Groups War Over Resources For DDoS Attacks (csoonline.com)

An anonymous reader quotes CSO: As more groups get into the denial-of-service attack business they're starting to get in each other's way, according to a report released Thursday... There are only so many devices around that have the kind of vulnerabilities that make them potential targets for a botnet. That translates into a smaller average attack size, said Martin McKeay, senior security advocate at Cambridge, Mass.-based Akamai Technologies Inc. There are only so many devices around that have the kind of vulnerabilities that make them potential targets for a botnet. "And other people can come in and take over the device, and take those resources to feed their own botnet," he said. "I'm seeing that over and over."
The article reports a median size for DDoS attacks of 4 gigabits per second at the start of 2015 -- which droped in the first quarter of 2017 down to 500 megabits per second.

Comments

Go Brickerbot!

[Dutch Gun]

I'm rooting for BrickerBot. Shut those vulnerable devices down permanently, and there's less for the rest of us to worry about.

Re: Go Brickerbot!

[Anonymous Coward]

Destroying the devices is the most just outcome. Companies that make trash devices with no security will only suffer if their customers turn around and hold them accountable. We should knock these things out of service and remove the distinction between half broken and fully broken products.

Re:Go Brickerbot!

[Anonymous Coward]

We should shoot the people who get robbed. Then we won't have crime.

Re:Go Gaysexbot!

[Anonymous Coward]

I'm all for gaysexbot! I just want gaysexbot to influence everyone just like the Russians influenced the US elections. If you just *TELL* people to do something like have gay sex or vote for TRUMP, that's all it takes to change their minds!

Needs more stats

[jon3k]

Lower median could also mean that it's so easy that lots of unskilled botnet creators have entered the arena. You'll notice at the same time the largest DDoS attacks continue to grow year over year.

Re:Needs more stats

[mhkohne]

Lower median could also mean that it's so easy that lots of unskilled botnet creators have entered the arena. You'll notice at the same time the largest DDoS attacks continue to grow year over year.

I think that's exactly what it means, but this means that anyone who really is smart is going to have to go after other classes of device when trying to perform a DOS - because all the kiddies are fighting over the stuff that they used to use. They may still be able to do damage, but they'll have to work for it again, instead of just being able to re-use the stuff they had before.

Re:Needs more stats

[Zocalo]

Or the writers of the rootkits could try to secure the device they have just owned, something that has already been done by several rootkits and exploits in the past. It's actually very rare to see a genuine 0-day exploit being used to generate a botnet, they far more often tend to rely on exploits that have been released for a while and for which patches are often already available, as we just saw with WannaCry. There's basically a race between the vendors of the rootkits who will need to add a new exploit to their kits once the details go public, then get it deployed in the wild (or sold to those that do via the darknet) first, so they can maximise the yield. In that light, it's probably just a matter of time before we see more advanced defensive mechanisms built into the rootkits to try and prevent a competitor usurping control; things like closing down external admin ports, enabling and configuring any available host based firewalling, and selectively installing any outstanding OS patches that won't compromise the malware.

Re:Needs more stats

[Anonymous Coward]

If you do try and close down external admin ports, changing firewall settings and installing OS patches, that may just tip off the real admins that they've been rootkitted. Admins could simply run auditing scripts that check if any disk space, firewall settings, kernel patches or admin ports have changed.

Re:Needs more stats

[Zocalo]

If the admins are that on the ball with their security then you'd kind of expect them to detect and deal with the infection anyway, assuming that they were even vulnerable in the first place, so at best the rootkit is going to buy its operator a little bit of time by doing the bare minimum necessary to setup the bot, but probably not all that much. The flipside would be that the almost certainly far more numerous number of potential targets that don't have a competent admin (including most home PCs) or are not all that responsive would be less likely to have a competing botnet muscle in, which is probably more beneficial to the botnet operator in the long run. Presumably there's a tipping point at which securing the host becomes preferable to keeping a low profile, and if the competition between botnets is as heated as TFA implies, then my guess would be that it was passed sometime ago.

Re:Needs more stats

[jon3k]

I think it's just that we have an entirely new class of targets. We had botnets before Marai and IoT botnets, those didn't go away. We've added more devices to the internet we didn't make any significant improvements to the security of existing devices.

Re: Go Gaysexbot!

[Anonymous Coward]

The fuck kind of low grade unfunny troll is this?

DDoS Map...

[Anonymous Coward]

http://www.digitalattackmap.co...
  You're welcome

Encourage!

[Anonymous Coward]

Do what you can to promote this, and perhaps these derps will start to snuff each other out. The Internet being left a better place as a result.

Re:Encourage!

[Anonymous Coward]

lol sure, like promoting guns in 'murka is getting rid of criminals, and reducing guns deaths.

Repeat yourself, you do

[JustAnotherOldGuy]

"As more groups get into the denial-of-service attack business they're starting to get in each other's way, according to a report released Thursday... There are only so many devices around that have the kind of vulnerabilities that make them potential targets for a botnet. That translates into a smaller average attack size, said Martin McKeay, senior security advocate at Cambridge, Mass.-based Akamai Technologies Inc. There are only so many devices around that have the kind of vulnerabilities that make them potential targets for a botnet."

Editing, you should.

From the redundant redundancies dept.

[BarbaraHudson]

There are only so many devices around that have the kind of vulnerabilities that make them potential targets for a botnet. That translates into a smaller average attack size, said Martin McKeay, senior security advocate at Cambridge, Mass.-based Akamai Technologies Inc. There are only so many devices around that have the kind of vulnerabilities that make them potential targets for a botnet.

First they came and duped stories. I didn't say anything because sometimes I missed the original story.

Then they came and duped posts. I didn't say anything because they were easy to ignore.

Next they came and duped sentences in stories to pad them out. I said something ...

TThheeyy rreettaalliiaatteed bbyy bboott--dduuppinngg mmyy kkeeyybbooaarrdd,, tthhee bbaassttaarrddss.

Re:From the redundant redundancies dept.

[Anonymous Coward]

Wow, the quality of the submissions on slashdot is droping like a stone.

Re:From the redundant redundancies dept.

[Anonymous Coward]

plop

Re: Go Gaysexbot!

[Anonymous Coward]

^ Funnybot says AWKWARD! ^
 
Captcha: soros-funded globalist AC shill parent!

My only question is

[Anonymous Coward]

When will more cars and trucks be connected to the internet?

Re: Go Gaysexbot!

[Anonymous Coward]

It's almost like the nerdier Trumpets are getting into machine learning, to shitpost for them.

Re: Go Gaysexbot!

[Anonymous Coward]

Yeah we have seen South Park. That episode was only funny because how absurd it was.
You, on the other hand, are just dumb.

ohhh

[Anonymous Coward]

we should kill politicians and erase the laws then there is no crime!!!!