Bloody June: What's behind last month's DDoS attacks?

June's large-scale DDoS activity is the child of many different parents.

The list of DDoS attacks in the month of June has made for grim reading. High-profile sites have been targeted by extortion demands, online games got disrupted and at least one company was put out of business as a direct result.

While it's tempting to look for a single cause at the root of this apparent tsunami of distributed denial-of-service activity, the reality is considerably more complex. Online activism, the profit motive and even potential nation-state activity contributed to June's high volume of DDoS attacks.

The only commonality, in fact, may be the ease with which DDoS attacks can be launched. Experts like Molly Sauter, an academic and author of the forthcoming book The Coming Swarm, say that the process is childishly simple.

"Literally, if you have a credit card and if you're bored, it could be anyone," Sauter told Network World. "It's so easy to rent a botnet most of them are out of Russia and you can rent one for stupid cheap, and then deploy it for a couple of hours, and that's really all you need to target a major site like Feedly or Evernote."

Sauter's research focuses on the socio-political aspects of technology. She highlights the attacks, earlier in June, on websites connected to the World Cup's sponsors and backers, which used the iconography of Anonymous.

"I'm seeing a lot of Anonymous-oriented DDoS actions," she said. Anonymous, according to Sauter, is a useful "brand" for politically motivated DDoS attacks, allowing groups to identify themselves with a particular flavor of political thought, despite no organizational connection to other activists.

But the highest-profile attacks in the U.S. this June were not politically motivated the DDoS attempts that took down RSS reader Feedly and note-taking and personal organization service Evernote drew big headlines, and Feedly, at least, was asked for ransom by its attackers.

Feedly didn't pay up, and, according to Forrester principal analyst Rick Holland, that's probably for the best.

"There's no guarantee that they're not going to continue to DDoS you," he said. "It's like regular extortion you start paying people off and then, suddenly, they're going to keep coming back to you every month."

Holland stopped short of urging a blanket refusal to pay off DDoS extortionists, however, saying that companies need to decide their own cases for themselves, in close consultation with their legal teams. He doesn't know of any companies that have paid a DDoS ransom, but said that it wouldn't surprise him to learn that it has happened.

"I wouldn't be surprised if people have gotten DDoS, it didn't go public, they paid a ransom and that was that, but I have not specifically had those conversations," he said.

IDC research manager John Grady said that the increasing primacy of online services means that extortion-based DDoS attacks are becoming a more serious threat.

"When there are direct ties from resource availability to revenue, targeting availability is a quick way to get someone's attention," he said.

Grady echoed both Sauter's point about the general cheapness of botnets and Holland's argument that paying the ransom doesn't make a company proof against further attacks. What's more, he said, the growing power of some types of attack swings the balance of power further in favor of the attackers.

"Increasingly, the ease of amplifying attacks through DNS or NTP, which can ramp traffic up in the hundreds of gigabit range that we've seen become common, gives attacks real economies of scale," Grady said.

Research from Forrester shows that, in addition to volumetric attacks like DNS and NTP (which essentially flood targets with unwanted data), targeted application-level attacks have been on the rise. Application-level incidents had been seen by 42% of DDoS victims surveyed in a 2013 report just shy of the 44% that suffered volumetric attacks. Moreover, 37% used some combination of techniques.

According to a report from Infonetics, that trend has prompted increasing attention for application-level mitigation technology.

"An increasing number of application-layer attacks, which older DDoS detection and mitigation infrastructure can't identify and block, are forcing companies to make new investments in DDoS solutions," wrote principal security analyst Jeff Wilson in December.

What this means is that a DDoS attack, whether it's motivated by politics or money, is an increasingly unequal struggle. Attack techniques have become easier, cheaper and more powerful at the same time as their effects have become more damaging and defensive measures have failed to keep pace.

"The cost of entry is very low for the attackers and the cost to defend is very high for the targets," said Holland.

He said that the best defense may be to simply be as forewarned as possible, and to make plans in advance for potential DDoS incidents. Many businesses haven't even considered the potential ramifications of a DDoS.

"I'm surprised that many of my clients that have some kind of online service be it a business-to-consumer service, business-to-business service they don't know how much 10 minutes of outage would cost them. So when I talk to customers, that's always one of the first questions I ask them," he said. "You need to have a playbook set up, basically."

Join the CSO newsletter!

Error: Please check your email address.

Tags network securityddossecurity

More about EvernoteIDC Australia

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jon Gold

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts