DDoS attacks surging behind new techniques, geopolitical goals

Geopolitical goals advance DDoS attacks

In addition to the growth in attack surface, vendors identified an array of factors that contributed to the increasing DDoS danger. Steve Winterfeld, advisory CISO at Akamai, narrowed it down to three primary sources, including more systems being compromised to become part of botnet armies, which he said mainly comprise IoT and connected devices.

Secondly, he told TechTarget Editorial that cybercriminals are offering more DDoS tools and IaaS, which lowers the skill set necessary to conduct an attack. Thirdly, more nation-state threat groups are leveraging DDoS attacks to attain political goals.

"Furthermore, the attacks follow the money, so they launch attacks on the most critical assets -- websites and APIs. As we transition to greater employee and customer engagement online, these protections are more critical than ever," Winterfeld said.

Eyal Arazi, senior security solutions lead at Radware, agreed that geopolitical motives have played a significant role in the uptick in DDoS attacks. Radware observed a 150% increase in the number of DDoS attacks between 2021 and 2022. The cybersecurity vendor mitigated one attack that occurred between February and April that generated 15 billion requests in aggregate.

The new wave of powerful attacks traces its origins to the Russian invasion of Ukraine in February 2022, he said, particularly linked to Russian state-sponsored groups such as Killnet and NoName. Backed by the state, the groups, including Anonymous Sudan, have the resources to build bigger and more powerful botnets, and now that knowledge is spilling over.

Arazi said there's been a wave of politically motivated DDoS attacks against Israel, India, Australia and other countries. Radware's threat intelligence discovered more than 1,800 DDoS attacks claimed by hacktivists between mid-February to mid-April.

One significant concern he presented is how the new attacks masquerade as legitimate traffic because they're encrypted with HTTPS, which makes it harder for mitigation services to detect malicious requests.

"One of the biggest changes in these new attacks is the shift to Layer 7 DDoS attacks, and particularly to HTTP/S DDoS attacks," Arazi said. "This shift has introduced a new level of complexity and enabled attackers to launch far more devastating attacks than ever before. These attacks are high in requests per second and sophisticated in behavior, masquerading as legit traffic and going unnoticed upon decryption."

DDoS attacks are particularly popular among politically motivated cybercriminals where disruption is the goal. Mike Parkin, senior technical engineer at risk management vendor Vulcan Cyber, said that given the current geopolitical situation, he's not surprised to see sophisticated and highly disruptive attacks. "That said, cybercriminals will still sometimes use a DDoS and demand payment to turn it off, while state-level threats may use ransomware to conceal their motives," Parkin told TechTarget Editorial.

Current mitigations were designed to defend against volume attacks, but Parkin noted how threat actors have moved past simple flooding to more sophisticated techniques. One more advanced method involves the attacker using the web server's behavior against it.

"Rather than 100,000 bots sending a flood, I have 50 of them sending simple queries in rapid succession that hammer the target's resources. It's even worse when the attacker finds their way past a content distribution network and hits the source servers directly," Parkin said.

Revamp mitigation strategies

The DDoS attacks against Microsoft this month highlighted holes in current mitigation efforts. In an effort to curb the attacks, Microsoft recommended customers configure their Azure web application firewall to enable bot protection and block malicious IP addresses. Some security experts questioned why customers needed to take action when the tech giant was the organization under attack.

But Arazi said the problem is not with Microsoft itself, but the entire traditional approach to DDoS protection. While most DDoS mitigations rely on static signatures of known attacks and apply brute-force mitigation techniques, the new generation of attack tools uses evasion techniques such as randomized header parameters, dynamic request arguments, IP spoofing and more.

"Traditionally, DDoS mitigation solutions concentrated on Layer 3 and 4 to protect against volumetric network layer attacks. However, when you launch attacks in the application layer, it is very difficult to distinguish between a legitimate request and a malicious request," Arazi said. "Moreover, most web traffic today is encrypted under HTTPS, which means by default that the payload of the packet is encrypted to an outside observer. This makes it even harder for traditional mitigation tools to identify malicious requests."

John Grady, senior analyst at TechTarget's Enterprise Strategy Group, said Layer 7 DDoS attacks are typically less powerful but harder to mitigate because they specifically target legitimate application processes. And given the amount of computing resources, tools and techniques available to threat actors, they can use multiple approaches -- as Storm-1359 did against Microsoft -- to cause prolonged disruptions.

"These horizontal or carpet-bombing attacks force security teams to assess a wider set of resources to understand what's going on and determine how to remediate," Grady said.

Because attack patterns are constantly changing, Arazi said the new approach should be based on dynamic behavioral detection and mitigation.

Emerging DDoS threats were highlighted in Akamai's June blog post. One attack vector, which the vendor dubbed "PhoneHome," is a new reflection DDoS vector with a "record-breaking potential amplification ratio." Akamai observed PhoneHome deployed in the wild to launch multiple DDoS attacks. The second, named "TCP Middlebox Reflection," Akamai classified as an amplification vector. It exploits corporate and national firewalls to reflect traffic against a victim.

To protect against emerging vectors, Akamai recommended reviewing critical subnet and IP spaces, ensuring DDoS security controls are in an "always-on" mitigation posture, and having a crisis response team with an incident response plan ready.

"Bottom line: It is important to test your DDoS protections and validate your playbooks before you are hit," Winterfeld said.

Arielle Waldman is a Boston-based reporter covering enterprise security news.