CYBER SECURITY WEB VERSION: Click Here
infections, web attacks, or attacks that were unclassified. As seen in Figure 2, DDoS attacks dominated the pandemic lockdown incidents. Reports of DDoS attacks started off as just a tenth of reported incidents in January, but then grew to three times that of all incidents in March. DDoS has remained significant on an ongoing basis.
The first D in DDoS means distributed and refers to the fact that DDoS attacks are sourced around the world from large botnets of compromised machines. In previous years, we saw a “spring slump” in DDoS attacks, but this year we witnessed a big rise from April onward, with only a slight dip in June. On average for the entire period annually, the magnitudes are similar, with 51 per cent of reported incidents being DDoS in 2020 compared to 46 per cent in 2019. However, the monthly timing of DDoS attacks waxed and waned differently during the lockdown, as shown in Figure 3.
During this period, a campaign of blackmail attempts claimed to be from the Russian advanced attacker Fancy Bear. Their attack opened with a small DDoS attack as a demonstration, followed by a payment demand for hundreds of thousands of dollars. Pay up or they will “make sure your services will remain off line until you pay.” What is curious is that Fancy Bear is a cyberespionage group that is not known for DDoS
Figure 2
Figure 3
attacks or blackmail, but rather espionage and political disruption. It’s highly unlikely that the real Fancy Bear is carrying out these recent campaigns.
Shift in DDoS attack types in 2020 Overall, most of the reported DDoS attacks are volumetric, targeting network bandwidth and saturating it with junk packets to clog up the connections for legitimate users. A common method for doing this is a DNS amplification attack,
homeofdirectcommerce.com | Direct Commerce
which spoofs DNS requests to flood back at a victim. In 2019, 17 per cent of all DDoS attacks reported to the F5 SIRT were identified as DNS amplification attacks. However, in 2020, that number nearly doubled, to 31 per cent.
Another DNS DDoS technique is a DNS query flood, where an attacker sends malicious DNS requests that are purposely malformed to cause a DNS server to exhaust its resources. During the 2020 period,
Continues overleaf > 49
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60 |
Page 61 |
Page 62 |
Page 63 |
Page 64 |
Page 65 |
Page 66 |
Page 67 |
Page 68 |
Page 69 |
Page 70
