- Q3 report highlights a 138% y-o-y increase in total DDoS attacks greater than 100 Gbps
- Web application attacks decreased by 18% y-o-y
AKAMAI Technologies, Inc, a content delivery network (CDN) services player, on Nov 17 released its third quarter, 2016 State of the Internet / Security Report.
The report, using data gathered from the Akamai Intelligent Platform, provides analysis of the current cloud security and threat landscape, including insight into two record setting DDoS attacks caused by the Mirai botnet.
“Every couple of years the industry faces what could be considered ‘harbinger attacks’, where the size and scope of a security event are radically different than what has come before. I believe the industry faced its latest ‘harbinger’ with the Mirai botnet,” explained Martin McKeay, senior security advocate and senior editor, State of the Internet/Security Report.
“The Mirai botnet also made concrete the industry’s fear that Internet of Things (IoT) and other Internet connected devices could be used for both web application and DDoS attacks, illustrating the need for device manufacturers to place a greater emphasis on security.”
Highlights from Akamai’s Third Quarter, 2016 State of the Internet / Security Report include:
- The two largest DDoS attacks this quarter, both leveraging the Mirai botnet, were the biggest observed by Akamai to-date – recorded at 623 Gbps and 555 Gbps.
- Compared to Q3 2015, total DDoS attacks increased 71% in Q3 2016.
- During the third quarter, Akamai mitigated a total of 4,556 DDoS attacks, an 8% decrease from Q2.
- There were 19 mega attacks mitigated in Q3 that peaked at more than 100 Gbps, matching the Q1 2016 highpoint.
- Q3 2016 showed that NTP reflection attacks are apparently becoming a less viable option for attackers. The average size of an attack relying solely on NTP reflection is approximately 700 Mbps, a significant drop from the June 2014 average of more than 40 Gbps.
Web Application Attacks
- Q3 2016 showed an 18% decrease in total web application attacks from Q3 2015.
- In Q3 2016, web application attacks sourced from the United States decreased by 67% from Q3 2015.
- Brazil, the top country of origin for all web application attacks in Q2 2016, experienced a 79% decrease in attacks this quarter. The United States (20%) and Netherlands (18%) were the countries with the most web application attacks.
- Web application attack metrics measured around major sporting events suggest malicious actors may take time off to watch their favorite teams. For example, on the day that France played Portugal in the European soccer championship, there was a 95% decrease in attacks sourcing from Portugal (20 attacks) as opposed to a day one month later (392 attacks). On the same day in France, there were 50,597 attacks as compared to 158,003 one month later – a 68% difference.
Spotlight on Attack Vectors
UDP fragments and DNS reflection attacks were the two most common vectors in Q3, accounting for 44% of all vectors – an increase of 4.5% from Q2.
Application layer attacks drove just 1.66% of all DDoS attacks, likely because of the level of technical knowledge needed to execute them. Infrastructure layer attacks are much easier to launch with point-and-click tools.
Bad omen for the IoT future
Mitigating cybercrime to combat security-breach domino effect
How to ensure you have a data-secured environment
The war against cybercrime now rages at the app layer: F5
For more technology news and the latest updates, follow us on Twitter, LinkedIn or Like us on Facebook.