IoT devices drive DDoS attack traffic in Q4

Unsecured IoT devices continued to drive significant DDoS attack traffic in the fourth quarter of 2016, according to Akamai’s latest State of the Internet / Security Report.

The fourth quarter report also revealed that attacks greater than 100 Gbps increased to 12 during the quarter, a 40% year-over-year increase.

Seven of the 12 Q4 2016 mega attacks, those with traffic greater than 100 Gbps, can be directly attributed to the Mirai IoT botnet.

But the largest DDoS attack in Q4 2016, which peaked at 517 Gbps, came from Spike, a non-IoT botnet that has been around for more than two years.

The number of IP addresses involved in DDoS attacks grew significantly this quarter, despite DDoS attack totals dropping overall. The United States sourced the most IP addresses participating in DDoS attacks – more than 180,000.

“With the predicted exponential proliferation of these devices, threat agents will have an expanding pool of resources to carry out attacks, validating the need for companies to increase their security investments,” said Martin McKeay, senior security advocate and senior editor of the report.

“Additional emerging system vulnerabilities are expected before devices become more secure.”

Of the 25 DDoS attack vectors tracked in Q4 2016, the top three were UDP fragment (27%), DNS (21%), and NTP (15%), while overall DDoS attacks decreased by 16 percent.

Akamai started tracking a new reflection DDoS attack vector this quarter, Connectionless Lightweight Directory Access Protocol (CLDAP), which attackers abuse to amplify DDoS traffic.

“If anything, our analysis of Q4 2016 proves the old axiom ‘expect the unexpected’ to be true for the world of web security,” continued McKeay.

“For example, perhaps the attackers in control of Spike felt challenged by Mirai and wanted to be more competitive. If that’s the case, the industry should be prepared to see other botnet operators testing the limits of their attack engines, generating ever larger attacks.”