New data indicates attackers preyed on the large attack surface of ASN-level communications service providers with a �bit-and-piece� approach
�
SAN
FRANCISCO, UNITED STATES - Media OutReach - January 22,
2019 -�The Nexusguard "Q3 2018 Threat Report"
has revealed the emergence of an extremely stealthy distributed denial-of-service
(DDoS) attack pattern targeting communications service providers (CSPs). This new vector exploits the large attack surface of ASN-level
(autonomous system number) CSPs by spreading tiny attack traffic across
hundreds of IP (internet protocol) addresses to evade detection. The ongoing
evolution of DDoS methods suggests that CSPs need to enhance their network
security posture and find more effective ways to protect their critical
infrastructure and tenants. The continued discovery of new attack patterns
should also alert enterprises to the importance of selecting DDoS-proof service
providers.
�
The quarterly report,
which measures thousands of DDoS attacks around the world, showed CSPs were
targeted by 65.5 percent of DDoS attacks in Q3, given their extensive networks enabling
access to tenants' assets. Attackers were found to have contaminated a diverse
pool of IP addresses across hundreds of IP prefixes (at least 527 Class C
networks, according to Nexusguard findings) with very small-sized junk traffic.
As a result, the year over year average attack size in the quarter fell measurably
- 82 percent.
�
"Perpetrators are using smaller, bit-and-piece
methods to inject junk into legitimate traffic, causing attacks to bypass
detection rather than sounding alarms with large, obvious attack spikes," said
Juniman Kasman, chief technology officer for Nexusguard. "Diffused traffic can
cause CSPs to easily miss large-scale DDoS attacks in the making, which is why
these organizations will need to share the load with the cloud at the network
edge to minimize attack impact."
�
Nexusguard analysts believe
that attackers conducted reconnaissance missions to map out the network
landscape and identify the mission-critical IP ranges of targeted CSPs. Then
they injected bits and pieces of junk into legitimate traffic, whose size
easily bypassed detection thresholds. Mitigating broadly distributed,
small-sized attack traffic is more difficult at the CSP level, in comparison to
the traditional volumetric attack method on a small number of targeted IPs. The
convergence of polluted traffic that slips through the "clean pipes" of
upstream internet service providers forms a massive traffic flow that easily
exceeds the capacity of mitigation devices, leading to high latency at best,
deadlock at worst.
�
The "bit-and-piece"
attacks observed in the quarter often leveraged open domain name system (DNS)
resolvers to launch what is commonly known as DNS Amplification, whereby a
targeted IP address receives only a small number of responses in each
well-organized campaign, leaving little or no trace. Black-holing all traffic
to an entire IP prefix may be a solution but is costly since black-holing will
also block access to a wide range of legitimate services.
�
Other report findings show:
- China advanced its lead of global
attack origins, contributing more than 23 percent of worldwide campaigns - 15 percent of attacks originated
in the United States - Simple Service Discovery Protocol
(SSDP) amplification attacks rose 639.8 percent over Q2 2018, a result of the
new pattern targeting CSPs
�
Nexusguard's quarterly DDoS threat research
measures attack data from botnet scanning, honeypots, internet service
providers (ISPs) and traffic moving between attackers and their targets to help
companies identify vulnerabilities and stay informed about global cyber security
trends. Read the full "Q3 2018 Threat Report" for more details.
�
About
Nexusguard
Founded in 2008, Nexusguard is a leading
cloud-based distributed denial of service (DDoS) security solution provider
fighting malicious internet attacks. Nexusguard ensures uninterrupted internet
service, visibility, optimization and performance. Nexusguard is focused on
developing and providing the best cybersecurity solution for every client
across a range of industries with specific business and technical requirements.
Nexusguard also enables communication service providers to deliver DDoS
protection solution as a service. Nexusguard delivers on its promise to provide
you with peace of mind by countering threats and ensuring maximum uptime. Visit
www.nexusguard.com for more information.
