NETSCOUT Arbor's Tony Teo on Why DDoS Keeps Reinventing Itself

NETSCOUT Arbor sells protection against Distributed Denial of Service (DDoS) attacks, first to service providers and now to companies well beyond them. CSA interviewed Tony Teo, its Sales Engineering Director for Asia, in 2018.

The pillar nobody talks about

Teo began with the three pillars of security: confidentiality, integrity and availability. DDoS defence, NETSCOUT Arbor's speciality, belongs to availability, which in his view gets less attention than the other two. Denial of service is also old and unglamorous, so it draws fewer headlines than ransomware.

That doesn't mean it's fading. Teo said attacks were increasing.

Unlike ransomware, they don't need anyone to write code: whoever can get hold of the resources to swamp a target's bandwidth can launch one, so any organised group with basic IT skills is capable of it. More important, in his view, is that the attacks themselves are changing.

From floods to precision strikes

The classic attack is volumetric. It takes a great deal of computing power, and sometimes a team of people, to produce enough traffic to take a service provider down. That's the problem NETSCOUT Arbor was founded to solve. Since then, Teo said, the methods have moved on to application attacks and stateful attacks.

These go after a single application, or a stateful device such as a firewall, until it fails. What worries him is how little they demand. They need very little data or traffic, so a lone attacker without deep technical knowledge can run one.

As the attacks have spread, so has the customer base. Service providers were the original market. Now, he said, companies outside telecoms buy from NETSCOUT Arbor too, because DDoS criminals go after them directly.

When the firewall becomes the target

A stateful firewall has to keep a record of every open transaction on the network, and the space it has for that record is finite. An attacker fills it until the firewall falls over. NETSCOUT Arbor's own DDoS appliance is stateless, Teo said, so it can sit in front of the firewall and take that kind of hit.

Sharing intelligence with governments

CSM-ACE is run by CyberSecurity Malaysia, the agency responsible for the country's cyber defence strategy, so CSA asked whether NETSCOUT works with governments and passes on what it knows. Teo first stressed that DDoS is a national-level issue. He had no evidence to offer, but in his personal view the sheer size of some attacks makes state sponsorship very likely. A well-coordinated attack on something like a power station, he added, could go beyond disruption and put citizens in danger.

NETSCOUT's ATLAS Security Engineering and Response Team (ASERT) gathers intelligence on DDoS threats and where they originate. Companies can pay for that work through the ATLAS Intelligence Feed. Some of it, though, goes to governments as goodwill. Teo was clear that the company can't hand over everything and give away its trade secrets. Where it judges the information important, it shares it.

Why attackers bother

Disruption is the obvious effect; the motive is the harder question. Some attackers, Teo said, simply enjoy the thrill of taking a server or provider offline. Others have a darker purpose.

• Extortion. Teo calls DDoS the original ransomware. Criminals stage a small attack to show what they're capable of, then demand payment to call off a full-scale one. That was happening long before ransomware in its current form appeared.
• Sabotage. Rivals may knock each other offline. He couldn't name a case, but pointed to online gaming, where people suspected one company of attacking a competitor. Players who can't reach one site just go and play somewhere else.
• Distraction. Hitting a stateful device like a firewall pulls the security team's eyes towards it and leaves other parts of the network exposed.

He's in no doubt the threat is here to stay and will keep changing shape. He put that down to IoT botnets, which in his words make massive volumetric attacks easier to create.