Latest Trends in DDoS Attacks

Thanks to its more than 200 data centers protecting over 3 million customers, Cloudflare has provided very interesting statistics on DDoS attacks and their trends.

Before presenting these trends in more detail, it is worth revisiting what DoS and DDoS attacks are, how they arise, and what attackers aim to achieve with them. DoS (Denial of Service) involves an attacker's tactic of limiting or preventing the operation of a specific service, such as a website, API interface, or mail server. An attack can take place at different layers of the OSI model, with ICMP or SYN flood being examples.

A standard DoS attack originates from a single machine and is therefore not as destructive. However, its derivative, DDoS (Distributed Denial of Service), originates from a large number of controlled machines or devices, and its consequences can be catastrophic. Attackers build their network of controlled devices through further attacks and infections. They do not limit themselves to conventional computers; other devices such as IP cameras, baby monitors, and other IoT devices connected to the internet can also become their slaves. Unfortunately, these are very often poorly secured or completely unsecured.

There are various ways to measure the size of an L3/4 DDoS attack. One is the traffic volume it generates, or its “bitrate” (measured in gigabits per second). Another is the number of delivered packets, or “packet rate” (measured in packets per second). Attacks with high bitrates attempt to saturate the target's last-mile network connections, while attacks with high packet rates try to overwhelm routers or other hardware devices along the path. Another metric of interest is attack duration. Interestingly, the longest recorded attack lasted 509 hours, which is almost 21 days.

DDoS Attacks in Q4 2020

• Number of attacks: For the first time in 2020, the total number of attacks recorded in the fourth quarter declined compared to the previous quarter.
• Attack duration: 73% of observed attacks lasted less than one hour, down from 88% in the third quarter.
• Attack vectors: SYN, ACK, and RST floods remain dominant, while the 5,400% increase in NetBIOS attacks is remarkable.
• Global DDoS activity: Data centers in Mauritius, Romania, and Brunei recorded the highest ratio of attack activity compared to normal traffic.
• New attacker tactics: Attempts at extortion by threatening DDoS attacks (Ransom DDoS) and demanding ransom in Bitcoin are emerging.

Global DDoS Activity

To understand where attacks originate, it is necessary to look at statistics from Cloudflare's edge data centers. The reason is that in the case of an L3/L4 attack, an attacker can spoof the source IP address in an attempt to conceal the originator of the attack.

This report measures the ratio of attack traffic to normal traffic in a given geographical location. Cloudflare can ensure high accuracy of this data thanks to more than 200 data centers in over 100 countries worldwide.

In the fourth quarter, a very interesting observation can be made: the highest ratio of attack traffic was recorded by data centers in Mauritius, Romania, and Brunei. Specifically, it accounted for 4.4%–4.9% of all traffic in the respective country. To put this into perspective, almost 5 out of every 100 bytes were part of attack traffic. These facts indicate increased botnet activity in these countries.

You may be wondering why these three countries in particular. The explanation may be surprising; let us take a closer look at the first two places in the ranking:

Mauritius – In August 2020, this island nation suffered a major environmental disaster when a tanker ran aground, spilling approximately 4,000 tonnes of oil into the ocean and destroying a unique ecosystem. As this directly threatened tourism, which is the main source of income for most of the population, the situation resulted in protests against the government calling for the prime minister's resignation. Even after several months, the situation remains highly unclear, creating fertile ground for hacker activity.

Romania – In the case of this European country, two events that took place at the end of 2020 may be behind it. The first was parliamentary elections, which ended on December 6. In addition, on December 9, the EU announced that Romania would host the new European cybersecurity research center (European Cybersecurity Industrial, Technology and Research Competence Centre – ECCC). Another possible explanation is the fact that Romania is the country with the cheapest ultra-fast internet connection, making it possible to launch attacks with enormous volumes of data from this country.

 

Summary

DDoS attacks remain a significant threat to internet infrastructure. Their apparent decline between the third and fourth quarters of last year was rather caused by a significant increase at the onset of the Covid-19 pandemic. Understanding the development and trends of such attacks enables us to take defensive measures in time that can partially or completely eliminate them.