The recent slew of distributed denial of service (DDoS) attacks against South African banks and ISPs have highlighted the fact that even the largest organisations with the latest security tools and solutions need to revisit their technology governance strategies.
(TOP: Rezelde Botha).
“A DDoS attack happens when threat actors attempt to make it impossible for a company to deliver its services, which is usually achieved by preventing access to networks, applications, servers, devices and suchlike. Essentially, these attacks work by flooding a system with requests for data, such as sending a web server way too many requests to serve a page that it inevitably crashes under the onslaught. Similarly, it could be a database being hit with a massive volume of queries, which will overwhelm the central processing unit, random access memory and available internet bandwidth.”
And DDoS attacks are not just on the rise, they are changing in nature, she says. “It would seem that new DDoS attack methods are taking over from those that have been successfully combatted by the security community and law enforcement. Unfortunately, they are becoming increasingly complex and this is showing no signs of slowing down. Businesses must find ways to protect themselves effectively.”
Botha says the impact of a DDoS attack can range from a minor irritation from disrupted services to seeing whole Web sites, applications, or even the whole business taken offline. “There are several symptoms that indicate a DDoS attack is happening, although initially, it can appear as if there are normal availability issues, such as a server or system being down. Sometimes, it can seem as if there are simply too many legitimate requests from real users taking place. However, traffic analysis will quickly separate the wheat from the chaff.”
Over the years, DDoS attacks have also gotten far bigger in size. “If we think back to the 90s, attacks might have seen 150 server requests happening each second, and that number would have been sufficient to bring down systems at that time. Today, they can exceed 1000 Gbps, thanks to massive botnets we see today.”
Three years ago, the notorious Mirai botnet reared its head, attacking one internet performance management company called Dyn DNS. The Mirai botnet employed a hundred thousand hijacked IoT devices to achieve its ends, sending a barrage of DNS queries coming from tens of millions of IP addresses. This lead to services from giants such as Netflix, Amazon, Spotify, Tumbler and Twitter being disrupted, she explains. “The Mirai botnet was notable in that, unlike the majority of DDoS attacks, it leveraged vulnerable IoT devices instead of PCs and servers. This is particularly concerning considering that there are already tens of billions of IoT devices in play, and this number is growing exponentially.”
Early last year, another DDoS technique reared its ugly head. “Software development platform GitHub was hit with an enormous DDoS attack, with a record 1.35 TB per second of traffic hitting its site. The platform managed to fight the attack off in under half an hour, and only went down intermittently, the sheer scale of the attack raised the alarm within the security community.”
She says interestingly, the attack didn’t make use of massive botnets such as seen in the Dyn DNS attack, it employed a far more simple method. “This attack stemmed from memcached servers. Essentially, these database caching systems work to quicken networks and Web sites, but they aren’t meant to be exposed on the public Internet. Anyone can query them, and similarly, they will respond to anyone. Approximately 100,000 memcached servers, most of which are owned by businesses and other organisations, sit exposed online with zero authentication protection.”
In this way, threat actors can access them and send them a special command packet that the server will respond to with a much larger reply. In this way, unlike the usual botnet attacks that large DDoS attacks employ, memcached DDoS attacks do not need the power of a malware-driven botnet to achieve their ends. Bad actors merely spoof the IP address of their target and send small queries to multiple memcached servers, at around 10 per second to each server, which are tailored to draw a far larger response. These memcached systems then return fifty times the data of the requests back to the victim.
One thing is clear, and that is that businesses need to find better ways to protect themselves against this sort of attack. “Step in Citrix NetScaler, which checks the client’s connection and request parameters to prevent flood attacks until a valid application request has been submitted. Using NetScaler, businesses can defend against attacks at multiple layers, including the application layer, the transport layer and the network layer.”