Arbor warns of surging network attacks

Stuart Corner
Wednesday, 12 November 2008 11:20

IT Industry - Strategy

Anecdotal comments provided by respondents revealed that money, not technology ended the mammoth 40Gbps attack. "This was, initially, criminal-on-criminal crime though obviously the greatest damage was inflicted on the infrastructure used by the criminals"' "The attack stopped only because the attacker was paid" and "The attacker remains at large and active."

The report warned that "most individual core Internet backbone links today are no larger than 10Gbps...As such, most of the larger attacks today still easily inflict collateral damage on infrastructure that is upstream from the targets themselves, while completely overwhelming the actual targets.

"Furthermore, given that most enterprises and other network properties quite likely do not have more than 1Gbps of aggregate Internet access capacity, organisations concerned with Internet availability must plan accordingly with their ISPs to be prepared to respond to attacks of such scale."

The attack did not exploit a botnet - the traditional means of launching a DDoS attack: "No bots were used in this attack. The attacker had a small number of compromised Linux boxes from which he'd launch the spoofed source DNS query. The DNS servers were all DNS servers open to recursion."

Also the report warns that ISPs face a double-edged struggle against increased cost and revenue pressure. "They are increasingly deploying more complex distributed VoIP, video and IP services to generate additional revenue streams. As a result, they are opening themselves up to additional attack vectors.

Nick Race, Australian country manager for Arbor Networks warned that any organisation that depended on the Internet for revenue needed to ensure that it or its hosting provider had the facilities in place to mitigate attacks quickly or it would be in an untenable position if faced with an extortion threat.

"If your Kyle Minogue tickets go on sale on line on Monday and someone rings you up the night before and threatens you, what are you going to do? You'll pay up."