Large-Scale DDoS Attacks Grow Bigger and More Diversified According to Prolexic's Latest Report

HOLLYWOOD, FL – Prolexic Technologies, the global leader in Distributed Denial of Service (DDoS) protection services, today announced that the scale and diversity of attacks increased against its global client base in Q4 2012. This is one of a number of key findings contained in the company's Quarterly Global DDoS Attack Report, which was published today.

While Q4 media reports focused on large DDoS attacks primarily against U.S. financial services companies, Prolexic also mitigated 50+ Gbps DDoS attacks against clients in the e-Commerce and software as a service (SaaS) sectors. While the itsoknoproblembro (BroDoS) toolkit was used against financial services firms in Q4, data shows it was also used against businesses in other sectors. Digital forensics by the Prolexic Security Engineering & Response Team (PLXsert) also found that malware besides Brodos was used in Q4 to generate equally large bandwidth attacks.

"The fourth quarter was defined by the increasing scale and diversity of DDoS attacks," said Prolexic CEO, Scott Hammack. "While bandwidth attacks of 20 Gbps were the story last quarter, 50 Gbps is more relevant now."

Highlights from Prolexic's Q4 2012 Global DDoS Attack Report
Compared to Q3 2012

27.5 percent increase in total number of attacks

17 percent increase in total number of infrastructure attacks; 72 percent rise in total number of application attacks

67 percent increase in average attack duration to 32.2 hours from 19.2 hours

20 percent increase in average attack bandwidth from 4.9 to 5.9 Gbps

China retains its position as the top source country for DDoS attacks

Compared to Q4 2011

19 percent increase in total number of DDoS attacks

15 percent rise in total number of infrastructure attacks; 30 percent rise in total number of application attacks

6 percent decline in average attack duration to 32.2 hours from 34

13 percent increase in average attack bandwidth from 5.2 Gbps to 5.9 Gbps

Analysis and emerging trends
During Q4 2012, Prolexic mitigated seven attacks over 50 Gbps directed against clients in the financial services, e-Commerce and SaaS verticals. "A case could be made that the size of attacks that are being reported in the financial services industry really just reflects the normal growth in DDoS," said Hammack. "We are seeing similarly sized attacks in other verticals, but they don't make headlines because companies in these industries are not required to report it in the same way."

In addition to increasing attack sizes, attack volume grew in Q4 2012 and reached the highest number of attacks Prolexic has logged for one quarter. Like the previous quarter, traditional Layer 3 and Layer 4 infrastructure attacks were the favored attack type, accounting for 75 percent of total attacks during the quarter, with application layer attacks making up the remaining 25 percent. This split has remained consistent throughout 2012. This quarter, SYN (24 percent), GET (20 percent), ICMP (18 percent) and UDP (15 percent) floods were the attack types most often encountered during mitigation.

Average attack duration increased 67 percent from 19.2 hours in Q3 2012 to 32.2 hours this quarter. November was the most active month for attacks, however, the total number of attacks for all three months of the quarter were consistent, showing a less than 10 percent difference from month to month. The week of Nov. 26 was the most active of the quarter, although only by a narrow margin.

As is commonplace, the top 10 list of source countries responsible for launching the most DDoS attacks was fluid. However, this quarter China secured the top place in attack source country rankings by a wide margin. Compared to last quarter, the United States dropped down in the rankings, while two European countries, France and Germany, rejoined the top 10 list.

"The take away for businesses from this Q4 report is to make sure that their DDoS mitigation provider can handle attacks in excess of 50 Gbps in a single location," said Hammack. "When attacks are this large, it's important that the provider can mitigate this volume of attack traffic in one place and distribute it effectively so it does not compromise intermediary transit providers and affect others."

Data for the Q4 2012 report has been gathered and analyzed by the PLXsert. The group monitors malicious cyber threats globally and analyzes DDoS attacks using proprietary techniques and equipment. Through digital forensics and post-attack analysis, PLXsert builds a global view of DDoS attacks, which is shared with Prolexic customers. By identifying the sources and associated attributes of individual attacks, PLXsert helps organizations adopt best practices and make more informed, proactive decisions about DDoS threats.

A complimentary copy of the Prolexic Quarterly Attack Report for Q4 2012 is available as a free PDF download from www.prolexic.com/attackreports/. Prolexic's Q1 2013 report will be released in the second quarter of 2013.

About Prolexic
Prolexic is the world's largest, most trusted Distributed Denial of Service (DDoS) mitigation provider. Able to absorb the largest and most complex attacks ever launched, Prolexic restores mission-critical Internet-facing infrastructures for global enterprises and government agencies within minutes. Ten of the world's largest banks and the leading companies in e-Commerce, SaaS, payment processing, travel/hospitality, gaming and other at-risk industries rely on Prolexic to protect their businesses. Founded in 2003 as the world's first in-the-cloud DDoS mitigation platform, Prolexic is headquartered in Hollywood, Florida and has scrubbing centers located in the Americas, Europe and Asia. To learn more about how Prolexic can stop DDoS attacks and protect your business, please visit www.prolexic.com, follow us on LinkedIn, Facebook and Google+ or follow @Prolexic on Twitter.