The latest report by Kaspersky Lab’s DDOS Intelligence Report for Q4 2015 reveals fourth quarter saw the longest botnet-based DDoS attack in 2015, which lasted more than two weeks.
The reporting period was marked by a decrease in the number of countries where resources are targeted as well as by new attack channels used by cybercriminals to disable resources.
Resources in 69 countries were targeted by botnet-assisted attacks (compared to 79 in Q3). As in the previous quarter, the vast majority of attacks (94.9%) took place in just 10 countries. There were some minor changes among the leaders in Q4, but China, South Korea and the US remained the worst-affected countries.
The longest DDoS attack in Q4 lasted 371 hours (or 15.5 days) – a record for 2015. During the reporting period cybercriminals launched attacks using bots from different families. In Q3, the proportion of such complex attacks was 0.7%, while in the final three months of the year it reached 2.5%. The popularity of Linux bots also continued to grow – from 45.6% to 54.8% of all DDoS attacks registered in Q4 2015.
Among other trends observed in Q4 were new channels for carrying out reflection DDoS attacks that exploit weaknesses in a third party’s configuration to amplify an attack. In particular, the fourth quarter saw cybercriminals send traffic to targeted sites via NetBIOS name servers, domain controller PRC services connected via a dynamic port, and to WD Sentinel licensing servers. The attackers also continued to use IoT devices – for example, researchers identified about 900 CCTV cameras around the world that formed a botnet used for DDoS attacks.
“We can see that the complexity and the power of DDoS attacks have not diminished with time, even if the number of attacked resources has fallen. Unfortunately, DDoS remains a convenient and affordable tool for online crime because there are still software vulnerabilities that attackers can use to penetrate servers. There are also users who fail to protect their devices, increasing the chances of those devices being infected by bots. For our part, we are committed to providing businesses with information about the DDoS threat and promoting the fight against it, because DDoS is a threat that can and should be combated,” comments Evgeny Vigovsky, Head of Kaspersky DDoS Protection, Kaspersky Lab.