They say there’s comfort in consistency. So in our world of fleeting internet fads where one day Vine is a thing and the next day it isn’t, where the name William Hung once garnered more than the furrowed brow of vague recognition, and where there is a new Person We All Love and Person We All Hate every literal minute, cyber stalwarts like DDoS attacks – which have abounded for over 15 years – should be of great comfort to us all. On the other hand, it could be that those pithy sayings “they” come up with are often wildly inaccurate.
It’s one of the two.
Here’s what you need to know right now about this year’s crop of DDoS attacks…so far.
1. Short is not sweet
According to the Q1 DDoS threat landscape report from denial of service attack experts Incapsula, in the first quarter of the year 80% of all attacks lasted less than one hour, while 90% of network layer attacks lasted less than half an hour.
Attacks characterized by short, low-volume bursts are generally the work of DDoS for hire services, delightful botnet rentals that allow anyone on the internet willing to spend a bit of money to lash out with DDoS attacks at any sites they so choose. As such, these services tend to be used by those seeking revenge, or by those looking to earn some quick cash by DDoS ransom notes.
While major enterprises with professional-level protection have zero reason to be shaking in their boots when it comes to these booters and stressers, many smaller sites and businesses have paid the price for thinking they aren’t big enough to be targeted by these attacks.
2. Short is really not sweet
Coming in hot from Q2 2017 are reports of a new type of attack, the so-called pulse wave DDoS attack. Unlike most DDoS attacks which have a distinct ramp-up period, pulse wave attacks come from botnets that are already running at full capacity, allowing them to immediately smash a target with enough traffic to clog the network.
The attack occurs in short bursts that ease off quickly and then come slamming back in again in regular intervals, often just several minutes apart, helping to ensure that the struggling network can’t fully recover.
These attacks have seemingly been designed to render appliance-first hybrid DDoS mitigation systems largely useless as the clogged network ensures the appliance can’t activate the cloud-based scrubbing server to deal with attack traffic. Thus far, these very professional attacks have targeted organizations in highly competitive industries such as online gaming and fintech.
3. The more the merrier? Not so much
At least not when it comes to distributed denial of service attack vectors as each additional vector makes an attack that much harder to defend against. According to the Incapsula threat landscape report, 40.5% of network layer DDoS attacks are multi-vector. This is an increase of 11% from the last quarter of 2016.
So while the low average attack time cited above points to an increase in attacks levied by non-professional offenders, both the pulse wave attacks and these multi-vector attacks indicate that professional DDoS attackers are still very much making moves, causing downtime and hurting businesses. Real go-getters they are.
4. The more the merrier? Again, not so much
Sometimes when a bad thing happens you tend to think the odds of that bad thing happening again are very slim. If you drove into a tree, when you started driving again you would probably not drive into anything for a while because you would be concentrating so hard on not doing that dumb thing you did before.
However! Whether or not your website is targeted by a distributed denial of service attack is, unfortunately, out of your control, and when it’s hit once, statistics says it’s going to be hit again. According to Incapsula, 74% of websites that were targeted by a DDoS attack in the first quarter were targeted more than once, and 19% ended up in the crosshairs more than ten times.
5. It’s time for professional protection
The time to invest in professional DDoS mitigation was actually several years ago, but today is also a good day to start. To summarize a few of the major points of 2017 so far, DDoS for hire services are raking in the cash and blasting attacks indiscriminately all over the internet, professional attackers are using multiple vectors and also inventing entirely new types of DDoS attacks, and websites that are targeted are going to be targeted again…and possibly again and again and again.
Best you take care of it now instead of waiting to find out if the saying what doesn’t kill you makes you stronger is true.