Cyber Defense eMagazine December Edition for 2021

The New Normal
Several factors have converged to drive terabit-class attacks. Attackers continue to build massive
botnets, the armies of infected devices that can direct malicious traffic at targeted systems. Meanwhile,
IoT devices, which too often have lax cybersecurity standards, have only increased the number of devices
available to compromise.
A second factor is the continued development of reflection amplification attacks. Think of it this way: in
most DDoS attacks, a targeted system is flooded with requests for information that initiate a response. In
a reflection attack, attackers disguise the origin of the attack traffic to make it appear that it is coming
from the targeted network or device. In other words, the attack tricks the targeted system into sending
the response back to itself. But the size of the request for information and the response are not always
symmetrical. For some internet-based services, a request for information initiates a response that is far
larger in proportion. By targeting these services, attackers can significantly amplify the size of their attack.
A reflection amplification attack both magnifies the amount of malicious traffic an attacker can generate,
and obscures its source. In the first half of 2021 alone, threat actors weaponized at least seven new
reflection and amplification vectors. The deployment of this new tactic ignited an explosion of new attack
modes. Along those lines, the number of vectors used in multivector DDoS attacks has soared, with a
record-setting 31 attack vectors deployed in a single attack against one German organization.
That’s the type of attack launched against GitHub. Known as a memcached attack. Open source and
free, Memcached is a high-performance, distributed memory caching system designed to optimize
dynamic web applications. The amplification capabilities of Memcached servers is so great that if you
send a single request, that request could send back more than 50,000 responses.
Mixing Tactics, Vectors, and Targets
Large attacks are relatively easy to identify by automated defenses. But that has value in itself to
attackers. A large DDoS campaign may, for example, provide cover for another attack, and threat actors
can adapt their tactics to overcome defenses when volume alone does not suffice (though, to be clear, a
big attack still causes many problems).
An emerging trend has been the development of adaptive attack techniques designed to evade traditional
defenses. These types of attacks require extensive pre-attack research and reconnaissance to identify
vulnerabilities. The result, however, is an attack perfectly calibrated to overcome an organization’s
defenses. Furthermore, attackers don’t always need to attack an organization itself to cause damage. In
many cases, DDoS attacks can target service providers, including DNS servers, VPN concentrators to
inflict collateral damage.
Defending Against Terabit-Class Attacks
Overall, the first half of 2021 saw a staggering 11 million DDoS attacks. It’s not a matter of if a company
will find themselves in the crosshairs of a DDoS attack, it’s a matter of when. The pandemic, and its
Cyber Defense eMagazine – December 2021 Edition 134
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.