Denial Of Service Attacks Increased Sharply In 2010

DDoS attacks surpass SQL injection to become most prevalent attack vector, security vendor Trustwave reports.

(click image for larger view)
Slideshow: 10 Massive Security Breaches
Between the first and second half of 2010, distributed denial-of-service (DDoS) attacks grew to surpass SQL injection attacks as the number-one attack vector against large businesses and organizations, according to a report from information security vendor Trustwave.
The study released Monday found that the principle drivers for Web attacks appear to be to causing Web site downtime (in 33% of cases), defacement (15%), stealing information (13%), planting malware to infect end clients (9%), and spreading disinformation (9%).
Despite the prevalence of downtime, most attacks appear to be profit-driven, and the Trustwave study found that attack outcomes largely mirrored this goal. For financial sector organizations, for example, 64% of attacks resulted in monetary loss, with 59% of firms admitting that they lacked robust enough authentication, and 36% saying that theyd been hacked using stolen credentials. Meanwhile, in the retail sector, 27% of attacks resulted in credit card data leakage, and SQL injection attacks were the principle method of attack.
Likewise, government Web sites most frequently fell due to SQL injection attacks (used in 24% of cases) and because of improper Web application input handling (for 26% of organizations). Thankfully, the principle outcome (in 26% of cases) was only Web site
defacement
.
As noted, DDoS attacks have become the principle hacking technique (in 32% of cases), followed by SQL injection (21%) and cross-site scripting (9%). Brute force, cross-site request forgery, process automation, and known vulnerability attacks were also seen, though less frequently.
Unfortunately, DDoS attacks are becoming harder to stop. In particular, newer types of attacks often target the Web application layer. Instead of overwhelmingly a network with packets, attackers can employ a smaller number of specially crafted requests -- using HTTP, HTTPS, SMTP, FTP, and similar protocols -- to produce a denial of service. For example, Slowloris, a free tool released in 2009, uses time-delayed HTTP headers to prevent HTTP connections from expiring, until servers simply run out of bandwidth.
According to Trustwaves report, the bottom line is that the overall amount of traffic needed to potentially take down a Web site is much less than is required to flood the network pipe leading to the Web server.
Trustwave isnt the first firm to spot the rise in DDoS attacks or variation in techniques. Last month, an Arbor Networks
study
blamed botnets for a noticeable increase in DDoS attack sophistication and frequency. Notably, it found that DDoS attack bandwidth increased by 102% during 2010, and rose by a staggering 1,000% from 2005 and 2010.

Last News
▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security	▸ Researchers create BlackForest to gather, link threat data. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Denial Of Service Attacks Increased Sharply In 2010