Story image

DDoS attacks combining new and tried-and-true techniques

02 Aug 2018

In the second quarter of 2018, DDoS botnets attacked online resources in 74 countries, according to a Kaspersky Lab report on botnet-assisted DDoS attacks.

For the first time in the history of DDoS Intelligence reports, Hong Kong found itself among the top three most attacked countries, coming second: its share increased fivefold and accounted for 17% of all botnet-assisted DDoS attacks.

China and the US remained first and third respectively, while South Korea slid down to fourth.

The most attacked resources in Hong Kong were hosting services and cloud computing platforms.

Interestingly, the second quarter saw Hong Kong replaced by Vietnam in the top 10 rating of countries hosting the most active C&C servers.

The US, meanwhile, became the leader of this rating, accounting for almost half (45%) of all active botnet C&C servers during the reporting period.

Activity by Windows-based DDoS botnets decreased almost sevenfold, while the activity of Linux-based botnets grew by 25%.

This resulted in Linux bots accounting for 95% of all DDoS attacks in the quarter, which also caused a sharp increase in the share of SYN flood attacks – up from 57% to 80%.

“There can be different motives for DDoS attacks – political or social protest, personal revenge, competition,” says Kaspersky DDoS protection team project manager Alexey Kiselev.

“However, in most cases, they are used to make money, which is why cybercriminals usually attack those companies and services where big money is made.

During the reporting period, cybercriminals delved deep into the past and started using some very old vulnerabilities in their attacks.

For example, experts reported DDoS attacks involving a vulnerability in the Universal Plug-and-Play protocol known since 2001, while the Kaspersky DDoS Protection team observed an attack organised using a vulnerability in the CHARGEN protocol that was described as far back as 1983.

Despite the considerable length of service and the protocol’s limited scope, many open CHARGEN servers can be found on the internet.

They are mostly printers and copiers.

However, the mastering of old techniques has not prevented cybercriminals from creating new botnets.

For example, in Japan 50,000 video surveillance cameras were used to carry out DDoS attacks.

One of the most popular methods of monetising DDoS attacks remains the targeting of cryptocurrencies and currency exchanges.

A typical case is that of Verge cryptocurrency which saw hackers attack some mining pools and steal 35 million XVGs in the ensuing confusion.

“DDoS attacks can be used as a smokescreen to steal money or to demand a ransom for calling off an attack,” Kiselev says.

“The sums of money gained as a result of extortion or theft can amount to tens or hundreds of thousands and even millions of dollars.”

Gaming platforms continue to be targeted as well, particularly during eSports tournaments.

Moreover, according to Kaspersky Lab, DDoS attacks affect not only game servers (which is often done to extort a ransom in return for not disrupting the competition) but also the gamers themselves who connect from their own platforms.

An organised DDoS attack on a team’s key players can easily result in that team losing and being eliminated from a tournament.

Cybercriminals use similar tactics to monetise attacks on the streamer market – channels streaming broadcasts of video games.

Competition in this segment is intense, and by using DDoS attacks cybercriminals can interfere with online broadcasts and, consequently, a streamer’s earnings.

Hackbusters! Reviewing 90 days of cybersecurity incident response cases
While there are occasionally very advanced new threats, these are massively outnumbered by common-or-garden email fraud, ransomware attacks and well-worn old exploits.
SEGA turns to Palo Alto Networks for cybersecurity protection
When one of the world’s largest video game pioneers wanted to strengthen its IT defences against cyber threats, it started with firewalls and real-time threat intelligence from Palo Alto Networks.
Forrester names Trend Micro Leader in email security
TrendMicro earned the highest score for technology leadership, deployment options and cloud integration.
LogRhythm releases cloud-based SIEM solution
LogRhythm Cloud provides the same feature set and user experience as its on-prem experience.
One Identity named Leader in PAM and IAM by KuppingerCole
KuppingerCole lead analyst Anmol Singh evaluated the strengths and weaknesses of 20 solution providers in the PAM market for the report.
Healthcare environments difficult to secure - Forescout
The convergence of IT, Internet of Things (IoT) and operational technology (OT) makes it more difficult for the healthcare industry to manage a wide array of hard-to-control network security risks.
Bitglass appoints new cloud, business development leaders
The cloud security company has appointed vice presidents for worldwide channels and worldwide business development.
Exploring the different needs for cloud services across Europe
Although digital transformation is happening across Europe, each country continues to have its own IT needs and the different cloud markets highlight this.