DDoS hots up<\/strong><\/p>\n\n\n\nDDoS attacks were by far the biggest threat to\nservice providers between 2017 and 2019, accounting for 49% of all reported\nincidents during this period. <\/p>\n\n\n\n
There was a big jump in 2019, with attacks rising\nto 77% of all incidents \u2013 up from just 25% in 2017. <\/p>\n\n\n\n
Most attacks were sourced from within the service\nprovider\u2019s subscription base. Many of these, particularly in the case of\nDNS-related incidents, will leverage service provider resources to attack\nothers. <\/p>\n\n\n\n
F5 Labs found that most reported incidents focused\non DNS DDoS such as reflection and water torture attacks.<\/p>\n\n\n\n
Reflection attacks use service provider-hosted\nresources (such as DNS and NTP) to reflect spoofed traffic so that responses\nfrom the leveraged service end up going to the target, not to the initiator. <\/p>\n\n\n\n
DNS \u201cWater Torture\u201d is a form of reflection attack\nthat uses intentionally incorrect queries to generate increased load on the\ntarget\u2019s DNS servers. However, requests still go through the service provider\u2019s\nlocal DNS servers, generating increased load strains, and occasionally rise to\nthe level of Denial of Service. <\/p>\n\n\n\n
The first indication of attack is usually an\nincrease in network traffic discovered by a service provider\u2019s operations team.\nOther red flags include customer complaints, such as slow network service or non-responsive\nDNS servers. <\/p>\n\n\n\n
\u201cThe ability to quickly compare the characteristics\nof normal, expected network traffic with deviations during attack conditions is\nof critical importance,\u201d explained Heath.<\/p>\n\n\n\n
\u201cIt is also crucial to quickly enable in-depth\nlogging for network services like DNS in order to identify unusual queries.\u201d<\/p>\n\n\n\n
Authentication attacks significant but waning<\/strong><\/p>\n\n\n\nBrute force attacks, which involve trying massive\nnumbers of usernames and passwords against an authentication endpoint \u2013 were\nthe second most reported incident.<\/p>\n\n\n\n
Attackers often use credentials obtained from other\nbreaches, which are then used to target services via a tactic known as\n\u201ccredential stuffing\u201d. Other forms of brute force attacks simply use common\nlists of default credential pairs (i.e. admin\/admin), commonly used passwords,\nor randomly generated password strings. <\/p>\n\n\n\n
F5 Labs observed a marked downturn in brute force\nattacks, from 72% of all incidents in 2017 to just 20% in 2019. There was,\nhowever, an uptick in attacks on service providers focusing on the financial\nvertical.<\/p>\n\n\n\n
F5 Labs noted that the first indications of these\ntypes of attack are usually customer complaints related to account lockout\nrather than any sort of automated detection. <\/p>\n\n\n\n
\u201cEarly detection is once again key,\u201d said Heath. <\/p>\n\n\n\n
\u201cAn increase in failed login attempts over a short\nperiod of time, compared to normal activity levels, should be flagged and\nimmediately actioned. It is also important to initiate the widespread use of\nmulti-factor authentication to keep persistent attackers at bay.\u201d<\/p>\n\n\n\n
Compromised devices, web attacks and IoT Bots<\/strong><\/p>\n\n\n\nOther notable attacks recorded by F5 Labs included\ncompromised devices within service provider infrastructure, which accounted for\n8% of incidents in 2018. These were\nusually detected due to increased outbound traffic as the compromised devices\nwere used to launch denial of service attacks. \n<\/p>\n\n\n\n
F5 Labs also reported that general web attacks\naccounted for 8% of all incidents in 2019, with injections dominating as a\nspecific tactic. <\/p>\n\n\n\n
On the Internet of Things (IoT) front, the influence\nof a bot named Annie, a fast-following variant of Mirai, continued to wield an\ninfluence. <\/p>\n\n\n\n
First discovered in 2016, the bot targeted the custom\nprotocols TR-069 and TR-064 used by ISPs to remotely manage large fleets of\nrouters over port 7547. <\/p>\n\n\n\n
Although the threat actor that created Annie\nadmitted to not using the bot in December 2016, the targeting of port 7547 is\nstill prevalent and continues to intensify in 2019. Attacker interest in the\nMikrotik remote management port 8291 has also exponentially increased over the\npast six months.<\/p>\n\n\n\n
According to F5 Labs, ports 7547 and 8291 were the top\ntargeted ports in the Middle East and Latin America in the 4th quarter of 2019,\nwhich indicates variable use of these ports from region to region. <\/p>\n\n\n\n
\u201cISPs in Europe surely learned from the news of\nAnnie years ago, and attackers focus their efforts where there are gains to be\nhad. ISPs in Middle East and Latin\nAmerica likely to still have some work to do,\u201d added Heath.<\/p>\n","protected":false},"excerpt":{"rendered":"
An analysis of global customer security incident data from the past three years \u2013 both mobile and landline \u2013 also found that brute force attacks, though still prevalent, are on the wane. <\/p>\n","protected":false},"author":8,"featured_media":1639,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1595,9621],"tags":[686,518,527,417,750,749,751],"contributor":[],"class_list":["post-1637","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-emerging-technologies","tag-cyber_attack","tag-cyber_security","tag-cyber_threat","tag-ddos","tag-f5labs","tag-global_service_provider","tag-iot_bots"],"featured_image_src":"https:\/\/techxmedia.com\/en\/wp-content\/uploads\/2020\/03\/Cyber-Security-e1583398728611.jpg","author_info":{"display_name":"Rabab","author_link":"https:\/\/techxmedia.com\/en\/author\/rabab\/"},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t