Public Cloud Services Increasingly Exploited to Supercharge DDoS Attacks: New Link11 Research
Cloud services from leading providers including AWS, Microsoft Azure and Alibaba used in 25% of all DDoS attacks in Europe from July 2017 to June 2018
DDoS attackers are increasingly abusing public cloud services to launch attacks, according to new research from Link11, a leader in cloud-based anti-DDoS protection. Data from Link11’s Security Operation Center (LSOC) shows that a quarter of all DDoS attacks in Europe in the 12 months from July 2017 to June 2018 used cloud server-based based botnets, compared to 18.5% in the previous 12 months – a 35% increase.
During the 12 months to June 2018, Microsoft Azure was the cloud service most exploited for DDoS attacks, with 38.7% of such attacks using Azure servers on average. Amazon Web Services (AWS) was used in 32.7% of attacks on average, and Alibaba servers used in 17.9% of attacks. Google servers were abused much less often, used in only 10.7% of attacks.
According to Link11, cloud server-based botnets are the ideal platform for launching DDoS attacks. Cloud instances generally offer bandwidths of between 1 and 10 Gbps, enabling attack volumes which can be as much as 1000 times higher than is possible with individual compromised devices such as home routers or IoT cameras. The LSOC reported that the peak attack volumes of these cloud-based attacks exceeded 150 Gbps in May. Cloud servers provide memcached or SSDP services, which amplify attack volumes.
Aatish Pattni, Regional Director UK & Ireland for Link11 said: “The people behind DDoS attacks are embracing the use of public cloud services for the same reasons as legitimate organizations: the services provide flexible, on-demand capacity and resources, and can be provisioned in just a few minutes.
“For threat actors, the benefits are even more compelling because they will often use stolen credit card details and false identities to pay for the services. This makes the perpetrators almost impossible to trace, even though providers such as Amazon are taking strong action against misuse, and asking users to report any suspected abuse of their services.”
To protect against DDoS attacks launched using public cloud services, blocking traffic from these services is not an option for many organizations because they will already be using public cloud as part of their own IT infrastructures.
Instead, organizations should analyze in detail the communication between public cloud services and their own network, and monitor for malicious or unwanted traffic. Ongoing analysis of data traffic, using machine-learning techniques, enables legitimate traffic to be profiled and fingerprinted, so that any changes can be detected quickly and reliably. The malicious traffic can then be filtered out in a granular manner before it can impact on the organization’s business, without blocking legitimate traffic.
Current articles
Stay updated on current DDoS reports, warnings, and news about IT security, cybercrime and DDoS protection.
Follow Link11 on Twitter
Allianz: More than 600 million Euros in losses due to Cyber-Extortion via #DDoS Attacks and #Ransomware.…
2 Retweets 0
Read MoreWhat does the end of the Privacy Shield means really for CDN users? Things have changed dramatically regarding data…
1 Retweets 2
Read MoreRT @CSOonline: How #DDoS attacks are evolving — Denial-of-service attacks have been part of the criminal toolbox for 20 years, and they’re…
8 Retweets 0
DDoS attacks and ransomware lead to increasing losses from cyber extortion. Our new blog article takes a detailed l…
3 Retweets 0
Read MoreRT @MarcWilczek: The average cost of a #databreach equals $116 million. Sensitivity of customer information and time-to-detection determine…
6 Retweets 0
Our COO Marc Wilczek takes a look at the current security situation and explains why the threat is not only omnipre…
3 Retweets 1
Read MoreRT @MarcWilczek: 639 #cybersecurity breaches at public comps analyzed, #malware (34%), #phishing (25%), & unauthorized access (20%) were th…
5 Retweets 0
RT @MarcWilczek: #Link11 keeps hiring and expanding. With great pleasure, I want to warmly welcome both Susan Herrmann and Peter Hoeld on b…
6 Retweets 0
Valentine's day is just around the corner! Our latest blog post takes a look at the challenges, threats and potenti…
3 Retweets 2
Read Morehttps://t.co/Z9lFjVwVs5 Fresh from the press. ⭐ With the acquisition of DOSarrest Internet Security LTD, we are loo…
2 Retweets 8
Read MoreA simple visualization of how the Underground Cybercrime Economy cashes in on data and DDoS attacks. To learn more,…
9 Retweets 10
Read More