In the last 12 months, cyber criminals have been using distributed denial-of-service (DDoS) attacks to target crypto-currencies.
That's according to Alex Cruz Farmer, security product manager at Cloudflare, who spoke at the ITWeb Security Summit 2018 event this week.
Criminal perpetrators of DDoS attacks often target sites or services hosted on high-profile Web servers such as banks or credit card payment gateways. Revenge, blackmail and activism can motivate these attacks.
However, when targeting crypto-currencies with DDoS attacks, "it's not for the good old ransom, it's a way to run the competition out of town".
Cloudflare is one of the biggest DDoS mitigation platforms in the world, serving over eight million domains across more than 150 data centres.
Soon to be the norm
A crypto-currency marketplace customer, who had migrated to Cloudflare, had an attack which according to Farmer demonstrated the complexities of modern day attacks, which he believes will soon be the norm.
"The customer noticed that there were a huge number of sign-ups to their Web site, way more than usual, and had assumed this was spam or some other scam. After a week or two, they found that thousands and thousands of these accounts were logging in, and repeatedly checking their account balances, which in turn caused their database platform to grind to a halt."
He explained that within a very short period of time, it was identified and the attack was dealt with, but the attackers did not stop there.
"Further application-based attacks occurred, focusing on almost every endpoint possible, to find another area of weakness. Fortunately, we were wise to these games, and our security teams were able to put adequate protections in place to block any further attacks."
DDoS evolution
He pointed out that DDoS attacks have evolved over the years, noting that the first ever DDoS was in 1988 caused by the Morris Worm, written by Robert Morris.
"It was a complete accident, the purpose was to gauge the size of the Internet. However, due to an oversight in the code, it ended up taking down the Internet, causing huge amounts of damage, leading to the first ever cyber-related felony in the US."
From then, he said DDoS attacks inherently were focused on exhausting CPU or other resources.
"For example, a simple TCP SYN attack on an Apache server would exhaust open sockets, rendering servers useless, causing any new connections to timeout. The only resolution was to restart the Web server."
TCP SYN flood (aka SYN flood) is a type of DDoS attack that exploits part of the normal TCP three-way handshake to consume resources on the targeted server and render it unresponsive. Essentially, with SYN flood DDoS, the offender sends TCP connection requests faster than the targeted machine can process them, causing network saturation.
"Unfortunately for the attackers, there were quick and easy solutions for server administrators to protect themselves from SYN attacks, so naturally, the evolution was to find the next destructive option; exhaust the network.
"Come to 2003, we had one of the most epic DDoS attacks ever seen, caused by the infamous SQL Slammer virus. Not only did these attacks cripple the target server, they also crippled the network, and in some cases even their upstream ISP," Farmer said.
Fast forward five to 10 years, we then saw the birth of User Datagram Protocol (UDP) based reflection attacks, primarily utilising NTP services (the service which sets the time on a computer, mobile phone or any other connected device), he pointed out.
"But, like always, patches are created, and the community came together to build necessary protections. It was UDP-based, so it was easy to block for most networks."
According to Farmer, 2016 is when things really changed. "Mirai was born, with its debut attack of 540Gb/sec targeting the Rio Olympics, then a few weeks later generating the largest attack the world had seen against security blogger Brian Krebs."
He explained that Mirai was orchestrated used IOT devices to generate the attacks. "While these devices may seem harmless, under the hood they run a real, fully-loaded operating system, mostly Linux. This means an attacker is able to run whatever script they wish, have it call home, update its firmware and most importantly, lock out the owner."
Share