With half (48%) of people still failing to protect their mobile devices, and only 22% using anti-theft solutions, pick pocketers that get their hands on a smartphone could be in for more of a treat than even they hope for.Learn more >
According to the DDOS intelligence report for Q3 2016, Kaspersky Lab experts have noted an emerging trend – a growth in the number of attacks using encryption. Such attacks are highly effective due to the difficulty in identifying them amongst the overall flow of clean requests. Recently, the company encountered yet more evidence of this trend – an attack exploiting vulnerabilities in WordPress, but via an encrypted channel.
WordPress Pingback attacks have been in use since 2014. They fall under the amplification class of attacks, when the victim’s resource is attacked via third-party servers by exploiting vulnerabilities in them. In the case of WordPress Pingback, the role of the vulnerable server is played by sites created using WordPress CMS (usually blogs) with the Pingback function enabled. This function is designed to automatically send notifications to authors about any activity involving their posts. The attacker sends a specially created HTTP request to these sites with a fake return address – the address of the victim who receives all the responses.
This means it is possible to organize a powerful HTTP GET flood attack without a botnet, making such an attack relatively simple and inexpensive to organize. However, the amplified HTTP GET request has a very specific header – User Agent – which makes such malicious queries easy to detect and block in the overall traffic flow.
Although the recent attack observed by Kaspersky Lab experts used the same method, it differed from a "classical" WordPress Pingback attack in that it was conducted via HTTPS rather than HTTP. The target of the attack – a news resource – turned out to be one of Kaspersky Lab’s customers.
"The use of encryption makes it more difficult to detect an attack and protect against it because it requires traffic decryption to analyze queries to check whether it’s ‘clean’ or ‘junk’,” explains Alexander Khalimonenko, DDoS Protection Group Manager at Kaspersky Lab. “At the same time, such an attack creates a bigger load on the attacked resource’s hardware than a standard attack, because setting up an encrypted connection requires the use of ‘heavy’ mathematics. Another difficulty lies in the fact that modern encryption mechanisms do not allow third-party access to traffic content. In this regard, security solutions will have to reconsider their filtering algorithms in order to protect customers from the growing popularity of DDoS attacks with encryption."
Kaspersky DDoS Protection provides business resources with effective multi-layered protection from DDoS attacks of almost any complexity and power, including the type of the attacks described above.
Articles related to Product news
Printers, eSport and cryptocurrencies: new Kaspersky Lab DDoS Intelligence quarterly report combines them all
Kaspersky Lab has published its report on botnet-assisted DDoS attacks for the second quarter of 2018Learn more >
Protect your connected lifestyle with adaptive security: Kaspersky Lab launches new generation of beyond-AV consumer solutions
In the modern world, people are making an everyday compromise between the opportunity to constantly stay connected, or preserve their privacy.Learn more >