Security Report: Large-Scale DDoS Attacks Grow Bigger and More Diversified
Prolexic Technologies, the global leader in Distributed Denial of Service (DDoS) protection services, today announced that the scale and diversity of attacks increased against its global client base in Q4 2012. This is one of a number of key findings contained in the company's Quarterly Global DDoS Attack Report,which was published today.
While Q4 media reports focused on large DDoS attacks primarily against U.S. financial services companies, Prolexic also mitigated 50+ Gbps DDoS attacks against clients in the e-Commerce and software as a service (SaaS) sectors. While theitsoknoproblembro (BroDoS) toolkit was used against financial services firms in Q4, data shows it was also used against businesses in other sectors. Digital forensics by the Prolexic Security Engineering & Response Team (PLXsert) also found that malware besides Brodos was used in Q4 to generate equally large bandwidth attacks.
"The fourth quarter was defined by the increasing scale and diversity of DDoS attacks," said Prolexic CEO, Scott Hammack. "While bandwidth attacks of 20 Gbps were the story last quarter, 50 Gbps is more relevant now."
Highlights from Prolexic's Q4 2012 Global DDoS Attack Report
Compared to Q3 2012
- 27.5 percent increase in total number of attacks
- 17 percent increase in total number of infrastructure attacks; 72 percent rise in total number of application attacks
- 67 percent increase in average attack duration to 32.2 hours from 19.2 hours
- 20 percent increase in average attack bandwidth from 4.9 to 5.9 Gbps
- China retains its position as the top source country for DDoS attacks
Compared to Q4 2011
- 19 percent increase in total number of DDoS attacks
- 15 percent rise in total number of infrastructure attacks; 30 percent rise in total number of application attacks
- 6 percent decline in average attack duration to 32.2 hours from 34
- 13 percent increase in average attack bandwidth from 5.2 Gbps to 5.9 Gbps
Analysis and emerging trends
During Q4 2012, Prolexic mitigated seven attacks over 50 Gbps Directed against clients in the financial services, e-Commerce and SaaS verticals. "A case could be made that the size of attacks that are being reported in the financial services industry really just reflects the normal growth in DDoS," said Hammack. "We are seeing similarly sized attacks in other verticals, but they don't make headlines because companies in these industries are not required to report it in the same way."
In addition to increasing attack sizes, attack volume grew in Q4 2012 and reached the highest number of attacks Prolexic has logged for one quarter. Like the previous quarter, traditional Layer 3 and Layer 4 infrastructure attackswere the favored attack type, accounting for 75 percent of total attacks during the quarter, with application layer attacks making up the remaining 25 percent. This split has remained consistent throughout 2012. This quarter, SYN(24 percent), GET (20 percent), ICMP (18 percent) and UDP (15 percent) floods were the attack types most often encountered during mitigation.