• Home
• Kilas Global
• Nexusguard Report Shows Nearly Two - Thirds of DDoS Attacks in Q3 2018 Targeted Communications Service Providers

Selasa, 22 Januari 2019 14:58:00

Nexusguard Report Shows Nearly Two - Thirds of DDoS Attacks in Q3 2018 Targeted Communications Service Providers

New data indicates attackers preyed on the large attack surface of ASN-level communications service providers with a ‘bit-and-piece’ approach

SAN FRANCISCO, UNITED STATES, - January 22, 2019 - The Nexusguard "Q3 2018 Threat Report" has revealed the emergence of an extremely stealthy distributed denial-of-service (DDoS) attack pattern targeting communications service providers (CSPs).

This new vector exploits the large attack surface of ASN-level (autonomous system number) CSPs by spreading tiny attack traffic across hundreds of IP (internet protocol) addresses to evade detection. The ongoing evolution of DDoS methods suggests that CSPs need to enhance their network security posture and find more effective ways to protect their critical infrastructure and tenants. The continued discovery of new attack patterns should also alert enterprises to the importance of selecting DDoS-proof service providers.
 
The quarterly report, which measures thousands of DDoS attacks around the world, showed CSPs were targeted by 65.5 percent of DDoS attacks in Q3, given their extensive networks enabling access to tenants' assets. Attackers were found to have contaminated a diverse pool of IP addresses across hundreds of IP prefixes (at least 527 Class C networks, according to Nexusguard findings) with very small-sized junk traffic. As a result, the year over year average attack size in the quarter fell measurably - 82 percent.
 
"Perpetrators are using smaller, bit-and-piece methods to inject junk into legitimate traffic, causing attacks to bypass detection rather than sounding alarms with large, obvious attack spikes," said Juniman Kasman, chief technology officer for Nexusguard. "Diffused traffic can cause CSPs to easily miss large-scale DDoS attacks in the making, which is why these organizations will need to share the load with the cloud at the network edge to minimize attack impact."
 
Nexusguard analysts believe that attackers conducted reconnaissance missions to map out the network landscape and identify the mission-critical IP ranges of targeted CSPs. Then they injected bits and pieces of junk into legitimate traffic, whose size easily bypassed detection thresholds.

Mitigating broadly distributed, small-sized attack traffic is more difficult at the CSP level, in comparison to the traditional volumetric attack method on a small number of targeted IPs. The convergence of polluted traffic that slips through the "clean pipes" of upstream internet service providers forms a massive traffic flow that easily exceeds the capacity of mitigation devices, leading to high latency at best, deadlock at worst.
 
The "bit-and-piece" attacks observed in the quarter often leveraged open domain name system (DNS) resolvers to launch what is commonly known as DNS Amplification, whereby a targeted IP address receives only a small number of responses in each well-organized campaign, leaving little or no trace. Black-holing all traffic to an entire IP prefix may be a solution but is costly since black-holing will also block access to a wide range of legitimate services.
 
Other report findings show:
China advanced its lead of global attack origins, contributing more than 23 percent of worldwide campaigns
15 percent of attacks originated in the United States
Simple Service Discovery Protocol (SSDP) amplification attacks rose 639.8 percent over Q2 2018, a result of the new pattern targeting CSPs
 
Nexusguard's quarterly DDoS threat research measures attack data from botnet scanning, honeypots, internet service providers (ISPs) and traffic moving between attackers and their targets to help companies identify vulnerabilities and stay informed about global cyber security trends. Read the full "Q3 2018 Threat Report" for more details. (*).
 

5 tahun lalu

Nexusguard research reveals 1,000% increase in DNS amplification attacks since last year

Enterprise networks and communications service providers (CSPs) need advance attack mitigation as DNS patch adoption creates new threats

SAN FRANCISCO, UNITED STATES, - 16

6 tahun lalu

Largest DDoS-for-hire Websites Responsible for 11 Percent of Attacks Worldwide, According to Nexusguard Threat Report

The FBI’s shutdown of the world’s 15 largest DDoS-for-hire “booter” websites in December resulted in 85 percent decrease in average attack sizes, year-over year

SA

6 tahun lalu

Penelitian Nexusguard mengungkap peningkatan 500 persen dalam rata-rata ukuran serangan DDoS

 

Para peneliti keamanan siber menganjurkan perlindungan lebar pita (bandwidth) terhadap botnet IoT

 

SAN FRANCISCO,

6 tahun lalu

Nexusguard research reveals 500 percent increase in average DDoS attack size

 

Cybersecurity researchers recommend bandwidth protection against IoT botnets

 

SAN FRANCISCO, UNITED STATES -- Sept