What Researchers Are Learning About DDoS Tactics

Security specialists reveal the DDoS threat

The ability of attackers to dig deeper and wider thanks to the proliferation of botnets was covered in the first article of this series, DDoS Attacks Are Back (and Bigger Than Before). The trend is also covered at length in The Botnet Hunters.

In this article, two IT security practitioners -- one with experience in dealing with DDoS attacks against government systems, the other an expert from the corporate side -- share what they've learned about the targets chosen for DDoS attacks and how to adjust security strategies based on those lessons.

CSOonline conducted Q&As with Jerry Mangiarelli, a security specialist with TD Bank in Canada, and Israeli researcher Gadi Evron.

A corporate security specialist on motives and tactics Jerry Mangiarelli has gained a lot of private-sector perspective on the DDoS threat over the years through his own personal research into botnets. He's a frequent speaker on the subject at such security conferences as EC-Council, SecTor and FSP. Here, he gives examples of what his research says about hacker tactics and motives.

CSO: What was it that shifted your focus so heavily into the area of bot-related DDoS attacks?Mangiarelli: The shift was influenced by my continued interest/research in malware and the application layer. The adversaries' motives that we've witnessed over the years as botnets mesh with the application layer is that there's a lot of return-on-investment (ROI) for them.

Describe what goes into your research in terms of hours spent and tools used.Mangiarelli: I spend a considerable amount of time researching. I like to call it my nightshift after the kids are in bed. I spend the time evaluating tools used by adversaries specifically around the development of Web-based DDoS toolkits.

Based on your research to date, what is most surprising about the firepower behind DDoS attacks?Mangiarelli: What most individuals are unaware of is their ability to utilize Web servers as controllers. The FTP attacks that were launched early 2009 and the mass SQL Injections from 2008 that carried over into 2009 have displayed opportunities to expand on the DDoS armies.

Are you finding such attacks are directed more toward the corporate world or are most politically motivated?Mangiarelli: As I alluded to earlier, adversary motives have changed. Each bot is now created differently with additional modules which are specific to each bot herder's needs or the needs of their customers. We'll continue to see attacks that target both worlds, corporate and political for a long time. This road will never end.

Lessons learned from hacktivism against the state Israeli security researcher Gadi Evron has put in a lot of time examining DDoS attacks against government networks. His cases include the massive attack that hit Estonia a few years ago. At the time, he concluded the attacks were the work of so-called hacktivists rather than people working directly on behalf of enemy governments (Russia, in this case). Here, he explains what corporate IT security pros can learn from attacks against the public sector:

CSO: Based on what you've learned from Estonia and similar incidents, are there any best practices IT security practitioners can glean from the tactics that were used?Gadi Evron: DDoS attacks are not about best practices. They're about either planning (infrastructure and contacts) or mitigation (playing with infrastructure and contacts)

Explain what that entails.Evron: The best thing for companies to do is follow their traffic load and make sure they can take a more serious load. No one can pay for 1000 times their normal traffic, but building in some wiggle room is advisable. Building the network gear and net-facing applications to be able to withstand abuse, or at least not fall under it, is critical. From there, the best thing to do is have more than one uplink, and have a good relationship with the ISPs for mitigation.

From your experience, what are the most-used DDoS techniques of late? We've talked to others who note that botnets have allowed for more ferocious, widespread DDoSes, for example.Evron: I can't speak so much about the specific tricks attackers use, but I can say that their methods don't point to any particular trend. Bottom line: They use whatever works and in that regard, it's either over-load the CPU, the memory, or the load checks in applications, or the traffic or capacity in networking.

Estonia seems to have responded forcefully and successfully to what happened to them. Are you able to talk about some of the things the country did in response to those attacks?Evron: Two things made the difference: incident response and global coordination. On incident response, cooperation and coordination were key, and on global coordination, while it sounds obvious, without the help of others around the world such incident response would not have been possible.

This is the second in a series of articles on the return of DDoS attacks. The first article is DDoS Attacks Are Back (and Bigger Than before). A podcast on the subject is also available: The Long, Strange Evolution of DDoS Attacks.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityddos

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Bill Brenner

CSO (US)
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?