The internet has come a long way from its idealistic beginnings. The history of the internet has its origin in the efforts of scientists and engineers to build and interconnect computer networks since the 1950s. In 1974, Vint Cerf and Bob Kahn published a research note that evolved into transmission control protocol (TCP) and internet protocol (IP). However, it was British computer scientist Tim Berners-Lee, whose research at CERN in Switzerland resulted in www or world wide web, which linked hypertext documents into an information system that could be accessed from any node on the network. The rest, as they say, is history.
However, since the very beginning, scientists and engineers aimed to build networks for sharing information freely. Since these initial networks used for information sharing were known and trusted, they did not pay enough attention to the security aspect of data transfer. Although, in later years, scientists and engineers developed several protocols and measures for internet security, the basics remain the same. In other words, internet security will continue to stay in an evolving state, forever.
According to a
report from Cloudflare, almost 7% of all internet traffic is malicious. During the second quarter of 2024, Cloudflare recorded a 20% year-over-year (y-o-y) increase in distributed denial of service (DDoS) attacks. DDoS is a cyber attack designed to take down or disrupt internet services, such as websites or mobile apps, making them unavailable. Attackers overwhelm the server with massive traffic, rendering it unable to handle legitimate user traffic.
According to Cloudflare, during the past quarter, half of all hypertext transfer protocol (HTTP) DDoS attacks (DDoS attacks designed to overwhelm a targeted server with HTTP requests) were mitigated using proprietary heuristics that targeted botnets known to Cloudflare. "Another 29% were HTTP DDoS attacks that used fake user agents, impersonated browsers or were from headless browsers. An additional 13% had suspicious HTTP attributes, which triggered our automated system, and 7% were marked as generic floods. One thing to note is that these attack vectors, or attack groups, are not necessarily exclusive and known botnets also impersonate browsers and have suspicious HTTP attributes."
Information technology (IT) and services were ranked as the most targeted industry in the second quarter of 2024. Telecommunications, services providers and the carrier sector came in second. Consumer goods came in third place.
What is more worrying is that one out of every 25 respondents (customers) told Cloudflare that DDoS attacks against them were carried out by State-level or State-sponsored threat actors.
"Almost 75% of respondents reported that they did not know who attacked them or why. Of the respondents who claim they did know, 59% said it was a competitor who attacked them. Another 21% said the DDoS attack was carried out by a disgruntled customer or user, and another 17% said that the attacks were carried out by State-level or State-sponsored threat actors. The remaining 3% reported it being a self-inflicted DDoS attack," the report says.
According to Cloudflare, threat actor sophistication fuels the continued increase in DDoS attacks. It says, "In the first half of 2024, we mitigated 8.5mn (million) DDoS attacks, including 4.5mn in the first quarter (Q1) and 4mn in Q2. Overall, the number of DDoS attacks in Q2 decreased by 11% quarter-over-quarter (q-o-q) but increased 20% year-over-year."
"For context, in 2023, we mitigated 14mn DDoS attacks, and halfway through 2024, we have already mitigated 60% of last year's figure. Cloudflare successfully mitigated 10.2trn (trillion) HTTP DDoS requests and 57 petabytes of network-layer DDoS attack traffic, preventing it from reaching our customers' origin servers," it added.
Cloudflare says this ten-fold difference underscores the dramatic change in the threat landscape. "The tools and capabilities that allowed threat actors to carry out such randomised and sophisticated attacks were previously associated with capabilities reserved for state-level actors or state-sponsored actors. But, coinciding with the rise of generative artificial intelligence (AI) and autopilot systems that can help actors write better code faster, these capabilities have made their way to the common cyber-criminal."
According to the report, Libya ranked as the largest source of DDoS attacks in the second quarter of 2024, followed by Indonesia and the Netherlands. China is ranked the most attacked country in the world. After China, Turkey came second, followed by Singapore, Hong Kong, Russia, Brazil, and Thailand.
"Despite the majority of attacks being small, the number of larger volumetric attacks has increased. One out of every 100 network-layer DDoS attacks exceed 1mn packets per second (pps), and two out of every 100 exceed 500GBps (gigabits per second). On layer 7, four out of every 1,000 HTTP DDoS attacks exceed 1mn requests per second," Cloudflare says.
The majority of DDoS attacks are small and quick. However, Cloudflare says even these attacks can disrupt online services that do not follow best practices for DDoS defence. "Furthermore, threat actor sophistication is increasing, perhaps due to the availability of generative AI and developer copilot tools, resulting in attack code that delivers DDoS attacks that are harder to defend against."
However, Cloudflare is not the only one that blocks malicious DDoS attacks. For two days in August 2023, Amazon Web Services (AWS) detected a spike in HTTP/2 requests to Amazon CloudFront. HTTP/2 allows for multiple distinct logical connections to be multiplexed over a single HTTP session.
In
a blog post, AWS says, "Between 28th August and 29 August 2023, proactive monitoring by AWS detected an unusual spike in HTTP/2 requests to Amazon CloudFront, peaking at over 155mn requests per second (RPS). Over those two days, AWS observed and mitigated over a dozen HTTP/2 rapid reset events, and through September, continued to see this new type of HTTP/2 request flood."
Last year in October, Google Cloud thwarted a DDoS attack that was seven and a half times bigger than it faced in 2022. The attackers used new techniques to try to disrupt websites and internet services.
"This new series of DDoS attacks reached a peak of 398mn RPS and relied on a novel HTTP/2 rapid reset technique based on stream multiplexing that has affected multiple internet infrastructure companies. By contrast, last year's largest-recorded DDoS attack peaked at 46mn RPS. For a sense of scale, this two-minute attack generated more requests than the total number of article views reported by Wikipedia during the entire month of September 2023,"
Google Cloud says.
While protecting against DDoS attacks can be challenging for common users, here are some steps that can be taken to mitigate the risk...
1. Use a reliable internet service provider (ISP)
• ISP with DDoS protection: Choose an ISP that offers DDoS protection services. Many ISPs have built-in safeguards to detect and mitigate DDoS attacks.
2. Enable firewall and security features
• Ensure that your router's firewall is enabled to block unauthorised traffic.
• Use software (intrusion detection systems -IDS) that can detect unusual behaviour patterns, indicating a potential attack.
3. Keep software updated
• Regularly update the firmware of your router and other network devices.
• Ensure all software, including operating systems and applications, are up-to-date with the latest security patches.
4. Use strong passwords
• Use complex, unique passwords for your router, network and online accounts to prevent unauthorised access.
• Enable multi-factor authentication (MFA) where possible to add an extra layer of security.
5. Implement network segmentation
• Use different networks for different purposes (for example, guest network, intenet of things (IoT) devices) to limit the spread of an attack.
6. Use a VPN
• A virtual private network (VPN) can help protect your IP address from being exposed, making it harder for attackers to target you.
7. Monitor network traffic
• Use tools to monitor network traffic for unusual activity, which can indicate an ongoing attack.
• Set up alerts for any abnormal spikes in traffic.
8. Educate yourself
• Understand the basics of DDoS attacks and how they work.
• Keep up-to-date with the latest security news and trends.
9. Utilise DDoS protection services
• Consider using third-party DDoS protection services, especially if you run a website or an online service. Services like Cloudflare, Akamai, or AWS Shield can help mitigate attacks.
10. Regular backups
• Regularly back up important data to recover quickly in case of an attack.
• Have a disaster recovery plan in place for how to respond if an attack occurs.
Implementing these measures can significantly reduce your vulnerability to DDoS attacks and enhance overall network security.
Stay Alert, Stay Safe!
