprise and IT security solutions to protect your organization's most critical data.

Swarmnetics

Swarmnetics

Swarmnetics helps customers discover hard-to-find software vulnerabilities by hacking your system before the bad guys do.

Nucleus Security

Nucleus Security

Nucleus is a leading Vulnerability Management platform for Large Enterprises, MSPs/MSSPs, and Application Security Teams that want more from their vulnerability management tools.

iTechArt Group

iTechArt Group

iTechArt is a top-tier custom software development company offering Cybersecurity Consulting, Application Security Testing, Risk Management and Compliance, and Infrastructure Security services.

Darkbeam

Darkbeam

Darkbeam provides a unified solution to protect against security, brand and compliance risks across your digital infrastructure.

FDD Center on Cyber and Technology Innovation (CCTI)

FDD Center on Cyber and Technology Innovation (CCTI)

The Foundation for Defense of Democracies is a nonprofit research institute focusing on foreign policy and national security. Ares of focus include cyber security and technology innovation.

SecureTech360

SecureTech360

SecureTech360 is a cybersecurity and IT consulting firm whose principals have extensive experience in Cybersecurity and Information Technology.

Encova Insurance

Encova Insurance

Encova’s cyber liability coverage protects you and your customers in case of a security breach in your company's data.

Qeros

Qeros

Qeros is a next-generation distributed system enables secure data and transaction processing at the velocity of thought.

Privasee

Privasee

Make GDPR compliance simple with Privasee. Our software makes it easy to protect your data and ensure you’re compliant with the new regulations.

Cyberlocke

Cyberlocke

Cyberlocke is dedicated to finding inventive solutions to meet the distinct IT obstacles of each organization we support.