Bloody June: What's behind last month's DDoS attacks?

Bloody June: What's behind last month's DDoS attacks?

June's large-scale DDoS activity is the child of many different parents.

The list of DDoS attacks in the month of June has made for grim reading. High-profile sites have been targeted by extortion demands, online games got disrupted and at least one company was put out of business as a direct result.

While it's tempting to look for a single cause at the root of this apparent tsunami of distributed denial-of-service activity, the reality is considerably more complex. Online activism, the profit motive and even potential nation-state activity contributed to June's high volume of DDoS attacks.

The only commonality, in fact, may be the ease with which DDoS attacks can be launched. Experts like Molly Sauter, an academic and author of the forthcoming book The Coming Swarm, say that the process is childishly simple.

"Literally, if you have a credit card and if you're bored, it could be anyone," Sauter told Network World. "It's so easy to rent a botnet most of them are out of Russia and you can rent one for stupid cheap, and then deploy it for a couple of hours, and that's really all you need to target a major site like Feedly or Evernote."

Sauter's research focuses on the socio-political aspects of technology. She highlights the attacks, earlier in June, on websites connected to the World Cup's sponsors and backers, which used the iconography of Anonymous.

"I'm seeing a lot of Anonymous-oriented DDoS actions," she said. Anonymous, according to Sauter, is a useful "brand" for politically motivated DDoS attacks, allowing groups to identify themselves with a particular flavor of political thought, despite no organizational connection to other activists.

But the highest-profile attacks in the U.S. this June were not politically motivated the DDoS attempts that took down RSS reader Feedly and note-taking and personal organization service Evernote drew big headlines, and Feedly, at least, was asked for ransom by its attackers.

Feedly didn't pay up, and, according to Forrester principal analyst Rick Holland, that's probably for the best.

"There's no guarantee that they're not going to continue to DDoS you," he said. "It's like regular extortion you start paying people off and then, suddenly, they're going to keep coming back to you every month."

Holland stopped short of urging a blanket refusal to pay off DDoS extortionists, however, saying that companies need to decide their own cases for themselves, in close consultation with their legal teams. He doesn't know of any companies that have paid a DDoS ransom, but said that it wouldn't surprise him to learn that it has happened.

"I wouldn't be surprised if people have gotten DDoS, it didn't go public, they paid a ransom and that was that, but I have not specifically had those conversations," he said.

IDC research manager John Grady said that the increasing primacy of online services means that extortion-based DDoS attacks are becoming a more serious threat.

"When there are direct ties from resource availability to revenue, targeting availability is a quick way to get someone's attention," he said.

Grady echoed both Sauter's point about the general cheapness of botnets and Holland's argument that paying the ransom doesn't make a company proof against further attacks. What's more, he said, the growing power of some types of attack swings the balance of power further in favor of the attackers.

"Increasingly, the ease of amplifying attacks through DNS or NTP, which can ramp traffic up in the hundreds of gigabit range that we've seen become common, gives attacks real economies of scale," Grady said.

Research from Forrester shows that, in addition to volumetric attacks like DNS and NTP (which essentially flood targets with unwanted data), targeted application-level attacks have been on the rise. Application-level incidents had been seen by 42% of DDoS victims surveyed in a 2013 report just shy of the 44% that suffered volumetric attacks. Moreover, 37% used some combination of techniques.

According to a report from Infonetics, that trend has prompted increasing attention for application-level mitigation technology.

"An increasing number of application-layer attacks, which older DDoS detection and mitigation infrastructure can't identify and block, are forcing companies to make new investments in DDoS solutions," wrote principal security analyst Jeff Wilson in December.

What this means is that a DDoS attack, whether it's motivated by politics or money, is an increasingly unequal struggle. Attack techniques have become easier, cheaper and more powerful at the same time as their effects have become more damaging and defensive measures have failed to keep pace.

"The cost of entry is very low for the attackers and the cost to defend is very high for the targets," said Holland.

He said that the best defense may be to simply be as forewarned as possible, and to make plans in advance for potential DDoS incidents. Many businesses haven't even considered the potential ramifications of a DDoS.

"I'm surprised that many of my clients that have some kind of online service be it a business-to-consumer service, business-to-business service they don't know how much 10 minutes of outage would cost them. So when I talk to customers, that's always one of the first questions I ask them," he said. "You need to have a playbook set up, basically."

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags network securityddossecurity



Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Show Comments