Rechercher
Contactez-nous Suivez-nous sur Twitter En francais English Language
 

Freely subscribe to our NEWSLETTER

Newsletter FR

Newsletter EN

Vulnérabilités

Unsubscribe

Public cloud services increasingly exploited to supercharge DDoS attacks - new Link11 research

September 2018 by Link11

DDoS attackers are increasingly abusing public cloud services
to launch attacks, according to new research from Link11. Data from Link11’s Security Operation Center (LSOC) shows that a quarter of
all DDoS attacks in Europe in the 12 months from July 2017 to June 2018 used public
cloud server-based botnets, compared to 18.5% in the previous 12 months - a 35% increase.

During the 12 months to June 2018, Microsoft Azure was the cloud service most
exploited for DDoS attacks, with 38.7% of such attacks using Azure servers on
average. Amazon Web Services (AWS) was used in 32.7% of attacks on average, and
Alibaba servers used in 17.9% of attacks. Google servers were abused much less
often, used in only 10.7% of attacks.

According to Link11, public cloud server-based botnets are the ideal platform for
launching DDoS attacks. Cloud instances generally offer bandwidths of between 1 and
10 Gbps, enabling attack volumes which can be as much as 1000 times higher than is
possible with individual compromised devices such as home routers or IoT cameras.
The LSOC reported that the peak attack volumes of these cloud-based attacks exceeded
150 Gbps in May. Cloud servers provide memcached or SSDP services, which amplify
attack volumes.

Aatish Pattni, Regional Director UK & Ireland for Link11 said: "The people behind
DDoS attacks are embracing the use of public cloud services for the same reasons as
legitimate organizations: the services provide flexible, on-demand capacity and
resources, and can be provisioned in just a few minutes.

"For threat actors, the benefits are even more compelling because they will often
use stolen credit card details and false identities to pay for the services. This
makes the perpetrators almost impossible to trace, even though providers such as
Amazon<https://aws.amazon.com/forms/report...> are taking strong action against
misuse, and asking users to report any suspected abuse of their services."

To protect against DDoS attacks launched using public cloud services, blocking
traffic from these services is not an option for many organizations because they
will already be using public cloud as part of their own IT infrastructures.

Instead, organizations should analyze in detail the communication between public
cloud services and their own network, and monitor for malicious or unwanted traffic.
Ongoing analysis of data traffic, using machine-learning techniques, enables
legitimate traffic to be profiled and fingerprinted, so that any changes can be
detected quickly and reliably. The malicious traffic can then be filtered out in a
granular manner before it can impact on the organization’s business, without
blocking legitimate traffic.


See previous articles

    

See next articles


Your podcast Here

New, you can have your Podcast here. Contact us for more information ask:
Marc Brami
Phone: +33 1 40 92 05 55
Mail: ipsimp@free.fr

All new podcasts