More and more hackers are using distributed denial-of-service (DDoS) attacks to hold businesses to ransom.

In June 2021, the Canadian Centre for Cyber Security issued an alert to raise awareness of increased DDoS extortion activity. One notable case occurred in September of that year, with ITWorld Canada reporting that a voice-over-IP provider in Canada had been targeted.

The perpetrator was believed to have demanded one bitcoin (equal to around $45,000) as payment to end the assault. Numerous other companies have been hit since.

With ransom DDoS incidents becoming more common, it’s crucial that organizations understand how serious this threat is, how it could affect them, and what defensive measures they can use to stay safe.

But before we explore what a ransom DDoS attack is and how you can stop it, we’ll cover the basics.

What is a DDoS Attack?

A DDoS attack floods a specific network, server, website, or application with an overwhelming amount of traffic. This disrupts the normal flow of traffic and prevents the target from operating as it should.

Perpetrators tend to use botnets to launch DDoS attacks. A botnet is a network comprising many connected systems, all of which have been infected with malware, to generate disruptive traffic. These devices may be computers, IoT (Internet of things) gadgets, or mobile devices.

A hacker can leverage these “zombie” systems to attack their target with enough traffic to cause serious problems. Attackers may aim to:

• Cause communication problems and leave a business unable to interact internally or with external contacts, such as customers or suppliers.
• Bring a company’s website offline to get a competitive advantage, either for their own gain or an employer’s.
• Disrupt a business’s operations to the extent that customers cannot get the products or services they pay for — ultimately chasing them away and causing reputation damage.

But with ransom DDoS attacks, hackers are driven more by greed than anything else.

What is a Ransom DDoS Attack?

A ransom DDoS attack (often referred to as a RDDoS attack) is essentially the same, but with a few key differences. The attacker’s goal is to extort money from the target through threats and even brief demonstrations of their power.

A hacker may launch a DDoS attack against a business then contact the victims to demand payment. They will expect the target to pay the ransom, and if they remain unpaid, the attacker will continue the DDoS assault.

Alternatively, hackers may threaten the target before they begin the attack. Their objective will be to inspire panic in the potential victims and receive money without needing to act.

However, an inexperienced or unequipped perpetrator may lack the resources or knowhow to follow through on their threat. In this case, an organization could emerge from the incident unscathed even if they refuse to pay the ransom.

How Does a Ransom DDoS Attack Disrupt Businesses?

A ransom DDoS attack could disrupt your business in various ways, assuming the perpetrator launches the attack instead of simply issuing a threat.

• Your website may become inaccessible, preventing existing and prospective customers from purchasing products, subscribing to services, or enjoying your content. This downtime can equate to lost sales and revenue.
• A DDoS attack could leave your workers unable to complete crucial tasks, leading to a drop in productivity that creates backlogs and delays.
• Your search engine rankings may drop if your website is inactive for any reason or runs slowly. That can harm your online visibility.
• Customers, affiliates, and suppliers may worry that your business is unreliable, and that any data you have that relates to them is unsafe.
• If you pay the ransom, your finances could take a significant hit — and there’s no guarantee that the hacker will end the attack.

Preventing an attack, and being prepared to handle one just in case, is vital to reduce your risk of experiencing these issues.

What Can You Do To Prevent a Ransom DDoS Attack?

Keep the following measures in mind to help prevent a ransom DDoS attack against your organization:

Refuse to Pay the Ransom

Your first instinct may be to pay the ransom, but you have no way of knowing whether that will stop the attack. It may continue, or the perpetrator could retarget your business again because they know you’re likely to pay a second time.

Train Employees to Handle Threats Responsibly

Educate your workers on what a ransom DDoS attack involves, how they usually unfold, and what actions to take if they receive a threatening message. They should know who to report an incident to and how to recognize early signs of an attack.

Look Out for Warning Signs of Impending Attacks

Common early signs of a DDoS attack include:

• Servers slow down and become less efficient.
• Significantly more spam emails littering your inbox.
• Your website takes longer to load.
• One or more computers slow down or show unusual signs of impaired performance.

These could indicate other problems, too, such as outdated equipment. However, it may be best to have any of these signs investigated by cybersecurity specialists just in case.

Ensure Your Security Measures are Updated and Effective

If you haven’t updated your firewalls and other IT security measures in a while, review them to identify potential weaknesses. Outdated cybersecurity software may lack the features to protect your business.

Work with Professional Cybersecurity Specialists

Reviewing, updating, and testing your cybersecurity setup is complicated. But it’s critical to reduce your risk of being affected by a ransom DDoS attack. For many companies in Canada, the simplest way to combat threats is to work with a team of cybersecurity professionals.

At The Driz Group, we’re dedicated to providing unparalleled cybersecurity solutions for businesses in all sectors.

Our experienced, trained, reliable team will perform a comprehensive IT audit and vulnerability assessment to accurately determine your unique security requirements. And we’ll implement the best security available to always defend your organization.

Start protecting your business — schedule your free consultation with The Driz Group today.

Microsoft recently revealed that one of its Azure customers was hit by a 2.4 Tbps distributed denial-of-service (DDoS) attack last August.

In the blog post “Business as usual for Azure customers despite 2.4 Tbps DDoS attack,” Amir Dahan Senior Program Manager at Microsoft’s Azure Networking said the 2.4 Tbps DDoS attack is 140 percent higher than 2020’s 1 Tbps attack and higher than any network volumetric event previously detected on Azure.

Dahan said the 2.4 Tbps DDoS attack on Azure infrastructure originated from approximately 70,000 sources and from multiple countries in the Asia-Pacific region, including Malaysia, Vietnam, Taiwan, Japan, and China, as well as from the United States.

“The attack vector was a UDP reflection spanning more than 10 minutes with very short-lived bursts, each ramping up in seconds to terabit volumes,” Dahan said. “In total, we monitored three main peaks, the first at 2.4 Tbps, the second at 0.55 Tbps, and the third at 1.7 Tbps.”

With the adoption of cloud services, Dahan said, “Bad actors, now more than ever, continuously look for ways to take applications offline.’

In the blog post "Azure DDoS Protection—2021 Q1 and Q2 DDoS attack trends," Alethea Toh Program Manager at Microsoft’s Azure Networking reported that the first half of 2021 saw a sharp increase in DDoS attacks on Azure resources per day. Toh said Microsoft’s Azure mitigated an average of 1,392 DDoS attacks per day in the first half of 2021, the maximum reaching 2,043 attacks on May 24, 2021.

“In total, we mitigated upwards of 251,944 unique [DDoS] attacks against our global infrastructure during the first half of 2021,” Toh said.

Toh added that in the first half of 2021, the average DDoS attack size was 325 Gbps, with 74 percent of the attacks being 30 minutes or less and 87 percent being one hour or less.

In 2020 Google, meanwhile, revealed a 2.5 Tbps DDoS attack on its infrastructure. In the blog post “Exponential growth in DDoS attack volumes,” Damian Menscher, Security Reliability Engineer at Google, said that Google’s infrastructure was hit by a 2.5 Tbps DDoS attack in September 2017. This 2.5 Tbps DDoS attack on Google infrastructure, Menscher said, was a culmination of a six-month campaign that utilized multiple methods of attack, simultaneously targeting Google’s thousands of IPs.

“The attacker used several networks to spoof 167 Mpps (millions of packets per second) to 180,000 exposed CLDAP, DNS, and SNMP servers, which would then send large responses to us,” Menscher said.

Top Attack Vectors

DDoS is a type of cyberattack that floods targets with gigantic traffic volumes with the aim of choking network capacity.

“While UDP attacks comprised the majority of attack vectors in Q1 of 2021, TCP overtook UDP as the top vector in Q2,” Toh of Microsoft's Azure said. “From Q1 to Q2, the proportion of UDP dropped from 44 percent to 33 percent, while the proportion of TCP increased from 48 percent to 60 percent.”

According to Toh, in Q1 of 2021, a total of 33% attack vectors came from UDP flood, 24% from TCP other flood, 21% from TCP ACK flood, 11% from UDP amplification, 7% from IP protocol flood, 3% from TCP SYN flood.

For Q2 of 2021, Toh said, a total of 23% attack vectors came from UDP flood, 29% from TCP other flood, 28% from TCP ACK flood, 10% from UDP amplification, 6% from IP protocol flood, and 3% from TCP SYN flood.

In January, Toh said, Microsoft Windows servers with Remote Desktop Protocol (RDP) enabled on UDP/3389 were being abused to launch UDP amplification attacks, with an amplification ratio of 85.9:1 and a peak at approximately 750 Gbps.

In February, Toh said, video streaming and gaming customers were getting hit by Datagram Transport Layer Security (D/TLS) attack vector which exploited UDP source port 443.

In June, Toh said, reflection attack iteration for the Simple Service Delivery Protocol (SSDP) emerged. SSDP normally uses source port 1900. The new mutation, Toh said, was either on source port 32414 or 32410, also known as Plex Media Simple Service Delivery Protocol (PMSSDP).

Cybersecurity Best Practices

Organizations with internet-exposed workloads are vulnerable to DDoS attacks. Some DDoS attacks focus on a specific target from application layer (web, DNS, and mail servers) to network layer (routers/switches and link capacity). Some DDoS attackers may not focus on a specific target, but rather, attack every IP in your organization’s network.

Microsoft and Google have their own DDoS mitigating measures that can absorb multi-terabit DDoS attacks. On the part of Google, the company said it reported thousands of vulnerable servers to their network providers, and also worked with network providers to trace the source of the spoofed packets so they could be filtered.

Small and medium-sized organizations can now avail of a DDoS protection solution that can absorb multi-terabit DDoS attacks. Today’s DDoS protection solution operates autonomously, without human intervention. Failure to protect your organization’s resources from DDoS attacks can lead to outages and loss of customer trust.

We can also help in preventing DDoS attacks from happening by ensuring that our computers and IoT devices are patched and secured.

DDoS Attackers Target VoIP Providers

Over the past few weeks, Voice over Internet Protocol (VoIP) providers have been targeted by distributed denial-of-service (DDoS) attackers.

DDoS is a form of cyberattack that often uses a botnet to attack one target. A botnet is a group of infected computers, including Internet of Things (IoT), and controlled by attackers for malicious activities such as DDoS attacks.

VoIP, meanwhile, refers to a technology that allows voice calls over an Internet connection instead of the traditional analog phone line. As VoIP uses the Internet and requires servers, portals, and gateways to be publicly accessible, this technology is a prime target of DDoS attackers.

In DDoS attacks against VoIP providers, attackers will flood VoIP servers, portals, and gateways with requests, making VoIP services unavailable to legitimate users.

Recent Attacks Against VoIP Providers

On August 31, 2021, London-based Voipfone disclosed that it was under DDoS attack.

"We have identified a further DDoS attack, we will post updates as the situation develops,” Voipfone said in a statement. “Our team is working extremely hard to address the ongoing issues that are currently affecting our network. We sincerely apologize for the disruption this must be causing you, and fully understand how frustrating this must be.”

A week after the intermittent DDoS attacks, Voipfone said it has fully resolved the DDoS attacks.

On September 16, 2021, Montreal-based VoIP.ms became the victim of a DDoS attack. On its website, VoIP.ms said it serves 80,000 customers in 125 countries.

“We have identified a large-scale Distributed Denial of Service (DDoS) attack which has been directed at our DNS and POPs,” VoIP.ms said in a statement posted on its website. “Our team is deploying continuous efforts to profile incoming attacks and mitigate them as best they can. We apologize for the inconvenience caused and thank you for your patience while we work on resolving the issue.”

The DDoS attack against VoIP.ms targeted the company’s DNS name servers. In the absence of DNS, VoIP.ms advised customers to configure their HOSTS file to point the domain at their IP address to bypass DNS resolution. In response, the attackers launched DDoS attacks directly at that IP address. To mitigate the DDoS attacks, VoIP.ms moved their website and DNS servers to Cloudflare.

As of September 28th, VoIP.ms said on its Twitter account that it’s advancing towards a more stable and secure network. The company, however, said that its main US carrier is still experiencing issues in their network which is impacting their clients all across North America.

On September 28, 2021, another VOIP provider admitted that it’s under DDoS attack. “Bandwidth and a number of critical communications service providers have been targeted by a rolling DDoS attack,” Bandwidth CEO David Morken, in a statement, said. “While we have mitigated much intended harm, we know some of you have been significantly impacted by this event. For that I am truly sorry.”

North Carolina-based Bandwidth said on its website that it provides local VoIP phone numbers together with outbound and inbound calling, powering popular platforms including Microsoft Teams/Skype for Business, Zoom Phone, and Google Voice. Bandwidth also serves as an upstream provider for VoIP vendors such as Accent.

“The upstream provider continues to acknowledge the DDoS attack is impacting their network and they are actively working to mitigate its effects,” Accent said in a statement. “Accent is seeing a limited impact to inbound calling for our services for certain phone numbers. We will continue to monitor the situation and update the status as appropriate.”

Ransom DDoS Attacks

A threat actor using the name “REvil” claimed responsibility in the VoIP.ms DDoS attack. The ransom note to VoIP.ms was posted on Pastebin. This ransom note has since been removed from Pastebin. REvil also posted updates about VoIP.ms DDoS attack on Twitter. These updates have since been removed from Twitter.

REvil demanded one bitcoin from VoIP.ms. After a failed negotiation, REvil raised the ransom demand to 100 bitcoins.

REvil originally refers to a threat group behind a number of high-profile ransomware attacks. On July 13, 2021, this group stopped its operation. In September 2021, the group resumed its ransomware operations. The original REvil group, however, hasn’t been known to launch DDoS attacks and publicly demanding ransom out of DDoS attacks.

To date, there’s no report of whether Voipfone and Bandwidth received a ransom demand similar to the one received by VoIP.ms.

Ransom DDoS (DDoS) attacks have been around for years. RDDoS attack occurs when a malicious actor extorts money from a target by threatening the target with a DDoS attack.

Threat actors may carry out a DDoS attack first and then followed by a ransom note. Another approach by threat actors is giving the ransom note first and then followed by a DDoS attack. In the last approach, the ransom note may be an empty threat with the threat actor not really capable of launching an actual DDoS attack. However, there’s a possibility that the DDoS threat is a real thing.

Paying the ransom gives ransom DDoS victims false hope that the attack will stop. Paying the ransom can only make your organization the subject of future DDoS attacks as the attackers know that your organization is willing to pay ransom. 

What we Learned from the Biggest DDoS Attack to Date: 22 Million Requests Per Second

Russian internet giant Yandex recently announced that it was hit by a record-breaking distributed denial-of-service (DDoS) attack.

“Our experts did manage to repel a record attack of nearly 22 million requests per second,” Yandex said in a statement. “This is the biggest known attack in the history of the internet.”

Mēris Botnet

In the blog post “Mēris botnet, climbing to the record,” DDoS mitigation service Qrator Lab reported that from August 7 to September 5 of this year, it recorded 5 DDoS attacks at Yandex from a botnet dubbed as "Mēris," which means "Plague" in the Latvian language. The five DDoS attacks at Yandex, Qrator Lab said, started from 5.2 million requests per second (RPS) and culminated at 21.8 million RPS.

In a DDoS attack, multiple internet-connected computers are operating as one to attack a particular target. In launching a DDoS attack, attackers often use a botnet – a group of hijacked internet-connected computers and controlled by attackers to conduct malicious activities such as DDoS attacks.

In a DDoS attack, the hijacked internet-connected computers are also attacked victims. The use of hijacked internet-connected computers results in exponentially increasing the attack power via voluminous requests sent to the target, and resulting in the initial hiding of the true source of the attack.

According to Qrator Lab, the number of infected internet-connected computers reached 250,000, and these infected internet-connected computers or devices come from only one manufacturer: Mikrotik, a Latvian network equipment manufacturer.

Qrator Lab added that the Mēris botnet used the HTTP pipelining technique in launching the DDoS attacks. “Requests pipelining (in HTTP 1.1) is the primary source of trouble for anyone who meets that particular botnet,” Qrator Lab said. “Because of the request pipelining technique, attackers could squeeze much more RPS than botnets usually do. It happened because traditional mitigation measures would, of course, block the source IP. However, some requests (about 10-20) left in the buffers are processed even after the IP is blocked.”

Based on the botnet’s attacking sources (IP addresses), Qrator Lab said that 10.9% came from Brazil, 10.9% from Indonesia, 5.9% from India, 5.2% from Bangladesh, 3.6 from Russia, and 3.3% from the United States.

In the last couple of weeks, Qrator Lab said that it has observed devastating DDoS attacks towards New Zealand, United States and Russia, which is attributed to the Mēris botnet species. “Now it can overwhelm almost any infrastructure, including some highly robust networks,” Qrator Lab said. “All this is due to the enormous RPS power that it brings along.”

Mirai Botnet

Prior to the DDoS attack at Yandex, the record-breaking DDoS attack was launched by a powerful botnet, targeting a Cloudflare customer in the financial industry. The attack reached 17.2 million requests per second.

According to Cloudflare, the said DDoS attack came from more than 20,000 bots in 125 countries around the world. Based on the botnet’s attacking sources (IP addresses), almost 15% of the attack originated from Indonesia and another 17% from India and Brazil combined.

Cloudflare said the attack was launched via a Mirai botnet. The botnet Mirai, which means “future” in Japanese, was first discovered in 2016. The Mirai botnet infects Linux-operated devices such as security cameras and routers. This botnet infects Linux-operated devices such as security cameras and routers by brute forcing known credentials such as factory default usernames and passwords. Succeeding variants of the Mirai botnet took advantage of zero-day exploits.

According to Qrator Lab researchers, they haven’t seen the malicious code, and as such, they aren’t ready to tell yet if it’s somehow related to the Mirai botnet family or not.

Preventative measures against DDoS attacks

In order to prevent your organization’s internet-connected computers or devices from being hijacked as part of a botnet, it’s important to follow these cybersecurity best practices:

• Keep these computers or devices up to date
• Use strong passwords and regularly change these passwords
• Use firewall to prevent remote access to unknown parties

According to MikroTik, Mēris botnet compromised the same routers that were compromised in 2018 via a known security vulnerability that was quickly patched. The 2018 vulnerability that was referred to is CVE-2018-14847, a MikroTik RouterOS security vulnerability that allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

“Unfortunately, closing the vulnerability does not immediately protect these routers,” MikroTik said. “If somebody got your password in 2018, just an upgrade will not help. You must also change password, re-check your firewall if it does not allow remote access to unknown parties, and look for scripts that you did not create.”

DDoS attacks, even volumetric attacks, can now be prevented autonomously, without human intervention.

Ransom DDoS Extortion On the Rise Again

A recent report from researchers at Proofpoint showed that ransom distributed denial-of-service (DDoS) extortions are on the rise again.

In the blog post “Ransom DDoS Extortion Actor 'Fancy Lazarus' Returns,” researchers at Proofpoint reported that since May 21, 2021, they've observed renewed DDoS extortion activity targeting an increasing number of industries by the threat group known as "Fancy Lazarus." In a DDoS attack, a system (website, network, application server, DNS server, and individual IP) is flooded with data requests in a bid to shut it down.

“The ransom distributed denial of service extortion threat actor known as ‘Fancy Lazarus’ is back, taking aim at an increasing number of industries, including the energy, financial, insurance, manufacturing, public utilities, and retail sectors,” researchers at Proofpoint said. “The actor [Fancy Lazarus] took over a month-long break from April to May 2021 before returning with new campaigns that include some changes to the group’s tactics, techniques, and procedures ….”

According to researchers at Proofpoint, the threat group’s latest campaign changes the group’s name to Fancy Lazarus from previous names such as “Lazarus,” “Lazarus Group,” and “Armada Collective.” The researchers found no connection between this ransom DDoS extortion group and the advanced persistent threat (APT) actors with the same names.

Ransom DDoS Extortion Prevalence

On November 1, 2019, CERT NZ reported that it received reports relating to an extortion campaign targeting companies within the financial sector in New Zealand. The extortion campaign, CERT NZ said, involved two phases. The first phase involved an email stating the name of the extortionist, the name of the target company, the deadline when the major DDoS attack will occur and the demand for a ransom to prevent it.

The second phase, according to CERT NZ, involved a demonstrative DDoS attack (typically lasting 30 minutes) against an IP address belonging to the companies’ network. CERT NZ said the DDoS techniques used in the demonstrative DDoS attack, include targeting services using the following protocols:

Hyper Text Transfer Protocol (HTTP)

Web Service Dynamic Discovery (WSD)

Apple’s Remote Management Service (ARMS)

Simple Service Discovery Protocol (SSDP)

Network Time Protocol (NTP)

Domain Name System (DNS)

Lightweight Directory Access Protocol (LDAP)

SYN and Internet Control Message Protocol (ICMP)

On November 15, 2019, researchers at Akamai said multiple companies have reported receiving an email demanding 2 bitcoins. Akamai said the extortion email contains a threat that if payment isn’t made before the deadline expires, the price increases by 1 bitcoin and the targeted DDoS attack will start.

“Shortly after a customer received one of these extortion emails, Akamai observed a 30Gbps attack (at peak) originating from a globally distributed botnet, where each IP sent a fraction of the overall traffic,” Akamai said. “The attackers were abusing DNS, Apple Remote Management Service (ARMS), CLDAP, TFTP, PortMap, and WS-Discovery (WSD), across the UDP protocol.”

In August 2020, the Federal Bureau of Investigation (FBI) issued an alert warning that thousands of organizations in multiple industries across the globe were targeted in the ransom DDoS extortion campaign similar to the ransom DDoS extortion campaign described by Akamai and CERT NZ. According to the FBI, DDoS "demonstration" launched by the threat group varied across institutions with some targeting a single IP address and others targeting multiple IP addresses, as well as variable peak volumes and attack length.

In the August 2020 blog post "Ransom Demands Return: New DDoS Extortion Threats From Old Actors Targeting Finance and Retail," researchers at Akamai said they’ve observed ransom DDoS attacks peak at almost 200 Gb/sec, utilizing ARMS, DNS Flood, GRE Protocol Flood, SNMP Flood, SYN Flood, and WSDiscovery Flood attacks as their main vectors.

Teresa Walsh, global head of intelligence at the Financial Services Information Sharing and Analysis Center (FS-ISAC), a cybersecurity consortium of nearly 7,000 financial companies told the Wall Street Journal last February that the global nature of the targets of the ransom DDoS extortion campaign was alarming, citing victims in North America, Latin America, Europe, the Middle East, Africa, and Asia-Pacific.

“After about four or five members raised their hands to say that they were seeing similar activity [ransom DDoS extortion], that’s when we started diving into a potential campaign against our members,” said Walsh. “This accumulated week upon week. Even months later, we were still seeing extortion emails coming through, and short-lived attacks,” Ms. Walsh said.

Ransom DDoS Extortion Campaign Modus Operandi

According to Proofpoint researchers, the ransom DDoS extortion campaign modus operandi always begins with sensational emails. The researchers said the extortion emails contain the following:

• Announcement of the name of the group
• Acknowledgment of the targeted specific company
• Threat of a DDoS attack in less than a week
• To prove that it isn’t a hoax, a small or demonstration attack will be launched on a specific IP, subnet, or autonomous system
• Threat that the maximum attack speed will be "2 Tbps”
• Threat of potential damage to the target company’s reputation and loss of internet access at their offices

It’s important to note that DDoS attack against websites, networks, application servers, DNS servers, and individual IPs is now preventable with a DDoS protection solution.

Lessons Learned Four Years After Dyn DDoS Attack

One of the perpetrators of the massive distributed denial-of-service (DDoS) attack that brought down the domain name system (DNS) provider Dyn and major websites pleaded guilty.

In a statement, the U.S. Department of Justice said that on October 21, 2016, the individual, who was a minor at the time, pleaded guilty to creating, in collaboration with other individuals, a botnet that launched several DDoS attacks and impacted the DNS provider Dyn (now owned by Oracle), as a result, taking offline for several hours a number of websites, including the websites of Sony, Spotify, Amazon, Twitter, PayPal, and Netflix.

What Is a DDoS Attack?

A DDoS attack is a type of cyberattack that overwhelms an online resource, such as a website with malicious traffic, taking down the website offline, making it unavailable to legitimate site visitors.

In overwhelming an online resource or online platform with malicious traffic, attackers use a botnet. A botnet refers to hijacked computers, including Internet of Things (IoT), and controlled by the attackers to perform malicious activities including DDoS attacks.

Based on court documents, in September and October of 2016, the attackers, including the one who recently pleaded guilty, created a botnet, which was a variant of the botnet called “Mirai,” in launching the DDoS attacks that resulted in taking down Dyn. The Mirai-variant botnet hijacked IoT devices including video cameras and recorders and turned them into “zombie robots” in launching the DDoS attacks.

"We saw both attack and legitimate traffic coming from millions of IPs across all geographies,” Scott Hilton, Dyn EVP of Product, said in a statement about the attack. “It appears the malicious attacks were sourced from at least one botnet, with the retry storm providing a false indicator of a significantly larger set of endpoints than we now know it to be. We are still working on analyzing the data but the estimate at the time of this report is up to 100,000 malicious endpoints. We are able to confirm that a significant volume of attack traffic originated from Mirai-based botnets.”

Role of Domain Name System (DNS) Resolver

Domain Name System (DNS) is one of the infrastructural services that most modern websites critically rely on when servicing web requests.

In searching the internet, users type into the web browsers words such as espn.com. Web browsers interact with Internet Protocol (IP) addresses – referring to addresses that are too complex for users to memorize such as 192.168.1.1 (in IPv4), or more complex IP addresses 2400:cb00:2048:1::c629:d7a2 (in IPv6).

What DNS does is convert these domain names, for instance, espn.com into IP addresses so that web browsers can load the web content. This eliminates the need for users to memorize complex IP addresses. DNS resolver like Dyn, meanwhile, initiates the process that leads to a domain name being translated into the necessary IP address.

DNS resolvers, also known as DNS providers, aren’t immune to cyber risks such as DDoS attacks as shown in the Mirai-Dyn incident. The Mirai-Dyn incident also showed that the reliance on a single third-party DNS resolver like Dyn led to taking offline the websites relying solely on a single DNS resolver.

In the study "Analyzing Third Party Service Dependencies in Modern Web

Services: Have We Learned from the Mirai-Dyn Incident," a team of Carnegie Mellon University researchers found that despite the highly publicized Dyn outage, for the period of 2016 to 2020, 89% of the Alexa top-100K websites critically depend on third-party DNS providers, that is, if these DNS providers go down, for instance through DDoS attacks, these websites could suffer service disruption.

The Carnegie Mellon University study also found third-party critical dependencies are higher for lower-ranked websites. The Carnegie Mellon University researchers added, “Moreover, we observe that redundancy decreases with popularity; i.e., more popular websites care more about availability as compared to less popular ones.”

The DDoS attack on Dyn in 2016 showed that third-party DNS providers aren’t immune to cyber risks such as DDoS attacks that are faced by small organizations.

One lesson out of the DDoS attack on Dyn in 2016 is the need to have a backup DNS resolver or provider. Twitter, for instance, added redundancy or backup by deploying a private DNS in addition to Dyn (now Oracle). Only a few organizations, however, can do what Twitter did as many can’t afford a private DNS infrastructure.

According to Carnegie Mellon University researchers, only a small fraction of websites have DNS infrastructure backup due to the following reasons:

• Configuring for multiple providers can be non-trivial;
• Using multiple DNS providers requires provider support; and
• Only a limited number of DNS providers support or encourage backup.

DDoS Protection

DNS Amplification DDoS attack hit Dyn in 2016. Since DNS is UDP based, it opens the door to IP spoofing and amplification attack. In IP spoofing, attackers falsify the source IP header to mask their identity. UDP-based DNS also allows for an attack amplification technique in which 1Mbps of attack traffic can end up becoming 100Mbps reflected on the victim.

DDoS protection is available against DNS Amplification DDoS attacks. Imperva’s DDoS Protection for DNS is the first destination for all DNS queries. “Acting as a secure proxy, Imperva prevents illegal DNS queries from reaching your server while masking it from direct-to-IP network layer attacks,” Imperva said in a statement.

Rise of Phishing and DDoS Attacks in the Education Sector

COVID-19 resulted in the temporary shutdown of schools and universities across the world. This has given rise to online classes, whereby classes are conducted remotely and on digital platforms.

As schools and universities across the world reopen, many opt for mixed physical and online classes, while some still opting for purely online classes. The shift to online classes, however, has opened a window for malicious actors to exploit.

The shift to online classes gives rise to phishing attacks and distributed denial of service (DDoS) attacks directed against the education sector.

Phishing Campaigns

Phishing is one of the oldest and popular forms of cybercrimes. In a phishing campaign, intended victims, whether targeted or random individuals, are tricked into clicking something leading to the stealing of data or the downloading of malicious software (malware).

Microsoft Security Intelligence has found that as of September 7, 2020, out of the nearly 8.7 million malware encounters reported in the last 30 days, 59.84% came from the education sector, making it the most affected sector.

In the report “Digital Education: The cyberrisks of the online classroom”, Kaspersky Lab said that attackers lure victims in downloading malware by bundling fake versions of popular video meeting apps and online course platforms as legitimate application installers. Victims encounter these fake video meeting apps and online course platform installers through phishing websites – referring to sites designed to look like legitimate websites supposedly for downloading popular video meeting apps and online course platform app installers.

Another way by which victims encounter these fake video meeting apps and online course platform installers is through phishing emails that masquerade as special offers or notifications. Downloading of the fake video meeting apps and online course platform installers either from phishing websites or phishing emails could lead to the installation and running of malicious software on the victim’s computer or stealing of sensitive data.

In April of this year, researchers at Check Point reported that in just a span of 3 weeks, nearly 2,500 new websites relating to the video conferencing app Zoom were registered. Out of these 2,500 new Zoom-related websites, 1.5% of these websites were found as malicious and the other 13% were found as suspicious. The researchers added that cybercriminals impersonated other video conferencing apps such as Microsoft Teams and Google Meet.

Researchers at Check Point reported that victims fell prey to phishing emails that came with the subject “You have been added to a team in Microsoft Teams“. The phishing emails contained a malicious website URL, which on the first glance looks similar to the legitimate Microsoft Teams URL. A double-check, however, of this URL shows that this URL is a fake one and victims who landed on this fake Microsoft Team site ended up downloading a malware.

Distributed Denial-of-Service (DDoS) Attacks

In a DDoS attack, a botnet – referring to a network of computers infected with self-propagating malware – is used by an attacker in overwhelming the target or its surrounding infrastructure with a flood of internet traffic. According to Kaspersky Lab, between January 2020 and June 2020, the number of DDoS attacks affecting the education sector increased by at least 350% when compared to the corresponding month in 2019.

Authorities recently arrested a 16-year-old in connection with a series of DDoS attacks on Miami-Dade County Public Schools that disrupted the district's first week of online classes. The teenager admitted to launching the DDoS attacks using Low Orbit Ion Cannon (LOIC).

LOIC is a decade-old application developed originally used for network stress testing. Since becoming an open-source application it has been used for malicious activities such as DDoS attacks. A successful DDoS attack using LOIC floods a target server with TCP, UDP, or HTTP packets with the goal of disrupting service.

A DDoS attack via LOIC uses IRC chat channels to run a “Hivemind” version of the LOIC. This allows a primary user of the IRC chat to control secondary computers, creating a botnet – referring to a network of computers controlled by the primary user for malicious activities such as DDoS.

LOIC was used in the past to launch DDoS attacks against Visa and MasterCard websites in response to the freezing of payments to WikiLeaks. The thing about using LOIC in launching DDoS attacks is that attackers are unable to hide their IP addresses, making it easy for authorities to track them down. Due to this IP address visibility, authorities in many countries have taken legal actions against DDoS attackers leveraging LOIC. 

Preventive and Mitigating Measures Against Phishing and DDoS Attacks

To stay safe from phishing attacks, be wary of clicking anything online as these could lead you to phishing sites. Also double-check URLs as a difference in one letter or character could lead you to a malicious site.

To stay safe against DDoS attacks, including DDoS attacks leveraging LOIC, use WAF, short for Web Application Firewall. WAF specifically provides strong protection against HTTP floods. As protection against TCP and UDP, use a dedicated DDoS protection.

DDoS Extortions Return

Over the past few weeks, a group of cybercriminals has launched distributed denial-of-service (DDoS) attacks targeting companies in the finance and retail sectors and demanding ransom payment for the attacks to stop.

In the blog post "Ransom Demands Return: New DDoS Extortion Threats From Old Actors Targeting Finance and Retail", Akamai reported that over the past few weeks, a series of DDoS attacks from the so-called "Armada Collective" and "Fancy Bear" actors have targeted businesses across multiple sectors, including finance and retail, and these DDoS attacks come with extortion demands. Some of the attacks peaked at almost 200 gigabyte per second (GB/s), Akamai said.

ZDNet likewise reported that in the past weeks, a criminal group that goes with the names "Armada Collective" and "Fancy Bear" has launched DDoS attacks against some of the biggest financial service providers and demanded payments in the form of the cryptocurrency bitcoin as extortion fees to stop the DDoS attacks.

Incidentally, a few days ago, the operations of the New Zealand stock exchange were disrupted as a result of a DDoS attack. Other than the comment that the attack came from overseas, authorities in New Zealand won't comment on whether or not the DDoS attack also involved a ransom demand.

Evolution of DDoS Extortions

DDoS extortion is nothing new. This type of extortion has been around in the last few years. The recent DDoS extortions, however, differ with the older DDoS extortions in terms of methods and severity.

The recent DDoS extortion campaign described by Akamai and ZDNet resembled that the type of DDoS extortion campaign described in the alert entitled "DDoS extortion campaign targeting financial sector" released on November 1, 2019 by the Computer Emergency Response Team New Zealand (CERT NZ). 

According to CERT NZ, it received reports relating to a DDoS extortion campaign targeting companies within the financial sector in New Zealand. This extortion campaign had also been observed in other countries, CERT NZ said. As described by CERT NZ, the DDoS extortion campaign followed these steps:

First, the target company receives an email stating “We are the Fancy Bear and we have chosen [Company Name] as a target for our next DDoS attack.” In the email, the attackers give the target company a deadline when the major DDoS will happen and demand from the target ransom to prevent the said major DDoS attack.

Second, to threaten the target that the major DDoS attack is coming, a minor DDoS is launched against an IP address belonging to the company's network. These demo attacks generally last for 30 minutes.

In the DDoS extortion campaign observed by Akamai, the targets were warned that going public about the extortion demand will result in the immediate major DDoS attack. The extortion demand also threatens the targets that the major attack will make websites and other connected services "unavailable for everyone" and will harm the target's reputation.

While past DDoS extortion campaigns targeted the victims' websites, the recent extortion campaign described by CERT NZ, Akamai and ZDNet targeted the victims' backend infrastructure, resulting in prolonged and severe outages. An example of a backend infrastructure is the DDoS attack on the target's web hosting provider resulting in the outages of the ultimate target's website.

In the case of the attack of the New Zealand stock exchange, the stock exchange's web hosting provider Spark was targeted in a series of DDoS attacks, resulting in the outages at the New Zealand stock exchange as well as downtime of the websites of Spark's other customers.

Reflective DDoS Techniques

In the November 2019 alert, the CERT NZ said that the so-called Fancy Bear threat group overwhelms the target using a variety of reflective DDoS techniques, with targets including services using the following protocols:

• Hyper Text Transfer Protocol (HTTP)
• Web Service Dynamic Discovery (WSD)
• Apple’s Remote Management Service (ARMS)
• Simple Service Discovery Protocol (SSDP)
• Network Time Protocol (NTP)
• Domain Name System (DNS)
• Lightweight Directory Access Protocol (LDAP)
• SYN and Internet Control Message Protocol (ICMP)

A reflective DDoS technique is a DDoS attack that depends on publicly accessible UDP servers to overwhelm a victim’s system with UDP traffic. UDP, short for User Datagram Protocol, is an internet communication protocol for time-sensitive transmissions such as video chat. UDP is designed not to validate source Internet Protocol (IP) addresses for the protocol to operate very quickly. This, however, creates an exploitation opportunity for attackers.

In general, in a reflective DDoS attack, an attacker who’s capable to spoof IP addresses sends fake requests to a vulnerable UDP server. The UDP server, not knowing the request is fake, prepares the response. These UDP responses are delivered to an unsuspecting target, overwhelming the target’s resources such as the network itself.

Best Practices Against DDoS Extortions

It’s recommended not to pay ransom to DDoS extortionists. Ransom payment only encourages extortionists to attack your organization again.

Like any other types of DDoS attacks, in DDoS attacks using reflective techniques, two groups are exploited by the attackers: the ultimate target and vulnerable computers, in this case, vulnerable UDP servers. In order to prevent your organization’s computers from being used for reflective DDoS attacks, it’s best to stop using UDP when not needed. If UDP is needed, configure it to always respond with smaller packet size. It’s also important to use a Firewall.

To protect your organization from being the ultimate target of a reflective DDoS attack, it’s best to work with your trusted cybersecurity service provider and use a DDoS protection service to prevent the DDoS traffic from reaching your organization’s systems.

The Driz Group specialized in DDoS protection and can mitigate the DDoS attack in just a few minutes.

Don’t pay ransom and protect your website and web applications today by calling us at 1.888.900.DRIZ (3749) or email us at [email protected]

How DDoS Threat Landscape Has Evolved Over Time

Through the years, distributed denial-of-service (DDoS) – a form of cyberattack originating from multiple systems and overwhelming one specific service or website using malicious data or requests – has evolved and grown stronger and more prevalent.

Evolution of the DDoS Threat Landscape

The Morris Worm

DDoS threat has been around ever since humanity decided to interconnect computers. The malicious software dubbed as “Morris worm”, which was unleashed prior to the invention of the World Wide Web, is considered by some as the first DDoS attack.

Morris worm replicated a copy of itself and propagated itself at a remarkable speed to computers belonging to a number of the prestigious colleges and public and private research centers that made up the ARPANET – an early prototype for the internet. On November 2, 1988, in just 24 hours, the Morris worm affected an estimated 6,000 of the approximately 60,000 computers that were then connected to ARPANET.

The unleashing of the Morris worm resulted in slowing to a crawl vital military and university functions and delayed emails for days. The creator of the Morris worm, then 23-year-old Cornell University graduate student Robert Tappan Morris unleashed out the worm by exploiting security vulnerabilities in a specific version of the Unix operating system. The worm was also unleashed by attempting to break into user accounts on an infected machine using brute force attacks, that is, guessing weak passwords similar to modern-day brute force attacks.

MafiaBoy DDoS Attack

While not the first DDoS attack in the World Wide Web era, the DDoS attacks carried out by MafiaBoy, then 15-year old Michael Calce from Montreal, Canada, were notable as this teenager launched a series of high-profile DDoS attacks in February 2000 against large commercial websites, including eBay, Amazon and E*Trade. In carrying out his DDoS attacks, Calce modified the code written by another hacker. Calce compromised nearly 200 university networks and brought this under his control to launch DDoS attacks against specific targets.

In the book "Mafiaboy: A Portrait of the Hacker as a Young Man", Calce wrote that he scanned the internet for university-owned servers withsecurity weaknesses that he could exploit. "Once I found at least one, I ran a program I had found called Hunter to hijack that computer's connection."

Mirai

In the age of Internet of Things (IoT), the DDoS attacks carried out Mirai stand out. Mirai is a malicious software (malware) that compromises poorly secured IoT devices such as wireless routers and security cameras into a botnet to conduct large-scale DDoS attacks. A botnet refers to a network of compromised computers coordinating as one to carry out instructions at the direction of their master – a malicious threat actor.

On September 30, 2016, Mirai source code was leaked online by one of its authors, Paras Jha. The Mirai source code was later used by different malicious actors in launching DDoS attacks.

Mirai exploits the habit of IoT users of not changing the default login details. At its height, nearly 400,000 IoT devices were hijacked by Mirai for DDoS attacks.

One notable DDoS attack utilizing the Mirai source code was the DDoS attack on internet infrastructure services provider Dyn DNS (now Oracle DYN) in October 2016. The DDoS attack on this internet infrastructure, which enslaved 100,000 devices including IP cameras and printers, disrupted the services of major websites such as Amazon, Netflix, Reddit, Spotify and Twitter.

Memcached-Based DDoS Attacks

In February 2018, DDoS attackers used a new attack method that exploited a lesser number of devices but produced a bigger punch. GitHub reported on February 28, 2018 that GitHub.com was unavailable from 17:21 to 17:26 UTC and intermittently unavailable from 17:26 to 17:30 UTC due to a DDoS attack. The DDoS attack on GitHub peaked at 1.35 Tbps – then setting the record of the largest DDoS attack.

In analyzing the DDoS attack on GitHub, Cloudflare reported that the attack on GitHub exploited 5,729 memcached servers that were inadvertently made accessible on the internet. Memcached is an open-source distributed memory caching system for speeding up applications.

"Launching such an attack [by exploiting Memcached] is easy," Cloudflare said. "First the attacker implants a large payload on an exposed memcached server. Then, the attacker spoofs the 'get' request message with target Source IP. In practice, we've seen a 15 byte request result in a 750kB response (that's a 51,200x amplification)."

With nearly 100,000 Memcached servers exposed to the internet, Cloudflare said at that time that it's expecting to see much larger attacks in the future.

Days after the GitHub attack, NetScout reported an even larger DDoS attack, victimizing a US-based service provider. This time peaking at 1.7Tbps. "The attack utilized a Memcached ... Reflection & Amplification vector to accomplish such a massive attack," NetScout said.

CLDAP-Based DDoS Attack

In the 1st quarter of 2020, Amazon reported that in February of this year, it detected and mitigated a DDoS attack targeting an AWS customer. The DDoS attack, Amazon said, peaked at 2.3 Tbps and caused three days of “elevated threat".

According to Amazon, the DDoS attack on one of its AWS customers exploited Connection-less Lightweight Directory Access Protocol (CLDAP) web servers. CLDAP is used to connect, search, and modify internet-shared directories. DDoS attackers have made CLDAPexploitation as part of their arsenal since 2016.

Imperva's 2019 Global DDoS Threat Landscape Report found that large-scale DDoS attacks were outside of the norm. "Overall, we saw attacks that were smaller, shorter, and more persistent," Imperva said. "While this trend may be indicative of attackers’ attempts to wreak havoc before a mitigation service kicks in, it’s no match for Imperva, where time to mitigation is near zero."

Many companies that call us have fallen victim to a DDoS attack, and paid ransom to cybercriminals to stop the attacks and resume normal business operations.

Protect your website, web applications and your network today and avoid costly business interruptions.

Using state of the art technology, our team will mitigate a DDoS attack in just 10-seconds, protecting your revenues, your assets and your reputation.

Call today 1.888.900.DRIZ (3749) or contact us online.

Amazon Records 2.3 Tbps DDoS Attack, Largest To Date

Amazon recently revealed that it detected and mitigated the largest distributed denial-of-service (DDoS) attack to date, targeting one of Amazon Web Services (AWS) customers.

In the "AWS Shield Threat Landscape Report – Q1 2020", Amazon said its threat protection service called "AWS Shield" detected and mitigated a DDoS attack in one of AWS customers with a previously unseen volume of 2.3 Tbps (terabytes per second). TBps refers to a data transmission rate equivalent to 1,000 gigabytes or 1,000,000,000,000 bytes per second.

In March 2018, NETSCOUT Arbor reported that it detected and mitigated the previous record holder for the largest DDoS attack which peaked at 1.7 Tbps, an attack targeted at a customer of a U.S. based service provider. The 1.7 Tbps DDoS attack came just heels after the previous record holder of the largest DDoS attack – an attack that specifically targeted GitHub in February 2018.

The AWS DDoS Attack

In a DDoS attack, multiple computers act as one unit to attack one target. Attackers often hijack and take control of vulnerable computers for the purpose of DDoS attacks by taking advantage of the security vulnerabilities or misconfigurations on these computers.

According to Amazon, the DDoS attack that targeted one of the company's AWS customers "caused 3 days of elevated threat during a single week in February 2020 before subsiding". Amazon said that the unnamed DDoS attacker or attackers utilized an amplification technique that takes advantage of the Connectionless Lightweight Directory Access Protocol (CLDAP) in launching the DDoS attack.

CLDAP is a cross-platform protocol and often used on Microsoft Active Directory networks to retrieve server information. From October 2016 to January 2017, Akamai reported that it detected and mitigated a total of 50 CLDAP reflection attacks, 33 of which exclusively used CLDAP reflection.

On January 7, 2017, Akamai said it detected and mitigated the largest DDoS attack using CLDAP reflection as the sole vector at the time, reaching peak bandwidth of 24 gigabytes per second (GBps), and peak packets per second of 2 million packets per second. Akamai added that the CLDAP protocol allows DDoS attacks to amplify 56 to 70 times.

"The query payload is only 52 bytes ...," Akamai said regarding thisJanuary 7, 2017 CLDAP reflection DDoS attack. "This means that, the Base Amplification Factor (baf) for the attack data payload of 3,662 bytes, and a query payload of 52 bytes, was 70x, although only one host was revealed to exhibit that response size. Post attack analysis showed that the average amplification during this attack was 56.89x."

The DDoS attack detected and mitigated by NETSCOUT Arbor and the DDoS attack on GitHub in 2018, meanwhile, were launched by taking advantage of internet-exposed Memcached protocol – a general-purpose distributed memory-caching system. Attack vectors of the topmost DDoS attacks are often used by DDoS-for-hire services in launching DDoS attacks.

In the case of the DDoS attack on GitHub, the amplification factor reached up to 51 times, which means that for each byte sent by the DDoS attacker, up to 51KB is sent toward the target. At the time of the GitHub DDoS attack, Shodan – a search engine that allows users to find specific types of computers connected to the internet using filters – reported 88,000 internet-exposed memcached servers.

In 2018, DDoS-for-hire services took advantage of the close to 100,000 memcached servers exposed to the internet. Since 2016 also, DDoS-for-hire services have been taking advantage of exposed CLDAP protocol.

In taking advantage of vulnerable computers with higher amplification or reflection factor, significant attack bandwidth can be produced with fewer compromised computers. Taking advantage of servers using CLDAP protocol and memcached protocol for reflection/amplification DDoS attacks work the same by sending spoofed requests to a vulnerable server, which then responds with a larger amount of data than the initial spoofed request, amplifying the volume of traffic.

Preventive and Mitigating Measures Against DDoS Attacks

DDoS attacks that are taking advantage of the CLDAP protocol start with servers that are exposed to the internet with port 389 open and listening. DDoS attackers simply scan the internet for these open port 389 and add these to a list of amplifiers or reflectors.

Don't be a part of the bigger DDoS reflection/amplification problem. If your organization doesn't need the CLDAP protocol, close this DDoS amplification egress by not exposing this protocol to the internet, that is, by blocking port 389. In the case of DDoS attacks taking advantage of exposed memcached servers, one of the prevented measures in preventing attackers in hijacking memcached servers for DDoS attacks is by disabling UDP.

Most often, however, DDoS attacks don’t reach the terabyte. According to Amazon, most of the DDoS events involving CLDAP protocol in the first quarter of 2020 was 43 Gbps.

While many DDoS attacks are non-terabyte attacks, such attacks still disrupt normal business operations and denying legitimate users access to victims’ IT infrastructure. Imperva’s 2019 Global DDoS Threat Landscape Report showed that most DDoS attacks were short, with 51% lasting less than 15 minutes. While most DDoS attacks were short, Imperva reported that the vast majority of DDoS attacks were persistent and aimed at the same targets. “Attackers either launched DDoS assaults in short streaks – two-thirds of targets were attacked up to five times – or were ultra-persistent, with a quarter of targets attacked 10 times or more,” Imperva reported.

When you need help, our team of experts is a phone call away. To mitigate the risks of DDoS attacks, call today 1.888.900.DRIZ (3749) or contact us online.