DDoS Returns: What Researchers Are Learning About Targets, Tactics

Two IT security specialists share what they've learned about the targets chosen for DDoS attacks and how to adjust security strategies based on those lessons. (Second in a series)

By Bill Brenner, Senior Editor

January 20, 2010 — CSO —

The ability of attackers to dig deeper and wider thanks to the proliferation of botnets was covered in the first article of this series, DDoS Attacks Are Back (and Bigger Than Before). The trend is also covered at length in The Botnet Hunters.

In this article, two IT security practitioners -- one with experience in dealing with DDoS attacks against government systems, the other an expert from the corporate side -- share what they've learned about the targets chosen for DDoS attacks and how to adjust security strategies based on those lessons.

CSOonline conducted Q&As with Jerry Mangiarelli, a security specialist with TD Bank in Canada, and Israeli researcher Gadi Evron.

A corporate security specialist on motives and tactics
Jerry Mangiarelli has gained a lot of private-sector perspective on the DDoS threat over the years through his own personal research into botnets. He's a frequent speaker on the subject at such security conferences as EC-Council, SecTor and FSP. Here, he gives examples of what his research says about hacker tactics and motives.

CSO: What was it that shifted your focus so heavily into the area of bot-related DDoS attacks?
Mangiarelli: The shift was influenced by my continued interest/research in malware and the application layer. The adversaries' motives that we've witnessed over the years as botnets mesh with the application layer is that there's a lot of return-on-investment (ROI) for them.

Describe what goes into your research in terms of hours spent and tools used.
Mangiarelli: I spend a considerable amount of time researching. I like to call it my nightshift after the kids are in bed. I spend the time evaluating tools used by adversaries specifically around the development of Web-based DDoS toolkits.

Based on your research to date, what is most surprising about the firepower behind DDoS attacks?
Mangiarelli: What most individuals are unaware of is their ability to utilize Web servers as controllers. The FTP attacks that were launched early 2009 and the mass SQL Injections from 2008 that carried over into 2009 have displayed opportunities to expand on the DDoS armies.

Are you finding such attacks are directed more toward the corporate world or are most politically motivated?
Mangiarelli: As I alluded to earlier, adversary motives have changed. Each bot is now created differently with additional modules which are specific to each bot herder's needs or the needs of their customers. We'll continue to see attacks that target both worlds, corporate and political for a long time. This road will never end.

• Print