Communications service providers were targeted by 65.5 percent of DDoS attacks in the third quarter of 2018 according to a new report.
The Q3 2018 Threat Report from Nexusguard shows attackers contaminated a diverse pool of IP addresses across hundreds of IP prefixes by using very small-sized junk traffic.
"Perpetrators are using smaller, bit-and-piece methods to inject junk into legitimate traffic, causing attacks to bypass detection rather than sounding alarms with large, obvious attack spikes," says Juniman Kasman, chief technology officer for Nexusguard. "Diffused traffic can cause communications service providers to easily miss large-scale DDoS attacks in the making, which is why these organizations will need to share the load with the cloud at the network edge to minimize attack impact."
Nexusguard analysts believe that attackers conducted reconnaissance missions to map out the network landscape and identify the mission-critical IP ranges of targeted CSPs. Then they injected bits and pieces of junk into legitimate traffic, whose size easily bypassed detection thresholds.
These attacks often used open domain name system (DNS) resolvers to launch what is commonly known as DNS Amplification, whereby a targeted IP address receives only a small number of responses in each well-organized campaign, leaving little or no trace
The Q3 2018 Threat Report from Nexusguard shows attackers contaminated a diverse pool of IP addresses across hundreds of IP prefixes by using very small-sized junk traffic.
"Perpetrators are using smaller, bit-and-piece methods to inject junk into legitimate traffic, causing attacks to bypass detection rather than sounding alarms with large, obvious attack spikes," says Juniman Kasman, chief technology officer for Nexusguard. "Diffused traffic can cause communications service providers to easily miss large-scale DDoS attacks in the making, which is why these organizations will need to share the load with the cloud at the network edge to minimize attack impact."
Nexusguard analysts believe that attackers conducted reconnaissance missions to map out the network landscape and identify the mission-critical IP ranges of targeted CSPs. Then they injected bits and pieces of junk into legitimate traffic, whose size easily bypassed detection thresholds.
These attacks often used open domain name system (DNS) resolvers to launch what is commonly known as DNS Amplification, whereby a targeted IP address receives only a small number of responses in each well-organized campaign, leaving little or no trace
Among other findings of the report are that China advanced its lead in global attack origins, contributing more than 23 percent of worldwide campaigns. 15 percent of attacks originated in the US.
It also shows that Simple Service Discovery Protocol (SSDP) amplification attacks rose 639.8 percent compared to Q2 2018 as a result of the new pattern targeting CSPs.