sb-eu logo
Story image

Azure platform exploited the most for DDoS attacks – report

12 Sep 2018

DDoS attackers are increasingly abusing public cloud services to launch attacks, according to new research from Link11, the cloud anti-DDoS vendor.

Data from Link11’s security operation centre (SOC) shows that a quarter of all DDoS attacks in Europe in the 12 months from July 2017 to June 2018 used public cloud server-based botnets, compared to 18.5% in the previous 12 months – a 35% increase.

During the 12 months to June 2018, Microsoft Azure was the cloud service most exploited for DDoS attacks, with 38.7% of such attacks using Azure servers on average. 

Amazon Web Services (AWS) was used in 32.7% of attacks on average, and Alibaba servers used in 17.9% of attacks.

Google servers were abused much less often, used in only 10.7% of attacks. 

According to Link11, public cloud server-based botnets are the ideal platform for launching DDoS attacks.

Cloud instances generally offer bandwidths of between 1 and 10 Gbps, enabling attack volumes which can be as much as 1000 times higher than is possible with individual compromised devices such as home routers or IoT cameras.

The SOC reported that the peak attack volumes of these cloud-based attacks exceeded 150 Gbps in May.

Cloud servers provide Memcached or SSDP services, which amplify attack volumes.

Link11 UK and Ireland regional director Aatish Pattni says, “The people behind DDoS attacks are embracing the use of public cloud services for the same reasons as legitimate organisations: the services provide flexible, on-demand capacity and resources, and can be provisioned in just a few minutes. 

“For threat actors, the benefits are even more compelling because they will often use stolen credit card details and false identities to pay for the services.

“This makes the perpetrators almost impossible to trace, even though providers such as Amazon are taking strong action against misuse and asking users to report any suspected abuse of their services.”

To protect against DDoS attacks launched using public cloud services, blocking traffic from these services is not an option for many organisations because they will already be using the public cloud as part of their own IT infrastructures.  

Instead, organisations should analyse in detail the communication between public cloud services and their own network, and monitor for malicious or unwanted traffic.

Ongoing analysis of data traffic using artificial intelligence techniques enables legitimate traffic to be profiled and fingerprinted so that any changes can be detected quickly and reliably. 

The malicious traffic can then be filtered out in a granular manner before it can impact the organisation’s business, without blocking legitimate traffic.

Story image
Just 6,000 accounts responsible for over 100,000 email attacks - report
Barracuda has today released a report detailing how 6,170 malicious accounts that use Gmail, AOL, and other email services were responsible for more than 100,000 business email compromise (BEC) attacks on nearly 6,600 organisations. More
Story image
Increased demand for cloud computing as organisations look to achieve business continuity - Aruba
The increase in remote working has also created a focus on cyber security for all businesses.More
Story image
Why greater network visibility is needed to reduce the threat posed by IoT in the enterprise
At home and abroad, organisations have joined the rush to embrace Internet of Things (IoT) technology, but a new survey shows they’re only just beginning to wake up to the enormous risk those devices pose, writes ExtraHop A/NZ Regional Sales Manager Glen Maloney.More
Story image
Forescout and Arista Networks embark on new Zero Trust security partnership venture
Forescout and Arista Networks have come together to deliver Zero Trust security and greater device visibility and enforcement across heterogeneous networks.More
Story image
DDoS attacks surge 542% amidst COVID-19 pandemic - report
Generally considered the “off season” for DDoS attacks, researchers attribute the surge in incidents to malicious efforts during the COVID-19 pandemic.More
Story image
Adobe, IBM and Red Hat partner up to accelerate DX and real-time data security
"As companies undergo their digital transformations and move core workloads to the cloud, the entire C-suite is facing a re-framing of their roles to meet customer demands – all while keeping security front and centre."More