The report said that the share of attacks from Linux botnets almost doubled (to 70 per cent) – and Linux bots are the most effective tool for the SYN-DDoS attack method. This is the first time that Kaspersky DDoS Intelligence has registered such an imbalance between the activities of Linux- and Windows-based DDoS bots.
SYN DDoS is one of the most common attack scenarios, but the proportion of attacks using the SYN DDoS method increased 1.4 times compared to the previous quarter and accounted for 76 per cent.
Oleg Kupreev, lead malware analyst at Kaspersky Lab said that it is Linux which is to blame.
“Linux servers often contain common vulnerabilities but no protection from a reliable security solution, making them prone to bot infections”, says. “These factors make them a convenient tool for botnet owners. Attacks carried out by Linux-based bots are simple but effective; they can last for weeks, while the owner of the server has no idea it is the source of an attack. Moreover, by using a single server, cybercriminals can carry out an attack equal in strength to hundreds of individual computers. That’s why companies need to be prepared in advance for such a scenario, ensuring reliable protection against DDoS attacks of any complexity and duration”.
Brazil, Italy and Israel all appeared among the leading countries hosting botnet Command and Control (C&C) servers. South Korea is the clear leader in terms of the number of C&C servers located on its territory, with its share amounting to 70 per cent. Brazil, Italy and Israel saw the amount of active C&C servers hosted in these countries nearly triple.
DDoS attacks affected resources in 70 countries over the report period, with targets in China suffering the most (77 per cent of all attacks). Germany and Canada both dropped out of the top 10 rating of most targeted countries, to be replaced by France and the Netherlands.
The report also identifies an increase in the duration of DDoS attacks. While the proportion of attacks that lasted up to four hours fell from 68 percent in Q1 to 60 percent in Q2, the proportion of longer attacks grew considerably – those lasting 20-49 hours accounted for nine percent (and those lasting 50-99 hours accounted for four per cent (one per cent in Q1).
The longest DDoS attack in Q2 2016 lasted 291 hours (12 days), an increase on the Q1 maximum of eight days.