Crossing the 10 Million Mark: DDoS Attacks in 2020

 By Richard Hummel, Carol Hildebrandon January 26th, 2021

DDoS Attacks in 2020

Not all world records are cause for celebration—just look at the DDoS attack numbers from 2020. For the first time in history, we observed more than 10 million DDoS attacks in a single year, with NETSCOUT’s ATLAS Security Engineering and Response Team (ASERT) observing 10,089,687 attacks over the course of the year. That’s nearly 1.6 million more attacks than 2019’s count of 8.5 million.

Granted, DDoS attack numbers move only in one direction—up. But context is important when looking at DDoS statistics from 2020. From March until the end of the year, DDoS attackers operated amidst the COVID-19 pandemic. While most of the world saw an unprecedented global health crisis, malicious actors saw new vulnerabilities and opportunity. It is seldom that annual activity is so deeply affected by one event, but such is the case with 2020 DDoS attack activity and trends. It is no coincidence that this milestone number of global attacks comes at a time when businesses have relied so heavily on online services to survive.

The start of the pandemic lockdown ushered in a “new normal” in the way we live a......

To read the full article, click on the link below

https://www.netscout.com/blog/asert/crossing-10-million-mark-ddos-attacks-2020

A Quick Note About TCP Sequence Numbers

I’ve received a lot of feedback from my readers expressing their gratitude that my articles/videos are short and to the point. To those people who took the time to send their feedback, thank you.

One topic that I’ve been asked to cover lately is TCP sequence number analysis. There are many videos out there that are very good. I know, since I watched quite a few of them ;)

After watching 4 or 5 of these videos, I noticed that they weren’t geared towards analysts getting into this level of analysis for the first time and missed a few items that I would have added. So here you go.

In this video I briefly’ cover some of the TCP sequence tips and tricks that I use in the field. The important part is to remember that by default Wireshark will display the relative sequence number. It even displays that note in the detail (middle) pane. You can easily toggle this on and off by right clicking on the TCP sequence number (or anywhere in the TCP header), select Protocol Preferences and check/uncheck Relative Sequence numbers.

I also briefly mention that you can also use the netstat –s command from the command prompt to track lost packets by looking at the TCP Segments Retransmitted counter.

The point of the video is to provide a simple introduction so the whole process of TCP analysis becomes a bit more straightforward.

Our Curious Habits

 

As an engineer, I’m often accused by my non-engineer brethren of being overly analytical. I confess that I can’t help scrutinizing some things (well...most things) to try and figure out how they work. This can lead to satisfaction and a boost in self-assurance when things work as expected, and a compulsive drive for further analysis when they don’t. I have been blessed (cursed?) with this inclination for as long as I can remember. I have been formally trained for it in school and throughout my career. Reinforced by a lifetime of use, this habit is unlikely to ever change.

There is some comfort in knowing that I am not alone in this. There are very few, if any, STEMers who don’t share this particular habit. Of course you don’t have to be educated in a STEM field to have habits, and many of them are difficult to rationalize. The fact that curious things arouse our curiosity is yet another curiosity of humanity.

Not all of my curious habits stem from engineering. One that has always produced a tingle in my analytical feelers involves the use of my car’s GPS. For some still unknown reason, as the robo-voice commands start to come more quickly and the little blue line on the screen begins to twist and turn impossibly, I have an uncontrollable urge to turn off the radio. I can understand why Helter-Skelter might be a poor soundtrack for these moments, but the actual content doesn’t seem to matter – the radio just has to be off. Period.

During my lifetime, technology has progressed from rotary dial telephones to the little computerized communicators we carry in our pockets. I believe I have adapted well, but I still spontaneously pick up my cell phone, quickly clear off all the little App-Badges, and then set it down again. Yes, I am at the age where short-term memory begins to fade. I confess that on more than one occasion, I have walked into a room only to wonder why I went there in the first place. Lately, I get text messages saying “Hello?” before it dawns on me that I had interrupted a conversation to dispatch those little red flags. Of course turning off the flags is out of the question, because then I might miss something important.

Live as long as I have, and you will likely accumulate drawers full of imprinted T-shirts. Sporting events, concerts, vacations and any visit to a Hard Rock Café – none of these count unless commemorated with a T-shirt. Now that 2020 really is hindsight, I realize that working from home provided me with the opportunity to swap Dockers and button-down shirts for shorts and T-shirts in the “office.” Still, there were lots of T-shirts at the bottom of my drawers that never seemed to get worn. I felt guilty and yet I remained frozen in inaction.

Somehow I failed to notice as the T-shirt stacks started shrinking. With help from our son, my wife cut them up and made a beautiful quilt for my birthday. Now I am frequently reminded of every Hard Rock Café I have ever visited, along with the fact that “Real Men Marry Accountants.” Some curious habits call for an intervention.

Unsurprisingly, neuroscience is also curious about curiosity. Neuroscientist Charan Ranganath of UC Davis has used fMRI to show that curiosity helps us learn and retain more. His research team also measured an increase in dopamine (the brain chemical associated with reward and pleasure) as we begin to anticipate an answer. Curiosity begets curiosity, which feels good.

I remain curious about my curious habits (GPS, App-Badges, T-Shirts...) but I’m beginning to understand that the world is too complex for there to be answers for everything. Although many of us have careers where we are paid for answers, our ability to provide those answers is enhanced by our continuing curiosity over the answers we don’t yet have. There is a certain satisfaction in leaving open the possibility of not knowing , if only to keep the dopamine flowing.

“By replacing fear of the unknown with curiosity we open ourselves up to an infinite stream of possibility. We can let fear rule our lives or we can become childlike with curiosity, pushing our boundaries, leaping out of our comfort zones, and accepting what life puts before us.”

– Alan Watts

Author Profile - Paul W. Smith - leader, educator, technologist, writer - has a lifelong interest in the countless ways that technology changes the course of our journey through life. In addition to being a regular contributor to NetworkDataPedia, he maintains the website Technology for the Journey and occasionally writes for Blogcritics. Paul has over 40 years of experience in research and advanced development for companies ranging from small startups to industry leaders. His other passion is teaching - he is a former Adjunct Professor of Mechanical Engineering at the Colorado School of Mines. Paul holds a doctorate in Applied Mechanics from the California Institute of Technology, as well as Bachelor’s and Master’s Degrees in Mechanical Engineering from the University of California, Santa Barbara.

Try this Wireshark display filter

 Wireshark’s features can really be a catch 22. In one way they are very powerful but on another hand, many of them are difficult to find. But you do find a gem of a tip or5 trick, packet analysis gets a lot easier.

In this article I want to share a different kind of display filter that you may not be familiar with. I’m sure you have used MAC, IP address, TCP, UDP and maybe even some application layer display filters. I find that sometimes I need to display just a few packets that might not have MAC, IP, TCP or UDP port numbers in common.

As you will see in the video, one way to address this challenge is to simply Mark the packets and then apply a display filter for just marked packets. The other way is to use the following display filter syntax frame.number in {frame numbers} this will simply display any frame number you provide in the curly braces.

That’s it folks, quick and simple and have a Happy New Year