Akamai's [state Of The Internet] / Security Q2 2015 Report

[SECTION] 1 ANALYSIS EMERGING TRENDS Packet per second attack volume dropped significantly compared with q2 2014, when the average peak was a record-setting 12 Mpps. But compared to last quarter, the average peak attack volume was up slightly, 3 Mpps as compared to 2 Mpps. In q2 2015, the average DDoS attack lasted nearly 21 hours. That represents a 19% increase in attack duration compared with q2 2014, but a 17% decrease in attack duration compared with q1 2015. The trends of the past two quarters show that malicious actors are favoring attacks with lower peak bandwidth, but are launching more frequent and longer attacks than they did a year ago. 1.1B / Mega Attacks / In q2 2015, 12 DDoS attacks registered more than 100 Gbps, as shown in Figure 1-1. This is up from q1 2015, when there were eight mega attacks, but still not as many as the record-setting 17 mega attacks of q3 2014. In q2 2015, the largest DDoS attack measured nearly 250 Gbps, an increase in size from the largest (170 Gbps) attack in q1 2015. Of the 12 mega attacks, the Internet and telecom sector received the largest share of attacks, albeit indirectly. The 10 attacks listed as Internet and telecom were actually targeting gaming sites hosted on the customer network. In q1 2015, the 170 Gbps attack was generated a multi-vector volumetric attack that used the same padded syn flood, along with a udp fragment flood and a udp flood as seen in this quarter’s largest attack. That is compared with q2 2014, when the most significant attack was measured by packet per second volume. That attack was a dns amplification attack out of China that peaked at 110 Mpps. 10 akamai’s [state of the internet] / security / Q2 2015 / www.stateoftheinter net.c om

[SECTION] 1 ANALYSIS EMERGING TRENDS Q2 2015 Attacks 100 Gbps Gaming Internet/Telecom 249 210 144 120 100 80 157 144 118 109 106 145 126 121 4-May 6:51 240 220 200 180 160 140 1-May 14:25 Gbps 260 115 18-May 20:15 30-Apr 6:03 25-Apr 14:15 24-Apr 3:25 18-Apr 4:44 11-Apr 3:30 9-Apr 3:40 8-Apr 5:32 4-Apr 4:58 20 0 3-Apr 13:12 60 40 Attacks Date and Starting Time (GMT) Figure 1-1: Ten of the mega attacks targeted the Internet and telecom industry In q2 2015, five attacks peaked at more than 50 Mpps, as shown in Figure 1-2. Attack campaigns of this volume can exhaust ternary content addressable memory (tcam) resources in border edge routers, such as those used by Internet service providers (ISPs). This can result in packet loss, while stressing the cycles of the router’s central processing unit (cpu). This can then result in collateral damage across the ISP’s network, which can manage production traffic for hundreds or thousands of organizations. 11 akamai’s [state of the internet] / security / Q2 2015 / www.stateoftheinter net.c om

[SECTION] 1 ANALYSIS EMERGING TRENDS The 214 Mpps attack on June 12 was one of the three largest DDoS attacks ever recorded across the Prolexic Routed network. The attack was based on a udp flood with 1-byte packets — the smallest possible payload — and it generated 70 Gbps of attack traffic. The 80 Mpps on May 15 was a little more complex, based on a Christmas tree DDoS flood, with every tcp flag turned on, targeting two /24 subnets over ports 80 and 443. As the attack continued, the attacker varied the tcp flag sequence configurations, while using an average payload size of 14-byte packets. Q2 2015 Attacks 50 Mpps High Tech / Consulting Services Internet/Telecom Gaming 220 214.35 200 180 Mpps 160 140 120 100 80 60 40 79.62 63.09 60.46 52.68 12-June 10:52 8-June 4:51 15-May 23:10 24-Apr 3:25 0 7-Apr 11:54 20 Attack Date and Starting Time (GMT) Figure 1-2: Several of the Q2 2015 mega attacks specifically targeted the TCAM limitations in tier 1 ISP routers 12 akamai’s [state of the internet] / security / Q2 2015 / www.stateoftheinter net.c om

[SECTION] 1 ANALYSIS EMERGING TRENDS 1.1C / DDoS Attack Vectors / In q2 2015, syn floods represented the top overall infrastructure-based attack (16%), bypassing ssdp by a razor-thin margin. ssdp was the top attack vector in q1 2015 and q4 2014. In q2, ssdp attacks represented just under 16% of all attacks. This vector first appeared in q3 2014 and has not been subject to the same cleanup efforts as ntp and dns, since many ssdp reflection attacks are leveraging unsecured in-home consumer devices. These attacks have two victims: the owners of the devices used as reflectors and the actual attack target. These owners are typically home users who are unlikely to realize that their devices are participating in attacks. Even if they do notice slowness in their networks, they may not have the expertise to troubleshoot, mitigate or detect the cause. Figure 1-3 displays the frequency of observed attack vectors at the DDoS layer. 13 akamai’s [state of the internet] / security / Q2 2015 / www.stateoftheinter net.c om

[SECTION] 1 ANALYSIS EMERGING TRENDS DDoS Attack Vector Frequency, Q2 2015 Percentage 0 5 10 6.42% CHARGEN 8.74% DNS Infrastructure DDoS Layer 20 2.14% ACK 2.56% ICMP RESET 15 1.02% SSDP 15.86% SYN 16.00% UDP FLOODS 11.49% UDP FRAGMENT 13.63% 9.44% NTP Other 2.46% FIN FLOODS (0.79%) RIP (0.09%), XMAS (0.42%) RP (0.37%), SNMP (0.65%) Application DDoS Layer SYN PUSH (0.14%) 8.74% HTTP GET HEAD HTTP POST PUSH 0.70% 0.37% 0.42% Application DDoS Layer 10.23% Infrastructure DDoS Layer 89.77% Figure 1-3: Nearly 90% of DDoS attacks targeted infrastructure layer in Q2 2015, a trend that has continued for the past year 14 akamai’s [state of the internet] / security / Q2 2015 / www.stateoftheinter net.c om

[SECTION] 1 ANALYSIS EMERGING TRENDS Infrastructure-based attacks accounted for the lion’s share of DDoS activity in the second quarter. Application layer DDoS attacks accounted for 10% of all activity, while the infrastructure layer experienced 90% of DDoS attacks, down slightly from 91% in q1. This trend of mostly infrastructure attacks has continued for more than one year, as attackers have relied more and more on reflection vectors as the primary DDoS attack method. Not only do these reflection attacks obscure the true ip addresses of the attackers, they also require fewer attack resources relative to the size of the attack. That said, DDoS attack scripts on the application side have been shifting more towards the use of non-botnet based resources, such as attack scripts that leverage open proxies on the Internet. This trend, along with the continued abuse of WordPress and Joomla-based websites as get flood sources, may pave the way to a continued increase in application-based reflected DDoS attacks that abuse web application frameworks. 1.1D / Infrastructure Layer vs. Application Layer DDoS Attacks / ssdp attacks accounted for a little less than 16% of all attacks, while syn floods accounted for 16% of attacks. As the 100 Gbps attacks show, the syn flood attack plays a major role in the larger attacks. udp floods accounted for 11%, while udp fragments accounted for 14%. As stated in previous reports, the fragments are sometimes a byproduct of other infrastructure-based attacks. In particular, udpbased chargen and dns reflection attacks together accounted for just over 15% of attacks. By comparison, in q2 2014 the most used infrastructure-based attack vectors were syn floods (26%), udp fragment (13%), udp floods (11%) and dns attacks (8%). Additionally that quarter, ntp attacks accounted for 7%, chargen for 5%, icmp for 7%, and ack floods for 5%. ssdp and syn have continued to gain popularity since it was first observed back in q3 2014. 15 akamai’s [state of the internet] / security / Q2 2015 / www.stateoftheinter net.c om

[SECTION] 1 ANALYSIS EMERGING TRENDS At the application layer, http get flood attacks came in at 7.5% head, http post and push attacks accounted for less than 2% each. Many of the get flood attacks were based on a combination of the Joomla, WordPress and get flood attacks via proxy. http get floods have been consistently favored by attackers targeting the application layer. The top application-layer DDoS attack in q4 2014 was http get floods, which was the case as well in q1 2014. A full comparison of attack vector frequency is shown in Figure 1-4 and Figure 1-5. 16 akamai’s [state of the internet] / security / Q2 2015 / www.stateoftheinter net.c om

DDoS Attack Vector Frequency by Quarter Q2 2014 Q3 2014 Q4 2014 Q1 2015 Q2 2015 4.86% 3.81% 2.77% 1.99% 2.14% ACK 4.54% 3.92% 5.20% 5.78% 6.42% CHARGEN 8.11% 7.42% DNS 5.93% 10.51% 8.74% 7.46% 8.90% 8.42% 7.47% 8.74% HTTP GET 4.18% ICMP 6.59% 3.59% 2.56% 4.56% NTP 8.05% 7.35% 8.15% 6.88% 9.44% 7.31% SSDP 14.62% 20.78% 15.86% SYN 16.91% 15.79% 16.00% 11.24% UDP FLOODS 25.73% 23.09% 15.25% 10.58% 13.25% 11.49% 13.41% 13.88% 13.95% 12.01% 13.63% UDP FRAGMENT 0 5 10 15 20 Figure 1-4: The 10 most common attack vectors over the past five quarters 25 30

DDoS Attack Vector Frequency by Quarter Q2 2014 Q3 2014 Q1 2015 Q2 2015 2.05% 0.42% 0.27% FIN FLOODS Q4 2014 0.75% 0.79% 0.11% 0.21% 0.13% 0.15% 0.22% FIN PUSH HEAD 0.20% 0.25% 0.70% 2.27% 0.53% HTTP POST 1.15% 0.70% 0.37% 0.11% IGMP FRAGMENT PUSH 0.76% 0.64% 0.54% 0.90% 0.42% RESET 0.64% 0.65% 1.30% 0.94% 1.02% 0.22% RIP 0.09% 0.43% 0.11% 0.40% 0.45% 0.37% RP 0.21% SNMP 3.03% 0.67% 1.15% 0.65% 0.11% SYN PUSH 0.07% 0.42% 0.35% 0.14% 0.11% TCP FRAGMENT 0.07% 0.05% 0.27% XMAS 1.15% 0.42% 0.0 0.5 1.0 1.5 2.0 2.5 3.0 Figure 1-5: These 13 attack vectors have been seen less frequently during the past five quarters

[SECTION] 1 ANALYSIS EMERGING TRENDS 1.1E / Top 10 Source Countries / China remained the top producer of nonspoofed DDoS attack traffic at 37% compared to 23% last quarter. The us was the second-largest source of attacks (17%), with the uk coming in third (10%). All three countries showed significant growth in the number of attacks originating from within their borders, with each showing a 50% increase over the previous quarter. Top 10 Source Countries for DDoS Attacks, Q2 2015 Taiwan 4% Australia 4.18% Germany 4.29% RussianFederation 4.45% Korea 4.53% Spain 6.03% India 7.43% UK 10.21% China 37.01% US 17.88% Figure 1- 6: Non-spoofed attacking IP addresses by source country, for DDoS attacks mitigated during Q2 2015 There is a considerable gap between the leaders and the rest of the pack with roughly 7% of attack traffic originating from India, while traffic from the Korean Peninsula, Russia and Germany had a combined 13%, with each region contributing a little more than 4% respectively. Australia and Taiwan made the top 10 for the first time, though attack traffic from both countries only registered 4% apiece. Australia’s appearance on the list is likely due to the increase adoption of high speed internet access throughout NBN and connectivity of IOT devices in the region. 19 akamai’s [state of the internet] / security / Q2 2015 / www.stateoftheinter net.c om

[SECTION] 1 ANALYSIS EMERGING TRENDS Top 10 Source Countries for DDoS Attacks by Quarter Q2 2015 Taiwan Australia Germany Russia Korea Spain India UK US China 4.00% 4.18% 4.29% 4.45% 4.53% 6.03% 7.43% 10.21% 17.88% 37.01% 0 Q1 2015 Russia France UK Korea India Spain Italy US Germany China 10% 30% 40% 30% 40% 30% 40% 5.95% 6.03% 6.17% 6.23% 6.93% 7.29% 8.38% 12.18% 17.39% 23.45% 0 Q2 2014 20% Thailand Russia Turkey Brazil India Mexico Germany China Japan US 10% 20% 4.44% 4.87% 5.16% 7.94% 8.26% 8.31% 10.30% 12.30% 18.16% 20.26% 0 10% 20% Figure 1-7: The US and China typically are among the top three non-spoofed sources for attacking IPs 20 akamai’s [state of the internet] security / Q2 2015 / www.stateoftheinter net.com

[SECTION] 1 ANALYSIS EMERGING TRENDS 1.1F / Target Industries / The online gaming sector was particularly hard hit in q2 2015, accounting for more than 35% of all attacks. Gaming was followed by software and technology, which suffered 28% of all attacks, as shown in Figure 1-8. Internet and telecom suffered 13% of attacks, followed by financial services (8%), media and entertainment (9%), education (3%), retail and consumer goods (3%), and the public sector (1%). Online gaming / Online gaming has remained the most targeted industry since q2 2014 and remained steady at 35% compared to last quarter. In q4 2014, attacks were fueled by malicious actors seeking to gain media attention or notoriety from peer groups, damage reputations and cause disruptions in gaming services. Some of the largest console gaming networks were openly and extensively attacked in December 2014, when more players were likely to be affected due to the new networked games launched for the holiday season. Software and technology / The software and technology industry includes companies that provide solutions such as Software-as-a-Service (SaaS) and cloudbased technologies. This industry saw a slight 2% drop in attack rates compared to last quarter. Internet and telecom / The Internet and telecom industry includes companies that offer Internet-related services such as ISPs and dns providers. It was the target of 13% of attacks, a 1% drop over the previous quarter. Financial services / The financial industry includes major financial institutions such as banks and trading platforms. The financial industry saw a small (less than 1%) drop in attacks from the previous quarter. While overall there was a slight reduction in attacks targeting this industry, it’s worth mentioning that they still saw some of the larger attacks (100 Gbps) of the quarter. Media and entertainment / The media industry saw a slight increase in the percentage of attacks, from 7% in q1 2015 to 9% in q2 2015. 21 akamai’s [state of the internet] / security / Q2 2015 / www.stateoftheinter net.c om

[SECTION] 1 ANALYSIS EMERGING TRENDS DDoS Attack Frequency by Industry Q1 2015 Q2 2015 4.93% 2.50% Education 8.40% 8.19% Financial Services 35.32% 35.20% Gaming 0.87% 0.41% Hotel & Travel 13.77% 12.90% Internet & Telecom 7.45% 9.41% Media & Entertainment 1.82% 1.05% Public Sector 2.25% 2.60% Retail & Consumer Goods 25.19% 27.74% Software & Technology 0% 5% 10% 15% 20% 25% 30% 35% 40% Figure 1- 8: The gaming industry remains a top target for malicious actors 1.1G / DDoS Attacks — A Two-Year Look Back / Figure 1-9 shows DDoS attack size as a function of time. A box and whiskers plot is used to show the measure of central tendency. The dark line in the box shows the median attack size. Fifty percent of the observed attacks were larger than the median and 50% of the observed attacks were smaller than the median. The box shows the interquartile range (iqr): Both boxes together encompass 50% of all attacks, with 25% of the attacks situated above the box and 25% of the attacks represented below the box. Each attack that took place during a given quarter is displayed as a dot so we can observe the size of individual attacks. 22 akamai’s [state of the internet] / security / Q2 2015 / www.stateoftheinter net.c om

[SECTION] 1 ANALYSIS EMERGING TRENDS Before we dive into the shape of the data, here are a few quick points to be aware of. 1. We’re making a conscious choice to use the median to describe an average attack rather than the mean. The median is much more resilient to the presence of outliers because it represents the point where 50% of all attacks are larger or 50% are smaller. 2. The set of observed DDoS attacks include an enormous number of small attacks and a few large ones. For legibility purposes, we’re choosing to use a logarithmic scale, which each interval representing a 10-fold increase. 3. There is a notch in each of the boxes centered on the median. The notches show confidence intervals for the median. If the notches for two consecutive boxes overlap, then there is not a statistically significant difference in the median attack size, as is exemplified by the fourth quarter of 2014 through the current quarter. Looking at the time series, a few patterns stand out. First, a significant increase in attack size occurred in q1 2014. The first four quarters we tracked (q1 – q4 2013) look similar to one another. The upper boundary of the iqr is roughly the same and three of the four medians are statistically similar. However, things changed between q4 2013 and q1 2014. The upper bound of the iqr increased dramatically (recall, this is a logarithmic scale), as has the median attack size. In q4 2014, things change once again. This time we see a statistically significant drop in the upper bound of the iqr, however, the median attack size remained unchanged. The size of the large attacks appears to be clumping closer to the median. 23 akamai’s [state of the internet] / security / Q2 2015 / www.stateoftheinter net.c om

[SECTION] 1 ANALYSIS EMERGING TRENDS DDoS Size as a Function of Time 100 Gbps 10 Gbps 1 Gbps 100 Mbps 10 Mbps 1 Mbps 100 Kbps Q1 2013 Q2 2013 Q3 2013 Q4 2013 Q1 2014 Q2 2014 Q3 2014 Q4 2014 Q1 2015 Q2 2015 Figure 1-9: The IQR chart is on a logarithmic scale and shows significant shifts in DDoS attack size and frequency over the past 10 quarters 1.2 / Kona Web Application Firewall Activity / For the q2 2015 report, we concentrated our analysis on nine common web application attack vectors. They represent a cross section of many of the most common categories seen in industry vulnerability lists. Akamai’s goal was not to validate any one of the vulnerability lists, but instead to look at some of the characteristics of these attacks as they transit a large network. As with all sensors, the data sources used by Akamai have different levels of confidence; for this report, we focused on traffic where Akamai has a high confidence in the low false-positive rate of its sensors. Other web application attack vectors are excluded from this section of the report. SQLi / sql injection is an attack where adversary-supplied content is inserted directly into a sql statement before parsing, rather than being safely conveyed postparse via a parameterized query. LFI / Local file inclusion is an atta

akamai's [state of the internet] / security / Q2 2015 / www.stateoftheinternet.com T he second quarter of 2015 set a record for the number of distributed denial of service (DDoS) attacks recorded on Akamai's Prolexic Routed network — more than double what was reported in q2 2014. !e pro"le of the typical attack, however, has changed.