The recent slew of distributed denial of service (DDoS) attacks against South African banks and ISPs have highlighted the fact that even the largest organisations with the latest security tools and solutions need to revisit their technology governance strategies.
“These attacks should be a wake-up call to organisations across the board,” says Rezelde Botha, business unit manager for Citrix at Axiz.
A DDoS attack happens when threat actors attempt to make it impossible for a company to deliver its services, usually achieved by preventing access to networks, applications, servers, devices and suchlike. Essentially, these attacks work by flooding a system with requests for data, such that it inevitably crashes under the onslaught. Also, DDoS attacks are not just on the rise, they are changing in nature. It would seem that new DDoS attack methods are taking over from those that have been successfully combatted by the security community and law enforcement. Unfortunately, they are becoming increasingly complex and this is showing no signs of slowing down, therefore, businesses must find ways to protect themselves effectively.
Botha says the impact of a DDoS attack can range from a minor irritation to seeing websites, applications, or even the whole business taken offline. There are several symptoms that indicate a DDoS attack, although initially, it can appear as if there are normal availability issues, such as a server or system being down. Sometimes, it can seem as if there are simply too many legitimate requests from real users taking place. However, traffic analysis will quickly separate the wheat from the chaff.
DDoS attacks are becoming more aggressive
Over the years, DDoS attacks have got bigger in size. “If we think back to the ‘90s,” Botha explains, “attacks might have seen 150 server requests happening each second, and that number would have been sufficient to bring down systems at that time. Today, they can exceed 1000 Gbps, thanks to the massive botnets we see today.”
Three years ago, the notorious Mirai botnet reared its head, attacking Internet performance management company, Dyn DNS. Mirai employed a hundred thousand hijacked IoT devices to achieve its ends, sending a barrage of DNS queries from an enormous number of different IP addresses. “This led to services from giants such as Netflix, Amazon, Spotify, Tumbler and Twitter being disrupted, explains Botha. “The Mirai botnet was notable in that, unlike the majority of DDoS attacks, it leveraged vulnerable IoT devices instead of PCs and servers. This is particularly concerning considering the number of IoT devices already in play, and growing exponentially.”
Early last year, another DDoS technique appeared on the scene. “Software development platform GitHub was hit by an enormous DDoS attack. The platform managed to fight it off in under half an hour, only going down intermittently, but the sheer scale of the attack raised the alarm within the security community.
Botha explains that this attack did not make use of massive botnets, such as those used in the Dyn DNS attack, it employed a far simpler method. This attack stemmed from memcached servers. “Essentially, these database caching systems work to
quicken networks and websites,” she adds, “but they aren’t meant to be exposed on the public Internet. Approximately 100 000 such memcached servers, most of which are owned by businesses and other organisations, sit exposed online with zero authentication protection. Anyone can query them, and similarly, they will respond to anyone.”
In this way, threat actors can access them and send them a special command packet that the server will respond to with a much larger reply. Unlike the usual botnet attacks, memcached DDoS attacks do not need the power of a malware-driven botnet to achieve their ends. Bad actors merely spoof the IP address of their target and send small queries to multiple memcached servers, at around 10 per second to each server, which are tailored to draw a far larger response. These memcached systems then return fifty times the data of the requests back to the victim.
“One thing is clear,” concludes Botha. “Businesses need to find better ways to protect themselves against this sort of attack.” Enter Citrix NetScaler, which checks the client’s connection and request parameters to prevent flood attacks until a valid application request has been submitted. Using NetScaler, businesses can defend against attacks through security products that use the latest standards to protect today’s segmented, layered and virtualised corporate networks.”
© Technews Publishing (Pty) Ltd | All Rights Reserved
printer friendly version