Distributed denial-of-service (DDoS) attack events are on the rise in the first quarter of 2018. That’s the word from a recent Kaspersky Lab study, which found “a significant increase in both the total number and duration of DDoS attacks against Q4 2017.”

Synchronized (SYN) attacks remain the most popular vector, accounting for 57.3 percent of the total volume of incidents. In addition, over 95 percent of all DDoS attack reports came from the top 10 countries, out of 79 total.

DDoS Attacks Increase in Length and Breadth

It’s not all bad news: The share of Linux botnets fell from 71 percent last year to 66 percent in Q1 2018. But the growth of specific botnet classes, such as Darkai, prompted a return to multiday DDoS attacks. The Kaspersky report noted that one attack lasted 297 hours — more than 12 days — which is the longest attack since 2015.

While these multiday events aren’t common, the report revealed a sixfold increase in sustained attacks, or those lasting longer than 50 hours. At the same time, short-term attacks are on the rise, up to 91.47 percent of all attacks from 85.5 percent last year.

Kaspersky also noted that amplification attacks are ramping up again, this time using Memcached and Lightweight Directory Access Protocol (LDAP) vectors rather than network time protocol (NTP) and Domain Name System (DNS)-based boosting. The authors warned that, as the year goes on, this could prove troublesome on the Dark Web because it “has one of the biggest amplification factors.”

Progress on the DDoS Attack Front

In addition to the sheer number of attacks, companies must contend with cost. A survey by Corero Network Security found that organizations spend up to $50,000 dealing with a single attack.

Reputational damage is also an issue. According to Security Boulevard, after an online poker site fell victim to multiple DDoS attack events in late April, many users became frustrated, arguing that the company’s “technical and management expertise is zilch” and calling for it to “make it right.”

There is some progress on the DDoS attack front. According to Forbes, European law enforcement recently shut down a website that sold DDoS attacks and helped launch them for millions of paying customers. The agency warned companies and individuals to stop using DDoS “stresser” services or face legal repercussions.

Taking Out the Garbage Traffic

According to Kaspersky, attacks in early March against code sharing site GitHub hit record volumes of “garbage” traffic at more than 1 TB per second using Memcached.

The security firm said it expects this traffic trend to continue this year. It predicted that “server owners will quickly spot the abundance of garbage traffic and patch up vulnerabilities, which will dent the popularity of attacks of this type.”

As noted above, however, amplification attacks may shift to LDAP services as threat actors look for ways to improve DDoS throughput.

More from

Vulnerability resolution enhanced by integrations

2 min read - Why speed is of the essence in today's cybersecurity landscape? How are you quickly achieving vulnerability resolution?Identifying vulnerabilities should be part of the daily process within an organization. It's an important piece of maintaining an organization’s security posture. However, the complicated nature of modern technologies — and the pace of change — often make vulnerability management a challenging task.In the past, many organizations had to support manual integration work to get different security systems to ‘talk’ to each other. As…

How I got started: SIEM engineer

2 min read - As careers in cybersecurity become increasingly more specialized, Security Information and Event Management (SIEM) engineers are playing a more prominent role. These professionals are like forensic specialists but are also on the front lines protecting sensitive information from the relentless onslaught of cyber threats. SIEM engineers meticulously monitor, analyze and manage security events and incidents within an organization. They leverage SIEM tools to aggregate and correlate data, enabling them to detect anomalies, identify potential threats and respond swiftly to security…

Tequila OS 2.0: The first forensic Linux distribution in Latin America

3 min read - Incident response teams are stretched thin, and the threats are only intensifying. But new tools are helping bridge the gap for cybersecurity pros in Latin America.IBM Security X-Force Threat Intelligence Index 2023 found that 12% of the security incidents X-force responded to were in Latin America. In comparison, 31% were in the Asia-Pacific, followed by Europe with 28%, North America with 25% and the Middle East with 4%. In the Latin American region, Brazil had 67% of incidents that X-Force…

Cost of a data breach 2023: Geographical breakdowns

4 min read - Data breaches can occur anywhere in the world, but they are historically more common in specific countries. Typically, countries with high internet usage and digital services are more prone to data breaches. To that end, IBM’s Cost of a Data Breach Report 2023 looked at 553 organizations of various sizes across 16 countries and geographic regions, and 17 industries. In the report, the top five costs of a data breach by country or region (measured in USD millions) for 2023…