Apparently DDoS attacks are changing -- or, at least, being summoned with some new tricks.
This article by Incapsula outlines a trend they're noticing: hackers are infiltrating anti-DDoS service providers and using their huge resources to unleash a new kind of DDoS attack -- the DNS UDP flood.
The thing about UDP flooding is that it is a symmetrical DDoS attack. It relies on the hacker having a vast botnet able to generate its DNS flood without any multiplier affect. This is different to a DNS amplification, for example, during which a relatively small botnet can enjoy a power boost of anything from 300% to 1000%.
Because resources have been a significant barrier to entry, UDP flooding has mostly taken care of itself. However, now that the ironic twist has occurred and hackers are taking advantage of these massive infrastructures created to protect the Interwebs from hackattacks, it appears shit is getting real.
Moreso because of the nature of the UDP flood. Unlike a DNS amplification, which redirects DNS replies to an intended victim using a spoofed IP, the legitimacy of the DNS queries during a DNS flood cannot be ascertained without being individually processed at the server level, and this opens server CPU cores up to attack.
I'm keen to learn more about this, as it seems like the implications are quite serious -- even for well-protected networks.
