The fearful reality is that botnet and distributed denial of service (DDoS) attacks continue to scale up, not only in quantity but also in sophistication. Traditionally, the goal of DDoS was to take websites offline. However, nowadays cyber criminals are using DDoS attacks as a means to diversify and strategize a deeper and more damaging infiltration.
For example, according to the latest research by Neustar, attackers jumpstart a series of coordinated DDoS attacks with the goal of distracting IT departments. While IT personnel is focused on trying to figure out when and where will the next strike will be, attackers hide other attack techniques behind the DDoS attacks with the end goal of achieving a major cyber heist.
These comprehensive cyber attacks via botnet and DDoS have already begun to cause major damage, and the data is here to prove it.
Neustar’s recent survey unveiled the following disturbing findings: 73% of global brands were hit with a DDoS attack in 2015; 45% of organizations admitted they were actually hit six or more times with DDoS attacks in 2015. In terms of damaged caused, 42% of companies confirmed it took them 3 or more hours to detect the attacks. Moreover, 50% of companies estimated that an hour of outages caused by the DDoS attacks cost them about $100,000 in revenue loss. Lastly, 57% of all DDoS attacks resulted in irreparable damages to the companies, such as customer data theft, intellectual property theft, and/or direct financial theft.
Similar to Neustar, ThreatMatrix recently released a report alarming companies about how exactly DDoS and Botnet attacks have evolved into our worst nightmare. The report confirms that current botnet attacks are all about low and slow bots “designed to evade rate and security control measures and mimic trusted customer behavior / login patterns.”
The report confirms that these sophisticated attacks are becoming increasingly hard to detect and companies lack the line of defense to protect themselves. ThreatMatrix uses as an example a group of attackers they have tracking, who are using botnets to acquire lists of stolen user credentials with the goal of launching a comprehensive credential testing session among e-commerce merchants. When that session begins, merchants will be hit with enormous transaction spikes for several days, but by that, time the attackers will have already put together a list of known password and username combinations that they will be able to use in other low-intensity attacks.
The good news is that research companies are already investigating how they can get ahead of botnet and DDoS advancements. But in the meantime, until businesses can come up with a better way of differentiating between a human and a bot, companies will continue to be susceptible to these attacks.
