1. DoS Threat Landscape Sean Newman Director Product Management Q3 2016 © 2016 Corero www.corero.com

2. 20 Years of DoS Attacks First Hacktivist event: Zapatista National Liberation Army DoS for bragging rights MafiaBoy DDoS: Yahoo!, Amazon, Dell, CNN, Ebay, Etrade Spammers discover botnets Organized crime: Extortion Estonia : Parliament, banks, media, Estonia Reform Party 19932013199519971999200120032005200720092011 Anon hits Church of Scientology Panix.net hit with first major DDoS 2015 Coordinated US bank attacks: Grew to 200 Gbps, and continues today ProtonMail attack Spamhaus attack: Reported to reach 310 Gbps 500 Gbps attack in Hong Kong France swarmed after terror attack PlayStation & Xbox hit at Christmas

3. DoS is part of the new-normal © 2014 Corero www.corero.com 3 Thousands of attacks every day: Many Motives Political / Beliefs Ransom / Extortion Targeted Attack Smokescreens Anyone can launch an attack: Free tools and how to videos DDoS for hire sites Increasingly Sophisticated Harder to Detect and Mitigate

4. Attacks are Non-Saturating and Short Duration 4 © 2016 Corero www.corero.com

5. Sophisticated Multi-Vector Attacks 5 © 2016 Corero www.corero.com  Advanced DoS attacks crafted to avoid detection  Enough volume to cripple target destination  Short duration to avoid legacy DDoS scrubbing-center mitigation Ongoing Multi-vector, sub-saturating attacks Volume ramped to 68Gb when initial attack fails

6. Latest Reflection Attack Vector 6 © 2016 Corero www.corero.com  New DDoS Reflection vector leveraging TFTP Small request packet, with spoofed source IP, requesting file TFTP Server sends larger response to spoofed target Amplification factor of around 60x, similar to DNS  Many TFTP Servers accessible from the public Internet TFTP is Unauthenticated  Attacks already seen in the wild…

7. Key Take-Aways  DDoS Attacks are Growing  Attack Sophistication is Increasing  Long duration - High Volume attacks are the minority  Traditional DDoS Scrubbing Centres are being Circumvented Organisations believe DDoS protection is not their problem; expectation is that the service provider is already dealing with it! 7

8. Questions?