Pulse-Wave DDoS Attacks Mark a New Tactic in Q2

itman · Oct 5, 2017

A new tactic for DDoS is gaining steam: the pulse wave attack. It’s called such due to the traffic pattern it generates—a rapid succession of attack bursts that split a botnet’s attack output.

According to Imperva’s latest Global DDoS Threat Landscape Report, a statistical analysis of more than 15,000 network and application layer DDoS attacks mitigated by Imperva Incapsula’s services during Q2 2017, the largest network layer assault it mitigated peaked at 350Gbps. The tactic enables an offender to pin down multiple targets with alternating high-volume bursts. As such, it serves as the DDoS equivalent of hitting two birds with one stone, the company said.

“A DDoS attack typically takes on a wave form, with a gradual ramp-up leading to a peak, followed by either an abrupt drop or a slow descent,” the company explained. “When repeated, the pattern resembles a triangle, or sawtooth waveform. The incline of such DDoS waves marks the time it takes the offenders to mobilize their botnets. For pulse wave attacks, a lack of a gradual incline was the first thing that caught our attention. It wasn’t the first time we’ve seen attacks ramp up quickly. However, never before have we seen attacks of this magnitude peak with such immediacy, then be repeated with such precision.”

Whoever was on the other end of these assaults, they were able to mobilize a 300Gbps botnet within a matter of seconds, Imperva noted. This, coupled with the accurate persistence in which the pulses reoccurred, painted a picture of very skilled bad actors exhibiting a high measure of control over their attack resources.

Meanwhile, as the origin of 63% of DDoS requests in Q2 2017 and home to over 306,000 attacking devices, China retained its first spot on the list of attacking countries.
Click to expand...

https://www.infosecurity-magazine.com/news/pulsewave-ddos-attacks-mark-q2/

RockLobster · Oct 6, 2017

I think they are over thinking that one. If you create a bot that for example sends a 10 second burst of data every minute on the minute, assuming most systems time are automatically kept accurate, then when the botnet receives instruction to DDOS a target domain, the attack would be highly synchronized as described.
It would be a reletively simple coding excersise to modify a bot to use the system time.

EASTER · Oct 6, 2017

RockLobster said: ↑

I think they are over thinking that one. If you create a bot that for example sends a 10 second burst of data every minute on the minute, assuming most systems time are automatically kept accurate, then when the botnet receives instruction to DDOS a target domain, the attack would be highly synchronized as described.
It would be a reletively simple coding excersise to modify a bot to use the system time.
Click to expand...

Quite correct.

Same old tactics, different name.

Log in or Sign up

Pulse-Wave DDoS Attacks Mark a New Tactic in Q2

itman Registered Member

RockLobster Registered Member

EASTER Registered Member

Log in or Sign up

Pulse-Wave DDoS Attacks Mark a New Tactic in Q2

itman Registered Member

RockLobster Registered Member

EASTER Registered Member

Useful Searches