DEF CON 33 - DDoS: The Next Generation - Andrew Cockburn

Revised Summary: NetScout's DDoS Threat Report Analysis: Attack Evolution, Motivations, and Defense Strategies

Summary

Andrew Coburn from NetScout presents findings from their latest DDoS threat report, revealing a 12% increase in global attack frequency to 8-9 million attacks. While the maximum recorded attack reached 995 Gbps, most attacks are smaller and shorter: 75% are under 1 Gbps and 70% last under 15 minutes. This trend indicates attackers optimize resources for efficiency rather than deploying maximum capacity.

Key Findings

Attack Evolution

Attack patterns have shifted dramatically from amplification-based attacks to direct path flag attacks:

• Top Attack Vectors: Now dominated by direct path attacks: ACT, TCP, TCP SYN, ICMP, and TCP RST. DNS amplification remains in the top five due to mitigation difficulty.
• Reasons for Shift:
  • Service providers implemented effective anti-spoofing measures
  • Attackers now leverage botnets of compromised high-power servers
  • Flag attacks (like SYN floods) are more efficient and harder to mitigate
  • DNS amplification persists because it's notoriously difficult to block
• Trend Data: Direct path attacks have surpassed volumetric reflection amplification attacks over the past 2-3 years.

Attack Motivations

Two primary drivers fuel DDoS attacks:

1. Monetization: Extortion campaigns and DDoS-for-hire services.
2. Geopolitical Activities: Clear correlations exist between specific world events and attack spikes, including:
   • Dark Storm (Iran-linked) attacks during Israel's Rafah operations
   • Attack surge coinciding with the UK's new government session
   • Attacks during Mexico's national elections
   • Attacks during political protests in Mozambique

DDoS-for-Hire Services Evolution

These services have evolved significantly from simple tools to sophisticated platforms:

• Advanced Capabilities:
  • **Carpe