Arbor Networks says it records the largest DDoS attack of all time in its Q1 2015 DDoS Report.
Arbor Networks, Inc., a provider of DDoS and threat protection solutions for enterprise and service provider networks, has released its global DDoS attack data for the first quarter of 2015, showing a steady stream of extremely high-volume attacks. Arbor says these included the largest attack ever recorded by its ATLAS threat intelligence system, a 334 Gbps attack targeting an Internet service provider in Asia. In the first quarter of 2015, there were 25 attacks larger than 100 Gbps globally, Arbor says.
Over the past year, Arbor Networks says it has documented a dramatic increase in the size of DDoS attacks. The majority of recent very large attacks exploit the reflection amplification technique, which uses the Network Time Protocol [NTP], Simple Service Discovery Protocol [SSDP] and DNS servers, with a large number of significant attacks detected across the globe, according to Arbor Networks.
Real-time DDoS attacks
Arbor Networks informs that reflection amplification is a technique that allows an attacker to simultaneously magnify the amount of traffic they are able to generate and to hide the original sources of said malicious traffic. This particular technique is based on two unfortunate realities: First, even now, a large number of service providers do not use filters at the edges of their networks to block traffic with “spoofed” [deceptive] IP addresses. In addition, there are a multitude of poorly configured and poorly protected devices on the Internet that provide UDP services by offering an amplification factor between a query sent to them and the response produced.
Arbor Networks’ data is collected through the ATLAS system, which is a collaboration of more than 330 service provider customers who share anonymized traffic data with Arbor, aiming to provide a comprehensive, aggregated view of traffic and threats on a global scale. ATLAS collects statistics representing 120 Tbps of Internet traffic and provides the data for the Digital Attack Map. The latter visualizes global threat traffic and was created in collaboration with Google Ideas.
Other notable statistics regarding DDoS attacks that occurred in the first quarter of 2015, according to Arbor Networks, are:
- SSDP reflection attacks are increasing exponentially year after year, providing a prime example of how attackers are constantly changing the techniques they use: In Q1 2015, 126,000 attacks , compared to just three in Q1 2014.
- Attacks are shorter in duration but have the potential to inflict a very powerful blow: The majority of attacks are short-lived, approximately 90% of them last less than 1 hour
“Attacks significantly larger than the 200Gbps level can prove extremely dangerous for network service providers and can certainly cause collateral damage to service provider networks, cloud hosting services, and corporate networks,” says Darren Anstee, Director, Solutions Architects at Arbor Networks.
“DDoS attacks are constantly evolving. Not only have volumetric attacks increased in size and frequency over the past 18 months, but application-level attacks remain particularly popular. To address the full spectrum of modern DDoS threats, we strongly recommend adopting a multi-layered approach to protection, one that integrates on-premises protection solutions against application-level attacks and cloud-based protection solutions against extremely high-volume attacks. Only then can an organization be considered fully shielded from DDoS attacks today,” adds Anstee.
Source: gr.pcmag.com
