The last three months of 2016 witnessed significant advances in DDoS attacks. Methods are becoming more and more sophisticated, the array of devices being harnessed by botnets is increasingly diverse, while the attackers show off their capabilities by choosing bigger and more prominent targets. All this, and more, is covered by Kaspersky Lab’s experts in the Q4 2016 DDoS attack report.
In the fourth quarter of 2016, Kaspersky Lab’s DDoS Intelligence system reported bot-assisted DDoS attacks in 80 countries, compared to just 67 countries the previous quarter. The top ten countries with the largest number of DDoS victims also saw a change, with Germany and Canada replacing Italy and the Netherlands. Three countries from Western Europe (the Netherlands, the UK and France) remained among the top ten countries with the largest number of hosted C&C servers for a second quarter in a row, and were joined by Bulgaria and Japan in Q4.
The longest DDoS attack in the fourth quarter lasted for 292 hours (or 12.2 days), which was a record for 2016. The final quarter also saw the year’s record number of DDoS attacks in one day – 1,915 launched on 5 November.
Overall, Q4 2016 was rich in noteworthy DDoS attacks against a broad range of targets, including Dyn’s Domain Name System, Deutsche Telekom and some of Russia’s largest banks. These companies were among the first victims of a new trend – DDoS attacks launched via huge botnets made up of vulnerable IoT devices, of which Mirai is one example. The approach used by the creators of Mirai has provided the basis for numerous other botnets made up of infected IoT devices.
The increasing number of attacks involving IoT devices was just one of the major trends seen in Q4. Throughout the quarter, there was a significant decrease in the number of amplified DDoS attacks, which were popular in the first half of 2016. This is down to improved protection against such attacks and fewer vulnerable servers available to cybercriminals.
The niche vacated by amplified attacks is being filled by application layer attacks, including WordPress Pingback attacks. Detection of application layer attacks poses a much greater challenge because they imitate the activities of real users. The fact that these attacks are making more frequent use of encryption only serves to increase the level of risk. Encryption dramatically increases the effectiveness of DDoS attacks, complicating the process of filtering out “junk” from among the many legitimate requests due to the need to decrypt them.
Kaspersky Lab’s experts predict that the trends toward increasingly complex DDoS attacks and greater numbers of IoT botnets will continue in 2017.
“IoT devices have the potential to launch DDoS attacks of any complexity, including application layer and encrypted attacks. Given the effectiveness of IoT botnets, as well as the growing number of poorly protected IoT devices, we can reasonably predict an increase in the number of such attacks as well as their power and complexity. That means companies need to take care of their protection in advance, and take a scrupulous approach to choosing their DDoS attack filtration service,” comments Kirill Ilganaev, Head of Kaspersky DDoS Protection at Kaspersky Lab.
“Though attackers are widening their focus to include ever more prominent targets, small and medium sized businesses continue to be at great risk. SMBs and the channel cannot disregard the threat faced. DDoS attacks are now more readily available, easier to procure and more disruptive than ever before. We are working to help our channel partners prepare against this threat, both as a small business themselves as well as helping them educate and prepare their customers with easy to manage solutions,” comments Russ Madley, Head of B2B at Kaspersky Lab UK.
