DDoS attacks are effectively collapsing massive networks. So what can be done?

As reported by The Guardian, late last year the Australian Bureau of Statistics (ABS) ‘fended off’ nearly one billion cyber attacks against the census. In 2016, a DDoS attack led to ABS having to take the first digital census offline for 40 hours. To stop this from happening again, cybersecurity measures were increased. However, on census day alone ABS was tasked with blocking 308,735 malicious connections and 130,000 IP addresses that were revealed as the source of attack traffic.

As DDoS attacks increase in consistency and sophistication, these stories are becoming commonplace. According to International Data Corporation (IDC), the international analyst firm, DDoS is currently a top concern for IT organisations of all sizes, alongside the likes of ransomware, phishing and data breaches. Numerous reports published in recent months highlight a massive increase in attacks against critical infrastructure, with prevalence and size of attacks on the rise.

One report found that DDoS traffic increased in 2022 from the previous year, with terabit-strong attacks frequently seen, as well as attacks in the hundreds of millions of packets per second, and sophisticated botnets peaking at tens of millions of requests per second. In addition, the number of volumetric and ransom DDoS attacks grew. As for industries targeted, while the likes of education management, finance and aviation are reportedly often at the top of the list, no industry is spared from the threat.

Volumetric and ransom DDoS attacks highlight the potential damage of these threats. Unlike ransomware, ransom DDoS attacks don’t require a user to accidentally click on a malicious link, instead they hone in on extortion. Generally speaking, a hacker will demand payment, and if the victim is unable or unwilling to pay the hacker will run their DDoS attack, flooding servers and networks with fake requests to make it impossible to discern legitimate requests.

A more direct approach, volumetric attacks have one primary aim, to overwhelm internal capacity with high volumes of malicious traffic. This type of DDoS attack typically takes advantage of vulnerable services, launching numerous spoofed queries to overwhelm the target. It can even result in an entire network infrastructure collapse. Volumetric DDoS attacks can also be a mask for more sophisticated and granular DDoS attacks. For example, hackers may take advantage of exposed services to disable a firewall or other preventative measures, and then install malware to steal sensitive data.