DDoS Attacks Evolve And Spread

What struck VeriSign executive Ben Petro most in his company's survey on distributed denial-of-service (DDoS) trends within organizations was the concrete company that reported being hit with a DDoS attack in the past year: In other words, DDoS isn't just for high-profile attacks anymore.

"I can only theorize why a concrete company would be DDoS'ed when it has virtually no Web presence ... who is attacking this company?" says Petro, senior vice president of VeriSign's network intelligence and availability group.

According to VeriSign's report, released today, 63 percent of midsize to large organizations say they suffered at least one DDoS attack in the past year, and 11 percent, six or more. Why the big spike in a not-so-new form of attack?

While hacktivist group Anonymous' wave of DDoS attacks on high-profile targets, such as MasterCard, HBGary, PayPal, and Visa, during the past few months might have renewed enterprise concerns about these types of attacks, Anonymous doesn't directly account for the major surge in DDoS threats, security experts say. "Anonymous is not a significant player based on the numbers. They get a lot of press and hit a lot of high-profile sites, but they don't hit at the frequency that could make the kind of dent on these numbers," says Jose Nazario, senior manager of security research for Arbor Networks, which studies DDoS attacks and trends.

Nazario says his firm sees small to midsize companies getting hit with DDoSes for extortion purposes. "[The attackers] know they can hit broadly and make a few thousand bucks here and there because SMBs can't defend themselves because it's too costly," he says.

DDoS is definitely on companies' radar screens today. Of the 225 U.S. IT decision-makers surveyed by VeriSign, nearly 80 percent are either extremely or very concerned about DDoS attacks hitting their organizations. Some 67 percent say they expect the strength and frequency of these attacks to either increase or stay flat in the next two years.

More than one-third of downtime in the past year was due to a DDoS attack, the report says. Sixty-seven percent say that network downtime affected their customers, and 51 percent say they lost revenue due to the downtime. Putting that into perspective: Some 60 percent of the survey respondents rely on their websites for at least one-fourth of their revenue. Meanwhile, some 70 percent say they plan to deploy a DDoS defense solution in the next 12 months.

And Asia is becoming a hotbed for DDoS. VeriSign's Petro says his firm sees multimegabit DDoS attacks originating from Asia.

Nazario, meanwhile, says Arbor has seen companies in China and Korea waging DDoS attacks to derail their competitors and drive traffic to them instead.

Researchers at Arbor see one to four new code bases a day emerge for DDoSing, he says. "The problem is a lot bigger than we had thought ... it's been very eye-opening," Nazario says, noting that VeriSign's DDoS attack data might even be slightly low.

And even with the increased pressure on botnets from the U.S. Department of Justice and various businesses, such as Microsoft, that are spearheading takedowns of these zombie nations, there is no shortage of botnets for DDoS or other purposes. They're cheap, too: Researchers saw one botnet that costs only $25 a day to rent, Nazario says. "It's a buyer's market," he says.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.