DDoS attacks continue to escalate in both size and frequency

Arbor Networks released global DDoS attack data for the first six months of 2016 that shows a continuing escalation in the both the size and frequency of attacks.

Arbor’s data is gathered through ATLAS, a collaborative partnership with more than 330 service provider customers who share anonymous traffic data with Arbor in order to deliver an aggregated view of global traffic and threats. ATLAS data has also been utilized recently in Cisco’s Visual Networking Index Report and the Verizon Data Breach Incident Report.

Global DDoS activity

DDoS remains a commonly used attack type due to the ready availability of free tools and inexpensive online services that allow anyone with a grievance and an internet connection to launch an attack. This has led to an increase in both the frequency, size and complexity of attacks in recent years.

• ATLAS has observed an average of 124,000 events per week over the last 18 months.
• A 73% increase in peak attack size over 2015, to 579Gbps.
• 274 attacks over 100Gbps monitored in 1H 2016, versus 223 in all of 2015.
• 46 attacks over 200Gbps monitored in 1H2016, versus 16 in all of 2015.
• USA, France and Great Britain are the top targets for attacks over 10Gbps.

As Arbor’s Security Engineering & Research Team (ASERT) recently documented, large DDoS attacks do not require the use of reflection amplification techniques. LizardStresser, an IoT botnet was used to launch attacks as large as 400Gbps targeting gaming sites worldwide, Brazilian financial institutions, ISPs and government institutions. According to ASERT, the attack packets do not appear to be from spoofed source addresses – and no UDP-based amplification protocols such as NTP or SNMP were used.

When average is a problem

A 1 Gbps DDoS attack is large enough to take most organizations completely off line.

• Average attack size in 1H 2016 was 986Mbps, a 30% increase over 2015.
• Average attack size is projected to be 1.15Gbps by end of 2016.

“The data demonstrates the need for hybrid, or multi-layer DDoS defense,” said Darren Anstee, Arbor Networks Chief Security Technologist. “High bandwidth attacks can only be mitigated in the cloud, away from the intended target. However, despite massive growth in attack size at the top end, 80% of all attacks are still less than 1Gbps and 90% last less than one hour. On-premise protection provides the rapid reaction needed and is key against “low and slow” application-layer attacks, as well as state exhaustion attacks targeting infrastructure such as firewalls and IPS.”

Time for reflection

Reflection amplification is a technique that allows an attacker to both magnify the amount of traffic they can generate, and obfuscate the original sources of that attack traffic. As a result, the majority of recent large attacks leverage this technique using DNS servers, NTP, Chargen and SSDP. As a result, in 1H 2016:

• DNS is the most prevalent protocol used in 2016, taking over from NTP and SSDP in 2015.
• Average size of DNS reflection amplification attacks growing strongly.
• Peak monitored reflection amplification attack size in 1H 2016 was 480Gbps (DNS).