IN THE olden days, a few years ago, a crippling denial-of-service attack against an internet site might only have needed to fill a T-1 line (1.5Mbps) or a low-speed Ethernet connection (10Mbps). This would overwhelm either the network or connected servers, or both, and render a website or e-mail server unreachable.
But times have changed. For one thing, the attackers' motives are different. Whereas they used to be just plain mischief-making they are now often criminal or political. More important, whatever the purpose, they are becoming bigger. Prolexic, a big supplier of services to counter such attacks, says that a large-scale distributed denial-of-service (DDoS) attack could approach 200Gbps and 160m packets (typically 1,500-byte chunks of data) per second. The internet's global capacity is over 100,000 Gbps, according to Telegeography, an analysis firm.
"These are monstrous numbers", says Prolexic's president Stuart Scholly. Just 18 months ago, the biggest onslaught would nudge 60Gbps. "That doesn't even get my attention anymore", he says. Neal Quinn, the firm's chief technology officer, notes that such attacks may now occur over a sustained period, not just for a few hours or days. Prolexic has a client that was buffetted continuously for nine months.
Yet his firm and others, as well as large internet companies with sufficient resources, can drown even such large attacks through a combination of filtering and the simple expedient of supplying even more bandwith. Prolexic can summon up to 1,000Gbps between its four data centres (two in the America, one in London and one in Hong Kong). That is roughly 1% of global capacity. It will scale to 3,000Gbps by the end of 2014 to keep up with attackers' capabilities.
In the past, those launching assaults would try to hide servers behind spoofed internet addresses and other techniques. Now, thousands of computers in a single company might be compromised and used as part of an assault. The attacks also now rely on an asymmetry: innocent internet servers can be enlisted to attack a host. A compromised computer can send a stream of brief, normal queries with a forged originating address to a domain name server (sed for network management) or gaming servers. The server responds with a larger response directed at the falsified address. Such a reflection attack amplifies the attacker's firepower.
Fortunately, Prolexic and other firms are able to "scrub" such attacks by allowing a client to make a slight change to how his systems are routed on the internet. In one scenario, the client updates the entry in the global routing table (which all internet backbone routers use to chart a path from one system to another). Traffic goes first to Prolexic, which filters out the gunk, and sends the remainder to the actual client network. In another, domain-name-system records are updated so that specific services, like a website, pass through a scrubber. (Some companies install hardware that does the scrubbing; makers include Radware, a brand Prolexic uses in its data centres as well.)
Enormous "volumetric" attacks are now more regularly paired with surgical ones aimed at specific weaknesses in web-server software or web applications that run on them. The DDoS might mask the more precise strike, which requires the assailant to understand a system's weakest links. This might involve many remote zombie systems simultaneously using a web form to perform a series of searches that grind servers to a halt, adding items to a shopping cart or downloading a particularly large publicly available file. Properly crafted, such attacks can be equally if not more devastating, says Mr Scholly.
But scrubbing hardware and cloud services try to block the more sophisticated attacks, too. Carl Herberger of Radware says that when a visitor to a site misspells his password, that is probably innocuous. But when he enters a series of common words in sequence, it is probably an attack. Likewise, if a site normally receives a certain mix of queries and suddenly one category rises out of proportion, this can be detected and blocked.
No silver bullet against such nefarious intrusion exists at the moment. The scale and sophisitication of attacks will continue to rise. This is good news for those who work out how to shut down attacks and maintain spare online resources that an assault tries to exhaust—and do so affordably.