What Researchers Are Learning About DDoS Tactics

Security specialists reveal the DDoS threat

The ability of attackers to dig deeper and wider thanks to the proliferation of botnets was covered in the first article of this series, DDoS Attacks Are Back (and Bigger Than Before). The trend is also covered at length in The Botnet Hunters.

In this article, two IT security practitioners -- one with experience in dealing with DDoS attacks against government systems, the other an expert from the corporate side -- share what they've learned about the targets chosen for DDoS attacks and how to adjust security strategies based on those lessons.

CSOonline conducted Q&As with Jerry Mangiarelli, a security specialist with TD Bank in Canada, and Israeli researcher Gadi Evron.

A corporate security specialist on motives and tactics Jerry Mangiarelli has gained a lot of private-sector perspective on the DDoS threat over the years through his own personal research into botnets. He's a frequent speaker on the subject at such security conferences as EC-Council, SecTor and FSP. Here, he gives examples of what his research says about hacker tactics and motives.

CSO: What was it that shifted your focus so heavily into the area of bot-related DDoS attacks?Mangiarelli: The shift was influenced by my continued interest/research in malware and the application layer. The adversaries' motives that we've witnessed over the years as botnets mesh with the application layer is that there's a lot of return-on-investment (ROI) for them.

Describe what goes into your research in terms of hours spent and tools used.Mangiarelli: I spend a considerable amount of time researching. I like to call it my nightshift after the kids are in bed. I spend the time evaluating tools used by adversaries specifically around the development of Web-based DDoS toolkits.

Based on your research to date, what is most surprising about the firepower behind DDoS attacks?Mangiarelli: What most individuals are unaware of is their ability to utilize Web servers as controllers. The FTP attacks that were launched early 2009 and the mass SQL Injections from 2008 that carried over into 2009 have displayed opportunities to expand on the DDoS armies.

Are you finding such attacks are directed more toward the corporate world or are most politically motivated?Mangiarelli: As I alluded to earlier, adversary motives have changed. Each bot is now created differently with additional modules which are specific to each bot herder's needs or the needs of their customers. We'll continue to see attacks that target both worlds, corporate and political for a long time. This road will never end.

Lessons learned from hacktivism against the state Israeli security researcher Gadi Evron has put in a lot of time examining DDoS attacks against government networks. His cases include the massive attack that hit Estonia a few years ago. At the time, he concluded the attacks were the work of so-called hacktivists rather than people working directly on behalf of enemy governments (Russia, in this case). Here, he explains what corporate IT security pros can learn from attacks against the public sector:

CSO: Based on what you've learned from Estonia and similar incidents, are there any best practices IT security practitioners can glean from the tactics that were used?Gadi Evron: DDoS attacks are not about best practices. They're about either planning (infrastructure and contacts) or mitigation (playing with infrastructure and contacts)

Explain what that entails.Evron: The best thing for companies to do is follow their traffic load and make sure they can take a more serious load. No one can pay for 1000 times their normal traffic, but building in some wiggle room is advisable. Building the network gear and net-facing applications to be able to withstand abuse, or at least not fall under it, is critical. From there, the best thing to do is have more than one uplink, and have a good relationship with the ISPs for mitigation.

From your experience, what are the most-used DDoS techniques of late? We've talked to others who note that botnets have allowed for more ferocious, widespread DDoSes, for example.Evron: I can't speak so much about the specific tricks attackers use, but I can say that their methods don't point to any particular trend. Bottom line: They use whatever works and in that regard, it's either over-load the CPU, the memory, or the load checks in applications, or the traffic or capacity in networking.

Estonia seems to have responded forcefully and successfully to what happened to them. Are you able to talk about some of the things the country did in response to those attacks?Evron: Two things made the difference: incident response and global coordination. On incident response, cooperation and coordination were key, and on global coordination, while it sounds obvious, without the help of others around the world such incident response would not have been possible.

This is the second in a series of articles on the return of DDoS attacks. The first article is DDoS Attacks Are Back (and Bigger Than before). A podcast on the subject is also available: The Long, Strange Evolution of DDoS Attacks.

Join the PC World newsletter!

Error: Please check your email address.

Tags ddossecurity

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Bill Brenner

Show Comments

Most Popular Reviews

Latest News Articles


PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?