Bloody June: What’s behind last month’s DDoS attacks?
Bloody June: What’s behind last month’s DDoS attacks?
June’s large-scale DDoS activity is the child of many
different parents.
By Jon Gold
NetworkWorld | Jul 7, 2014 12:44 PM
The list of DDoS attacks in the month of June has made
for grim reading. High-profile sites have been targeted by extortion demands,
online games got disrupted and at least one company was put out of business as
a direct result.
While it’s tempting to look for a single cause at the
root of this apparent tsunami of distributed denial-of-service activity, the
reality is considerably more complex. Online activism, the profit motive and
even potential nation-state activity contributed to June’s high volume of DDoS
attacks.
The only commonality, in fact, may be the ease with which
DDoS attacks can be launched.
Experts like Molly Sauter, an academic and author of the
forthcoming book The Coming Swarm, say that the process is childishly simple.
“Literally, if you have a credit card and if you’re
bored, it could be anyone,” Sauter told Network World. “It’s so easy to rent a
botnet – most of them are out of Russia – and you can rent one for stupid
cheap, and then deploy it for a couple of hours, and that’s really all you need
to target a major site like Feedly or Evernote.”
Sauter’s research focuses on the socio-political aspects
of technology. She highlights the attacks, earlier in June, on websites
connected to the World Cup’s sponsors and backers, which used the iconography
of Anonymous.
“I’m seeing a lot of Anonymous-oriented DDoS actions,”
she said. Anonymous, according to Sauter, is a useful “brand” for politically
motivated DDoS attacks, allowing groups to identify themselves with a particular
flavor of political thought, despite no organizational connection to other
activists.
But the highest-profile attacks in the U.S. this June
were not politically motivated – the DDoS attempts that took down RSS reader
Feedly and note-taking and personal organization service Evernote drew big
headlines, and Feedly, at least, was asked for ransom by its attackers.
Feedly didn’t pay up, and, according to Forrester
principal analyst Rick Holland, that’s probably for the best.
“There’s no guarantee that they’re not going to continue
to DDoS you,” he said. “It’s like regular extortion – you start paying people
off and then, suddenly, they’re going to keep coming back to you every month.”
Holland stopped short of urging a blanket refusal to pay
off DDoS extortionists, however, saying that companies need to decide their own
cases for themselves, in close consultation with their legal teams. He doesn’t
know of any companies that have paid a DDoS ransom, but said that it wouldn’t
surprise him to learn that it has happened.
“I wouldn’t be surprised if people have gotten DDoS, it
didn’t go public, they paid a ransom and that was that, but I have not
specifically had those conversations,” he said.
IDC research manager John Grady said that the increasing
primacy of online services means that extortion-based DDoS attacks are becoming
a more serious threat.
“When there are direct ties from resource availability to
revenue, targeting availability is a quick way to get someone's attention,” he
said.
Grady echoed both Sauter’s point about the general
cheapness of botnets and Holland’s argument that paying the ransom doesn’t make
a company proof against further attacks. What’s more, he said, the growing
power of some types of attack swings the balance of power further in favor of
the attackers.
“Increasingly, the ease of amplifying attacks through DNS
or NTP, which can ramp traffic up in the hundreds of gigabit range that we've
seen become common, gives attacks real economies of scale,” Grady said.
Research from Forrester shows that, in addition to
volumetric attacks like DNS and NTP (which essentially flood targets with
unwanted data), targeted application-level attacks have been on the rise.
Application-level incidents had been seen by 42% of DDoS victims surveyed in a
2013 report – just shy of the 44% that suffered volumetric attacks. Moreover,
37% used some combination of techniques.
According to a report from Infonetics, that trend has
prompted increasing attention for application-level mitigation technology.
“An increasing number of application-layer attacks, which
older DDoS detection and mitigation infrastructure can’t identify and block,
are forcing companies to make new investments in DDoS solutions,” wrote
principal security analyst Jeff Wilson in December.
What this means is that a DDoS attack, whether it’s
motivated by politics or money, is an increasingly unequal struggle. Attack
techniques have become easier, cheaper and more powerful at the same time as
their effects have become more damaging – and defensive measures have failed to
keep pace.
“The cost of entry is very low for the attackers and the
cost to defend is very high for the targets,” said Holland.
He said that the best defense may be to simply be as
forewarned as possible, and to make plans in advance for potential DDoS
incidents. Many businesses haven’t even considered the potential ramifications
of a DDoS.
“I’m surprised that many of my clients that have some
kind of online service – be it a business-to-consumer service, business-to-business
service – they don’t know how much 10 minutes of outage would cost them. So
when I talk to customers, that’s always one of the first questions I ask them,”
he said. “You need to have a playbook set up, basically.”
Comments
Post a Comment