Distributed Denial of Service (DDoS) attacks have become an ongoing threat to organizations. Any entity with an online presence can become a DDoS target.

What is a Botnet? 

The bots that make up a botnet can include computers, smartphones, virtualized machines, and a wide range of Internet of Things (IoT) devices such as IP cameras, smart TVs, routers, and even children’s toys, i.e., anything with an internet connection.

What Do Botnets Do?

Botnets are used for four main purposes, and generally, a botnet can be switched as a whole or in parts between any of these functions.

1. Spam and Phishing

Amr Alashaal, Regional Vice President

Bots enable spammers to avoid the problem of their IP addresses getting blacklisted; even if some bots get blacklisted, they can create thousands of backup IPs. Targeted botnet spam is used for phishing for identity theft. By generating huge amounts of spam email messages inviting recipients to visit promotional websites, websites impersonating banks and other financial institutions, and fake competitions, scammers try to harvest personal information such as bank account details, credit card data, and website logins.

2. Pay-per-Click Fraud

To increase website advertising revenues, botnets hijack the pay-per-click advertising model by faking user interaction. Because of the distributed nature of the click sources, it’s hard for advertising networks to identify click fraud.

3. Cryptomining

An IoT botnet is the perfect platform for crypto-mining. By running the algorithms that mine cryptocurrencies on tens of thousands of bots, hackers steal computing power from the device owners, creating significant revenue without the usual costs of mining, like electricity.

4. DDoS Attacks-as-a-Service

DDoS attacks are easily launched using botnets, and as with botnet-generated spam, the bots’ distributed nature makes it difficult for organizations to filter out DDoS traffic. Botnets can execute any DDoS attack and even launch multiple attack types simultaneously.

A relatively new hacker business is DDoS-as-a-Service. Individuals can buy DDoS attacks for as little as $5 per hour on certain websites across both the Dark Web and regular web, with price scaling based on the attack’s scale and duration.

Botnet Command and Control 

The latest botnet command and control communications are based on peer-to-peer (P2P) connections. In this model, compromised devices discover each other by scanning IP address ranges for specific port and protocol services and sharing lists of known peers and commands with any identified botnet members. 

The Future of Botnet and DDoS Attacks and How to Respond 

Botnets are here to stay. All IT teams should prepare to deal with a botnet and DDoS attack. The first step is to realize that no online property or service is too big or too small to be attacked.

Secondly, organizations should plan for increased bandwidth, ideally on an as-needed basis. The ability to scale up an internet connection will make it harder for a botnet and DDoS attack to saturate access and isolate an organization from the internet. 

Thirdly, organizations should consider using or expanding their content delivery network (CDN) to increase client-side delivery bandwidth. The use of multiple CDNs also increases resilience to DDoS attacks. 

Finally, businesses should strengthen everything. Strategically deploying hardware and software DDoS mitigation services throughout organizational infrastructure is key to reducing the potential impact of a botnet and DDoS attack.

Explain the latest enterprise solutions NETSCOUT offers to SMEs and large enterprises

Gaurav Mohan, VP, SAARC & ME, NETSCOUT

One of our latest innovations for businesses is Omnis AIF. This AI-based solution helps users instantly and automatically thwart a significant amount of distributed denial of service (DDoS) attacks, thereby streamlining operations and reducing exposure to risk. Our approach is different because we leverage global observations in DDoS attack activity to drive local automation and response. Therefore, we can drastically lessen our customers’ exposure to DDoS attacks and their potential consequences for their businesses.

We have added the nGeniusEDGE Server to our service assurance offerings to guarantee that businesses are kept up-to-date and protected against any potential vulnerabilities to their networks. This all-in-one, plug-and-play solution gives customers the oversight and information they need to guarantee a positive final-user experience, regardless of where staff members physically perform their duties. nGeniusEDGE Server is a simple-to-deploy technology that alerts IT departments to issues as soon as they arise, allowing them to fix them before they disrupt business operations and end-user satisfaction.

What are the key products or solutions you are presenting at the GITEX 2022?

At GITEX, we will showcase our full suite of cybersecurity and service assurance offerings. NETSCOUT Omnis Security is a portfolio of network-based cybersecurity solutions and products that delivers the scale, scope, and consistency necessary to secure today’s enterprise networks, thereby strengthening the digital infrastructures of regional businesses. These tools enable cybersecurity teams to detect and respond to threats quickly and comprehensively throughout their networks.

We’ll also be showcasing our service assurance portfolio, which is built to facilitate seamless operations across enterprises. Our nGeniusONE Service Assurance solution is one of our flagship solutions, providing visibility and analysis into any infrastructure environment – data center, private & public cloud, and co-locations; for whatever service is deployed – customer-facing applications, voice, video, SaaS, and UCaaS; and from wherever they are accessed – headquarters, regional locations, or home offices.

 Tell us about NETSCOUT’s business goals for the remainder of 2022 and plans for 2023

At NETSCOUT, we constantly listen to our customer’s evolving needs and objectives. We’re growing our presence in the Middle East by securing new customers, introducing our services to a wider range of existing customers, and deploying more sales staff to the region. We are devoted to improving the efficiency of our customer’s online environments.

How do you distinguish between NETSCOUT and its competitors in offering cloud and cybersecurity solutions?

Businesses and service providers worldwide rely on NETSCOUT to help keep their networks safe against distributed denial of service attacks and other advanced threats.

We protect digital business services against disruptions in availability, performance, and security. Our market and technology leadership stems from combining our patented smart data technology with smart analytics. This is what differentiates us from other vendors in the industry.

The world has been going through significant changes: facing a global COVID-19 pandemic, researching how the SARS-CoV-2 virus works, and then delivering a defense via vaccines to fight back. Similarly, in the world of cybersecurity, we saw many changes in the first half of 2021. A10 Networks’ recent report on the H1 2021: The Global State of DDoS Weapons sheds light on potential DDoS weapons and their behavior to ensure DDoS attacks can be mitigated regardless of the country or organization they belong to. The report provides detailed insights into the origins of DDoS activity, how easily and quickly modern malware can hijack IoT devices and convert them into malicious botnets, and what organizations can do to protect against such activities.

Amr Alashaal, Regional Vice President – Middle East at A10 Networks

As per the report, while DDoS attacks kept growing in size and frequency, attackers particularly focused on low-volume attacks that ran for longer periods, frequently injecting attack traffic. These low-volume attacks helped them evade basic defensive measures, but low thresholds still had a significant impact on systems and operations. We also saw some positive changes, for example, a large-scale botnet takedown by an international operation across different continents. Organizations began paying a lot more attention to DDoS, raising awareness around the role of malware in DDoS attacks, and providing insights into how systems and operations can be protected from attacks, large or small.

Organizations are paying more attention to infectious malware, like Mozi. Some vigilante groups have even started using DDoS attacks as a defensive measure, attacking systems that exhibit scanning behavior. A10 has seen this behavior exhibited on our honeypots. While employing DDoS attacks against the very attackers might be considered controversial, it helps ultimately reduce DDoS attacks and the expansion of botnets.

Key Insights from the report:

• The total number of DDoS weapons has increased by approximately 2.5 million in the first half of 2021, in line with the last two reports, with a total number of approximately 15 million weapons. This number includes both reflected amplification weapons as well as botnet agents readily available for exploitation by attackers.
• SSDP (Simple Service Discovery Protocol), which can be a dangerous and potent DDoS weapon, remained at the top with over 3.2 million potential weapons exposed to the internet. The rest of the weapons remained virtually the same as before, with SNMP, Portmap, TFTP, and DNS Resolvers as the top five. It is important to note that almost all of these weapons experienced a growth in numbers except for DNS Resolvers, which had a reduction of over 300,000 weapons.
• China continues to lead in hosting the highest number of potential DDoS weapons (almost 2 million), including both amplification weapons and botnet agents.
• The United States remains the second-largest source of DDoS weaponry, particularly amplification weapons.
• The number of total botnet agents was almost halved, with China hosting 44% of the total number of drones available worldwide.
• Mozi, one of the highly prevalent malware in the DDoS world, topped out at over 360,000 unique systems using more than 285,000 unique source IP addresses, likely due to address translation. First identified in 2019, Mozi has been evolving and increasing in size ever since. It can now persist on network devices by infiltrating the device’s file system, remaining functional even after the device has been rebooted. The Mozi botnet includes infected bots around the globe with China, India, Russia, Brazil, and Vietnam leading the list of countries and regions.

In conclusion, cybercriminals and cyberattacks have been evolving at a steady pace. With new attacks and new malware variants that come out, we see new layers of sophistication in how IoT and smart devices are weaponized. While these attacks become more prevalent, one thing is quite obvious — they don’t go unnoticed. Now is the time to update our defensive strategies by incorporating the Zero Trust model and investing in modern, artificial intelligence/machine learning-based solutions that will not only defeat attacks in real-time but also protect against the unknown.

“The EMEA region is of strategic importance to Infoblox, so finding the right leadership is critical to our ongoing success,” said McCarthy. “Cherif has done a terrific job in leading the Middle East and Africa team over the past two years. During his tenure, he helped significantly grow the regional business while developing a strong partnership model. Under his leadership and given his expertise in security and cloud solutions, I am confident that Infoblox will flourish in the EMEA region.”

“With the rising number of DDoS attacks and data breaches, DNS Security has become mandatory to ensure safe computing in service provider and enterprise networks,” said Sleiman. “Organizations must realize that ignoring DNS as a threat vector can result in damaging consequences. The recent European Union General Data Protection Regulation (GDPR) aims to strengthen data protection and will hold institutions responsible for any data privacy breaches. Infoblox is uniquely positioned to help organizations comply with GDPR and other data privacy regulations by delivering DNS based security measures.”

Sleiman has more than 22 years of sales, technical and business experience with some of the world’s leading networking and telecommunications technology companies including Cisco Systems and Nortel Networks. He is a subject matter expert and well versed in the areas of security, compliance, cloud, and technology trends

Enterprise Businesses have been facing rising DDOS attacks in terms of size, complexity and frequency which calls for a multi-layered approach

Distributed denial-of-service (DDoS) attacks, is seen as a frequently used strategy by cyber criminals in disrupting Businesses. The impact of a DDoS attack can be quite disastrous for a company’s Business. It is executed through all possible devices with an IP address to send a traffic overload to a targeted network. The targeted network’s system are unable to accommodate the web traffic that is being directed to it and goes down. As one of the prominent areas of an ever evolving landscape of cyber security threats, the need for Advanced detection and mitigation solutions for DDoS is quite critical.

Mahmoud Samy, Regional Director, ME R CIS at Arbor, the security division of NETSCOUT says, “When you talk to CIOs, CTOs etc, they are unanimous that DDOS is one aspect they cannot compromise with. That is because DDOS attack affects company’s financials, reputation, credibility of service etc. While there may still be time taken to mull over other security aspects and strategies, as far as DDOS protection is concerned, you have to be ready to thwart potential DDOS attacks from day one. Hence there cannot be any compromise. It has to be top of the list priority.”

Global DDoS attack data for the first six months of 2016 shows a continuing escalation in the both the size and frequency of attacks, according to data gathered through ATLAS, a collaborative partnership with more than 330 service provider customers who share anonymous traffic data with Arbor in order to deliver a comprehensive, aggregated view of global traffic and threats. ATLAS provides the data for the Digital Attack Map, a visualization of global attack traffic created in collaboration with Google Ideas.

In recent years, enterprise Businesses have been facing rising DDOS attacks in terms of size, complexity and frequency. With DDoS tools that are available for free downloads or purchase online, almost anyone with least technical skills can pull off an attack on a target’s web assets. However, there could in fact be a variety of reasons behind a DDoS attack and could also include diversionary tactics.

Mahmoud says, “Success could be 100% from a DDoS attack on an organization that doesn’t have the protection. Protection has to be in place before an event. Attackers can reach their objectives in no time, if there is no protection. There are also simple do it yourself DDoS attacks available on Internet which makes it is easier to launch DDoS attacks.”

He adds, “The attacks could come in different look and feel. They could be volumetric attacks, application attacks or exhausting attacks. Volumetric attack is a flood of traffic targeted to a destination whereas application attacks target a specific application to take it down. Exhausting attacks target security devices – they try and convert the devices that are meant to defend to launch attacks or be the gateway of attacks. Some attacks can be a combination of the three.”

Chris Gale, EMEA Partner Director at A10 Networks at A10 Networks opines these attacks could arise from hit and run strategies orchestrated by untrained individuals or hackers.

According to him, “Considering these attacks are typically the least organized, and pulled off by the least technical individuals, they are the easiest to prevent. Unskilled troublemakers typically will use a paid service to pull off the attacks, making it costly to sustain long-term. By optimizing your network configuration, and utilizing technology with robust load balancing capabilities, the risks posed by these attacks are greatly minimized.”

The attacks could also have origins in political protests or could be traced to even competitors looking to hurt the financials of the company. It may also be a diversionary tactic to sustain the attention of IT staff to the DDoS related mitigation while the cyber criminals execute a more serious incursion into the network.

Chris opines that the fact that a DDoS attack is being used as a smokescreen for a larger security incident is not realized until it’s too late. The best defense therefore is to ensure that all normal cybersecurity processes are continued in the wake of an attack and never assuming the worst is over. Finally, the origin of the attack may also lie in an effort at extracting ransom from Businesses that can’t afford downtime on their systems for protracted periods.

In the era of IoT devices, the threat factor is manifold. The most recent instance is the DDoS attack last month against Dyn, a New Hampshire-based company that hosts DNS zones for many companies. The DDoS attack used the Mirai botnet, which consists of thousands of compromised “Internet of Things” devices, including IP cameras and digital video recorders. The DDoS attack sent enormous volumes of traffic-most of it not DNS-to Dyn’s name servers, overwhelming them and rendering them unable to respond to legitimate queries. The result was that many of Dyn’s customers were unreachable from the Internet, including high-profile companies such as Twitter, Amazon, Netflix and Reddit.

Providing an insight into what enterprises in the Middle East can do to withstand such an attack, Cherif Sleiman, Managing Director, Middle East and Africa at Infoblox says, “Infoblox’s best practices recommend using a combination of on-premises appliances and a DNS hosting provider to support external authoritative name service. A customer following this recommendation would have withstood the attack against Dyn, as their on-premises authoritative name servers would have been accessible throughout the attack. ”

Cherif adds, “Infoblox provides the instrumentation and capabilities underneath the network intelligence where we can uncover insights across your network, security, datacenter layers and the cloud. We are trying to reduce the latency between the time it takes to discover something is amiss and the action that solves the issue.”

In the region, Telecom providers are also playing a significant role in ensuring DDoS protection and driving awareness in their role as MSSPs.

“Service providers are also helping promote the role of DDOS security and they are selling it as a managed service. They have to ensure that their major customers are protected; otherwise the problems could multiply. We have partnered with service providers including Etisalat, STC and du who use our solutions and they are in turn providing DDOS solutions as managed services to the enterprise market, including key verticals such as Financial sector, oil & gas, government sector etc, “says Arbor’s Mahmoud.

Research Team (ASERT) and reportedly, LizardStresser, an IoT botnet was used to launch attacks as large as 400Gbps targeting gaming sites worldwide, Brazilian financial institutions, ISPs and government institutions. In this case, according to ASERT, the attack packets do not appear to be from spoofed source addresses – and no UDP (User Datagram Protocol) based amplification protocols such as NTP (Network Time Protocol) or SNMP were used.

The ASERT report documented that a majority of recent large attacks leverage the Reflection amplification technique using DNS servers, NTP, Chargen and Simple Service Discovery Protocol (SSDP). DNS is currently seen as the most prevalent protocol used in 2016 and adding more cause for concern, the average size of DNS reflection amplification attacks has been growing. Further, while even a 1 Gbps DDoS attack is arguably enough to take most organizations completely off line, the average attack size in 1H 2016 had reached 986Mbps, showing a 30% increase over 2015 and is projected to be 1.15Gbps by end of 2016.

Since the range of attacks is quite varied, from high bandwidth to as low as 1 Gbps, the need is for a hybrid, or multi-layer DDoS defense. According to Darren Anstee, Arbor Networks Chief Security Technologist, high bandwidth attacks are best mitigated in the cloud, away from the intended target.  However, 80% of all attacks are still less than 1Gbps and 90% last less than one hour and therefore on-premise protection provides the rapid reaction needed and is key against “low and slow” application-layer attacks, as well as state exhaustion attacks targeting infrastructure such as firewalls and IPS.

Offering protection against volumetric flood of data, a key identifier of a DDoS attack, A10 Networks offers Threat Protect System (TPS) appliances and has recently unveiled the latest edition products.

According to Adil Baghir, Sr. Systems Engineer at A10 Networks, many of the available solutions are arguably limited in terms of DDoS mitigation performance and A10 Networks is seeking to address these shortcomings with its latest TPS. The manufacturer’s new group of TPS appliances unveiled in October, provides up to 300 Gbps of DDoS protection in a single box. The top-end device is the new Thunder 14045, which is a 3 RU (rack unit) appliance powered by four 18-core Intel Xeon processors.

Adil adds, “Many existing solutions introduce high latency into the networks and also offer very limited deployment options. We are addressing these issues with our latest launch October of the new TPS appliances which offer the fastest DDoS mitigation solution offering from 1 Gbps to 300 Gbps throughput DDoS mitigation.”

While more awareness is building up in the market about the evolving nature of DDoS threats, more companies in the region could look into having the right solutions in place. The role of the channel in driving awareness goes hand in hand with vendors who have been at the forefront of DDoS technologies.

Mahmoud adds, “The awareness in the market about DDoS is getting better compared to 4-5 years. Arbor has been educating the market regarding DDoS threats for nearly 15 years now. In the early years, no one else was talking of DDoS but that has changed in the past few years. Almost every CIO is talking about it which goes to prove that the awareness is now a lot better.”

Finally, a multi-layered approach is key to having the best chance against staving off such attacks. A no-compromise approach should be the mantra towards securing effectively against DDoS attacks.

Thunder TPS 3.2 now enables more organizations to intelligently provide an always-on application experience. New features and customer benefits include:

• Smarter DDoS attack detection and dynamic mitigation with Thunder TPS 3.2. Traffic baselines leverage multi-protocol behavioral indicators to learn peacetime network conditions, enabling precise detection of anomalies. Dynamic mitigation policies escalate suspect traffic through progressively tougher countermeasures to minimize legitimate traffic drops. DevOps can leverage event-based scripting for increased operational agility.
• Automated signaling for volumetric attack protection through Verisign’s cloud DDoS protection service. The redirection option utilizes the Verisign OpenHybrid API to provide anomaly information and can trigger a swing of customer’s traffic to Verisign’s cloud-based services when volumetric DDoS protection is needed. This hybrid solution broadens the market reach of Thunder TPS to enterprises with limited internet bandwidth.
• Integration with existing DDoS solutions for investment protection. Leveraging open networking standards, Thunder TPS mitigation integrates easily with existing DDoS detection solutions. Open networking standards support enables tight integration with many other devices, including SDN controllers and security products.
  • In addition to Thunder 3.2 and the Verisign DDoS Protection Service, organizations can further complement their DDoS protection with the recently announced:
  • aGalaxy to streamline operations. Empowering administrators to centrally manage multiple Thunder TPS deployments to enable real-time troubleshooting, incident management and reporting.
  • A10 Threat Intelligence Service to increase security efficacy. Providing a dynamic intelligence feed that prevents data theft, reduces the network load, and minimizes the attack surface.

“Devastating multi-vector DDoS attacks are on the rise and in everyday news. Organizations will inevitably become targets of these cyber-attacks, causing major disruptions to their business,” said Sanjay Kapoor, Vice President Global Marketing at A10 Networks. “With the expanded capabilities of Thunder TPS 3.2 and integration with Verisign’s OpenHybrid, organizations can enable the always-on application experience that their customers demand from them.”

“In today’s growing DDoS threat landscape, organizations must protect and ensure the availability of their critical applications. A10’s Thunder TPS appliance’s ability to signal with Verisign cloud-based DDoS Protection Service enables customers to implement an effective hybrid DDoS protection strategy,” said Ramakant Pandrangi, Vice President of Product Management for Verisign’s Security Services.

“Customers trust C4L to protect them from the crippling effects of a vast array of escalating multi-vector DDoS attacks on a daily basis,” said Gary Barter, Head of Marketing at C4L. “Thunder TPS 3.2 greatly expands our effectiveness through the surgical nature of the countermeasures, the comprehensive baselining, anomaly detection capabilities, and detailed monitoring.”

“A10 has built a loyal base of service provider and enterprise customers that value the performance, the manageability, and the advanced features of the entire product line,” said Jeff Wilson, Research Director, Cybersecurity Technology at IHS Inc. “Thunder TPS 3.2 and the Verisign partnership enable A10 to broaden market reach of its DDoS detection and mitigation solutions to customers’ lower bandwidth requirements.”