Is your organisation protected against modern DDoS attacks?

The recent slew of distributed denial of service (DDoS) attacks against banks and ISPs particularly in South African, highlighted a fact that even the largest organisations with the latest and well built security tools and solutions need to revisit their technology governance strategies.

A DDoS attack happens when threat actors attempt to make it impossible for a company to deliver its services, which is usually achieved by preventing access to networks, applications, servers, devices and suchlike. Essentially, these attacks work by flooding a system with requests for data, such as sending a web server way too many requests to serve a page that it inevitably crashes under the onslaught. Similarly, it could be a database being hit with a massive volume of queries, which will overwhelm the central processing unit, random access memory and available internet bandwidth.

“These attacks should be a wake-up call to organisations across the board,” says Rezelde Botha, Business Unit Manager for Citrix at Axiz, a leading value-added ICT distributor in South Africa. Adding; “Such attacks are not just on the rise, they are changing in nature.”

When it would seem like the new DDoS attack methods are taking over from those that have been successfully combated by the security community and law enforcement, they are unfortunately becoming increasingly complex. Businesses must find ways to protect themselves effectively.

Botha says the impact of a DDoS attack can range from a minor irritation from disrupted services to seeing whole Web sites, applications, or even the whole business taken offline.

“There are several symptoms that indicate a DDoS attack is happening, although initially, it can appear as if there are normal availability issues, such as a server or system being down. Sometimes, it can seem as if there are simply too many legitimate requests from real users taking place. However, traffic analysis will quickly separate the wheat from the chaff,” she notes.

Back in the 90s, attacks might have seen 150 server requests happening each second, a number that would sufficiently bring down systems at that time. Today, they can exceed 1000 Gbps, thanks to massive botnets we see today! Over the years, DDoS attacks have also gotten bigger and better if not worse.

Three years ago, as Botha narrates, the notorious Mirai botnet reared its head, attacking one internet performance management company called DynDNS. The Mirai botnet employed a hundred thousand hijacked IoT devices to achieve its ends, sending a barrage of DNS queries coming from tens of millions of IP addresses. This lead to services from giants such as Netflix, Amazon, Spotify, Tumbler and Twitter being disrupted, she explains.

“The Mirai botnet was notable in that, unlike the majority of DDoS attacks, it leveraged vulnerable IoT devices instead of PCs and servers. This is particularly concerning considering that there are already tens of billions of IoT devices in play, and this number is growing exponentially.” Rezelde Botha.

Early last year, another DDoS technique reared its ugly head seeing Software development platform – GitHub-  hit with an enormous DDoS attack, with a record 1.35 TB per second of traffic hitting its site. The platform managed to fight the attack off in under an hour, and only went down intermittently. The sheer scale of this attack raised an alarm within the security community.

She says interestingly, that the attack didn’t make use of massive botnets such as seen in the Dyn DNS attack, rather employed a far more simple method.

“This attack stemmed from memcached servers. Essentially, these database caching systems work to quicken networks and Web sites, but they aren’t meant to be exposed on the public Internet. Anyone can query them, and similarly, they will respond to anyone. Approximately 100 000 memcached servers, most of which are owned by businesses and other organisations, sit exposed online with zero authentication protection,” she avers.

Bad actors merely spoof the IP address of their target and send small queries to multiple memcached servers, at around 10 per second to each server, which are tailored to draw a far larger response. These memcached systems then return fifty times the data of the requests back to the victim.

In this way, threat actors can access them and send them a special command packet that the server will respond to with a much larger reply. In this way, unlike the usual botnet attacks that large DDoS attacks employ, memcached DDoS attacks do not need the power of a malware-driven botnet to achieve their ends.

One thing is clear, businesses need to find better ways to protect themselves against this sort of attack.

Step in Citrix NetScaler, which checks the client’s connection and request parameters to prevent flood attacks until a valid application request has been submitted. Using NetScaler, businesses can defend against attacks at multiple layers, including the application layer, the transport layer and the network layer.