VERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT

Transcription

1 VERISIGN DISTRIBUTED DENIAL OF SERVICE TRENDS REPORT VOLUME 3, ISSUE 3 3RD QUARTER 2016 Complimentary report supplied by

2 CONTENTS EXECUTIVE SUMMARY 3 VERISIGN-OBSERVED DDoS ATTACK TRENDS: Q DDoS Attacks are Unpredictable 4 Multi-Vector DDoS Attacks Continue to Dominate 6 Types of DDoS Attacks 7 Highest Intensity Flood and Largest Volumetric Attack 8 Every Organization is at Risk 9 VERISIGN DDoS TRENDS REPORT Q

3 EXECUTIVE SUMMARY This report contains the observations and insights derived from distributed denial of service (DDoS) attack mitigations enacted on behalf of, and in cooperation with, customers of Verisign DDoS Protection Services from July 1, 2016 through Sept. 30, 2016 ( Q ) and the security research of Verisign idefense Security Intelligence Services conducted during that time. It represents a unique view into the attack trends unfolding online, including attack statistics and behavioral trends for Q * Verisign observed the following key trends in Q3 2016: Number of Attacks Peak Attack Size Average Peak Attack Size Most Common Attack Mitigated 13% decrease from the third quarter of 2015 Volume 257 Gigabits per second (Gbps) Speed 152 Million packets per second (Mpps) Highest intensity flood ever observed by Verisign Gbps 16% of attacks over 10 Gbps 49% of attacks were User Datagram Protocol (UDP) floods 59% of attacks employed multiple attack types 37% of mitigation activity IT Services/ Cloud/SaaS VERISIGN DDoS TRENDS REPORT Q

4 VERISIGN-OBSERVED DDoS ATTACK TRENDS: Q DDoS Attacks Are Unpredictable DDoS attacks continue to be complex and unpredictable, making them more challenging for companies to mitigate. While not directly observed by Verisign, Q was notable due to several attacks unprecedented in attack size. Specifically, the approximately 620 Gbps attack against KrebsonSecurity 1 and a 579 Gbps attack reported by Arbor Networks 2 were significant and widely reported within the industry. Attackers in Q launched sustained and repeated attacks against their targets. In fact, out of all the Verisign customers targeted by DDoS attacks in Q3 2016, 41 percent were targeted multiple times during the quarter. Attack Size 81% peaked over 1 Gbps 30% peaked over 5 Gbps With almost a third of attacks over 5 GBPS a do-it-yourself approach to DDoS PROTECTION would be challenging for most organizations. >10 Gbps >5<10 Gbps >1<5 Gbps <1 Gbps 2014-Q Q Q Q Q Q Q Q Percent of Attacks Figure 1: Mitigation Peaks by Quarter from Q to Q Retrieved on Nov. 1, Retrieved on Nov. 1, 2016 VERISIGN DDoS TRENDS REPORT Q

5 Average Peak Attack Size Gbps 82% increase in average attack peak size since Q Overall, average attack peak sizes in 2016 have been larger than previous recorded years Gbps Q Q Q Q Q Q Q Q3 0 Figure 2: Average Attack Peak Size by Quarter from Q to Q VERISIGN DDoS TRENDS REPORT Q

6 Multi-Vector DDoS Attacks Continue to Dominate Fifty-nine percent of the DDoS attacks mitigated by Verisign in Q employed multiple attack types indicating that DDoS attacks continue to be complex, and thus require more time and effort to mitigate. 4% 14% 23% 41% 18% 1 Attack Type 2 Attack Types 3 Attack Types 4 Attack Types 5 or More Attack Types 41% of the DDoS attacks in Q utilized 3 or more different attack types. Figure 3: Number of Attack Types Per DDoS Event in Q VERISIGN DDoS TRENDS REPORT Q

7 Types of DDoS Attacks UDP flood attacks continue to dominate in Q3 2016, making up 49 percent of the total attacks in the quarter. The most common UDP floods mitigated were Domain Name System (DNS) reflection attacks, followed by Network Time Protocol (NTP) reflection attacks. 49% 49% of attacks were UDP FLOODS 3% 6% 20% 22% UDP Based IP Fragment Attacks TCP Based Layer 7 Other Figure 4: Types of DDoS Attacks in Q VERISIGN DDoS TRENDS REPORT Q

8 Highest Intensity Flood and Largest Volumetric Attack The highest intensity flood attack observed by Verisign in Q was a TCP SYN flood that peaked at approximately 60 Gbps and 150 Mpps. This flood attack is one of the highest packets per second attacks ever observed by Verisign, surpassing the previous highest flood of 125 Mpps mitigated by Verisign in the fourth quarter of The largest attack in Q utilized the Generic Routing Encapsulation (GRE) protocol (IP protocol 47) and peaked at 250+ Gbps and 50+ Mpps. This is the first time Verisign observed this type of attack against its customer base. The attack was notable in that the attackers encapsulated UDP packets to legitimate service ports within the GRE protocol. Attackers were able to increase the payload and add volume to the attack with this technique. Both the source and destination IP addresses in the encapsulated data were spoofed. The highest intensity flood attack in Q was a TCP SYN flood that peaked at approximately 60 Gbps and 150 Mpps VERISIGN DDoS TRENDS REPORT Q

9 Every Organization is at Risk DDoS attacks are not limited to any specific industry or vertical. Mitigations on behalf of Verisign Customers by Industry for Q IT Services/ Cloud/SaaS 37% of mitigations Financial 29% of mitigations Public Sector 12% of mitigations Media and Entertainment/ Content 10% of mitigations E-Commerce and Online Advertising 10% of mitigations Telecommunications and Other 2% of mitigations Average attack size: Average attack size: Average attack size: Average attack size: Average attack size: Average attack size: 8.8 Gbps 39.1 Gbps 5.8 Gbps 0.6 Gbps 5.0 Gbps 4.1 Gbps 3 The attacks reported by industry in this document are solely a reflection of the Verisign DDoS Protection Services customer base. VERISIGN DDoS TRENDS REPORT Q

10 Peak Attack Size by Industry (Quarterly) Gbps 50 IT Services/ Cloud/SaaS Financial Public Sector Media & Entertainment E-Commerce/ Online Telecommunications & Other 0 Q Q Q Q Figure 5: Peak DDoS Attack Size by Industry from Q to Q The Financial industry saw the highest attack peak size in 2016 thus far. For Q3 2016, the attack peak size was 257 Gbps, a 47 percent increase from the second quarter of VERISIGN DDoS TRENDS REPORT Q

11 TO LEARN MORE ABOUT VERISIGN DDoS PROTECTION SERVICES, VISIT Verisign.com/DDoS. About Verisign Verisign, a global leader in domain names and internet security, enables internet navigation for many of the world s most recognized domain names and provides protection for websites and enterprises around the world. Verisign ensures the security, stability and resiliency of key internet infrastructure and services, including the.com and.net domains and two of the internet s root servers, as well as performs the root-zone maintainer function for the core of the internet s Domain Name System (DNS). Verisign s Security Services include intelligence-driven Distributed Denial of Service Protection, idefense Security Intelligence and Managed DNS. To learn more about what it means to be Powered by Verisign, please visit Verisign.com. *The information in this Verisign Distributed Denial of Service Trends Report (this Report ) is believed by Verisign to be accurate at the time of publishing based on currently available information. Verisign provides this Report for your use in AS IS condition and at your own risk. Verisign does not make any and disclaims all representations and warranties of any kind with regard to this Report, including, but not limited to, any warranties of merchantability or fitness for a particular purpose. VERISIGN DDoS TRENDS REPORT Q

12 Verisign.com 2016 VeriSign, Inc. All rights reserved. VERISIGN and other trademarks, service marks, and designs are registered or unregistered trademarks of VeriSign, Inc. and its subsidiaries in the United States and in foreign countries. All other trademarks are property of their respective owners. Verisign Public VRSN_DDoS_TR_CSC_Q3-16_201611