DoS Threat Landscape Sean Newman Director Product Management Q © 2016 Corero

20 Years of DoS Attacks First Hacktivist event: Zapatista National Liberation Army DoS for bragging rights MafiaBoy DDoS: Yahoo!, Amazon, Dell, CNN, Ebay, Etrade Spammers discover botnets Organized crime: Extortion Estonia : Parliament, banks, media, Estonia Reform Party Anon hits Church of Scientology Panix.net hit with first major DDoS 2015 Coordinated US bank attacks: Grew to 200 Gbps, and continues today ProtonMail attack Spamhaus attack: Reported to reach 310 Gbps 500 Gbps attack in Hong Kong France swarmed after terror attack PlayStation & Xbox hit at Christmas

DoS is part of the new-normal © 2014 Corero 3 Thousands of attacks every day: Many Motives Political / Beliefs Ransom / Extortion Targeted Attack Smokescreens Anyone can launch an attack: Free tools and how to videos DDoS for hire sites Increasingly Sophisticated Harder to Detect and Mitigate

Attacks are Non-Saturating and Short Duration 4 © 2016 Corero

Sophisticated Multi-Vector Attacks 5 © 2016 Corero  Advanced DoS attacks crafted to avoid detection  Enough volume to cripple target destination  Short duration to avoid legacy DDoS scrubbing-center mitigation Ongoing Multi-vector, sub-saturating attacks Volume ramped to 68Gb when initial attack fails

Latest Reflection Attack Vector 6 © 2016 Corero  New DDoS Reflection vector leveraging TFTP Small request packet, with spoofed source IP, requesting file TFTP Server sends larger response to spoofed target Amplification factor of around 60x, similar to DNS  Many TFTP Servers accessible from the public Internet TFTP is Unauthenticated  Attacks already seen in the wild…

Key Take-Aways  DDoS Attacks are Growing  Attack Sophistication is Increasing  Long duration - High Volume attacks are the minority  Traditional DDoS Scrubbing Centres are being Circumvented Organisations believe DDoS protection is not their problem; expectation is that the service provider is already dealing with it! 7

Questions?