UK second only to US in DDoS attacks

The UK is second only to the US in being targeted by distributed denial of service (DDoS) attacks with the aim of vandalism, disrupting businesses or extorting money from businesses, a report reveals.

The US still accounted for most of the first-quarter DDoS attacks (50.3%), followed by the UK (9.2%), Japan (6.7%) and Germany (3.1%), according to security firm Imperva’s latest DDoS threat report.

While US DDoS attacks have increased steadily in the past year, the report shows a spike in the UK to 23% of all DDoS attacks monitored by Imperva in the fourth quarter of 2015, when there was an increase in cyber extortion attempts.

While most attacks in the UK targeted small and medium-sized organisations, the report said this trend also translated into several high-profile assaults, including takedowns of the BBC, HSBC UK and the Irish National Lottery.

Overall, the report shows that DDoS attacks increased in frequency and more than doubled in number compared with the previous year. The rise was fuelled by DDoS-for-hire services, which accounted for 93% of attacks in the first quarter of 2016, up from 63.8% in the second quarter of 2015.

More than 40% of targets were attacked more than once, and 16% were targeted more than five times, the report said. Repeated attacks have increased from 29.4% in the third quarter of 2015 to 49.9% in the first quarter of 2016.

This highlights the tenacity of DDoS offenders, many of whom persist in trying to take a target down even after multiple failed attempts, said Imperva analysts.

Imperva Incapusula mitigated an average of 445 attacks a week from 1 April 2015 to 31 March.

In that period, the number of both network and application layer attacks doubled, but although application layer assaults accounted for 60% of attacks, this type of DDoS attack is trending downward, dropping by more than 5% compared with the year before.

Network layer attacks hit a new high in the period under review, with the largest assault peaking at 470 gigabits per second (Gbps).

If this trend continues, the Imperva analysts said network layer attacks could be as common as their application layer counterparts by 2018.

The report shows DDoS attacks are also growing in size, with multiple attacks exceeding 200Gbps, making them almost a regular occurrence.

At the same time, DDoS attackers are experimenting with new attack methods in an attempt to circumvent security measures, the report said, with researchers coming across multiple examples of new application layer assaults crafted to bypass mitigation systems.

One prominent case involved a uniquely executed HTTP flood attack, in which the target was bombarded by abnormally large upload requests.

According to Imperva analysts, the attack exploited a nuanced soft spot of hybrid DDoS mitigation setups, highlighting the degree of understanding some perpetrators now have about the inner workings of anti-DDoS measures.