The sharp decline follows an FBI takedown of so-called “booter,” or DDoS-for-hire, websites in December 2018.

The average distributed denial-of-service (DDoS) attack size shrunk 85% in the fourth quarter of 2018 following an FBI takedown of “booter,” or DDoS-for-hire, websites, in December 2018, researchers report.

Late last year, United States authorities seized 15 popular domains as part of an international crackdown on booter sites. Cybercriminals can use booter websites (also known as “stresser” websites) to pay to launch DDoS attacks against specific targets and take them offline. Booter sites open the door for lesser-skilled attackers to launch devastating threats against victim websites.

About a year before the takedown, the FBI issued an advisory detailing how booter services can drive the scale and frequency of DDoS attacks. These services, advertised in Dark Web forums and marketplaces, can be used to legitimately test network resilience but also make it easy for cyberattackers to launch DDoS attacks against an existing network of infected devices.

The shutdown of prominent booter sites made a pronounced difference in DDoS attack trends for the fourth quarter of 2018, researchers report in Nexusguard’s DDoS Threat Report 2018 Q4. During the most recent quarter, the number of DDoS attacks fell nearly 11% year-over-year, and the maximum attack size decreased nearly 24%. The biggest difference was in attack size, which dropped 85%.

Booter sites are the origin for many DDoS attacks as they make it “fairly simple” for amateur hackers to take down websites, explains Donny Chong, product director at Nexusguard. While the shutdown of booter sites had a positive effect on DDoS trends year-over-year, the growing prevalence of the “bit-and-piece” technique caused attacks to grow quarter-over-quarter.

The bit-and-piece tactic avoids detection by injecting small pieces of malicious code into legitimate traffic across hundreds of IP prefixes, Chong explains. By using small bits of junk, adversaries avoid sounding the alarms that large traffic spikes would set off. Between third and fourth quarters of 2018, this method caused the number of attacks, and the maximum and average attack sizes, to increase 36%, 49%, and 3.75%, respectively, Nexusguard researchers found.

Nexusguard noticed the bit-and-piece trend emerge in the third quarter, when it was the focus of its threat report. Unlike in a typical DDoS attack, in which an actor identifies and targets a particular IP address, bit-and-piece attacks are spread across multiple IP addresses on the same prefix. Diffused traffic can cause service providers to miss large-scale DDoS attacks in progress.

SSDP Amplification Attacks Ramp Up
SSDP amplification attacks are the most popular bit-and-piece attack vector and increased by 3,122% year-over-year and 91.2% quarter-over-quarter, Nexusguard reports. This type of attack, which made up 48.3% of DDoS attacks overall, is launched over UDP via Universal Plug and Play devices (printers, webcams, routers, and servers, for example).

Source: https://www.darkreading.com/vulnerabilities—threats/ddos-attack-size-drops-85–in-q4-2018/d/d-id/1334197