Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: DDOS are way down? Why? - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
DDOS are way down? Why?

I have been tracking DDOS volume and patterns for a few years.  We have seen the attacks move from DNS to NTP, to chargen then on to SSDP and occasionally QOTD.  I think we have a much better understanding of the vulnerabilities which are enabling the successful amplification of DDOS attacks. Small steps have been made, and are continuing to be made, by vendors and ISPs, to reduce the impact of this style of attack.  

What I haven't been able to understand is why since late last year, other than the occasional booter and attacks on Brian Krebs, the incidence and volume of these attacks has dropped off almost completely?

Any ideas?

-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)

Rick

290 Posts
ISC Handler
Perhaps it's partly because app-layer attacks are being used more widely, with the volumetric component being used to supplement the app-layer attacks where required.
Anonymous
Perhaps consolidation on the demand side of the market and a trend toward using botnets for more profitable purposes?
Marquis

7 Posts

Sign Up for Free or Log In to start participating in the conversation!