In recent times, the cybersecurity landscape has become more challenging than ever. Microsoft grappled with a series of Distributed Denial of Service (DDoS) attacks this month. These onslaughts, designed to overwhelm a network, service, or server with excessive traffic, were executed by an adversary that Microsoft has code-named Storm-1359. The sheer volume of traffic in DDoS attacks can bring down systems, leaving them unavailable to regular users and bringing operations to a standstill.
As Microsoft dug deeper into the tactics and resources of Storm-1359, they discovered an extensive range of botnets and tools at the disposal of this threat actor. Interestingly, the attacker didn’t appear to have a focus on data theft or other conventional forms of cybercrime. Instead, their objective seemed to revolve around causing widespread disruption and garnering attention.
The sophistication of Storm-1359’s assault lies in the fact that the DDoS attacks are meticulously designed to target layer 7 – the application layer of the OSI model. In contrast, most common DDoS attacks aim for the lower layers (layer 3-network and layer 4-transport). Layer 7 attacks are insidious because they mimic legitimate user behavior, making them difficult to defend against.
The multi-pronged approach employed by Storm-1359 included three notable types of layer 7 attacks:
- HTTP(S) Flood Attack: The attacker overwhelms system resources by dispatching an enormous volume of HTTP(S) requests. By forcing the server to process these requests, it aims to drain its CPU and memory resources.
- Cache Bypass: In this attack, the focus shifts to overwhelming origin servers by circumventing the Content Delivery Network (CDN) layer. The attacker dispatches a series of queries against generated URLs, which compels the front end to direct all requests to the origin rather than serving from cached contents.
- Slowloris: A notably sly attack, the Slowloris involves the client opening a connection to a web server and requesting a resource but failing to acknowledge the download or doing so at a painfully slow pace. This forces the web server to keep the connection open and the requested resource in memory for an extended period, eating away at the server’s resources.
Given the complexity of such layer 7 DDoS attacks, Microsoft has recommended adopting robust protection services like Azure Web Application Firewall (WAF). This tool can effectively shield against known bad bots and can be configured to block or limit traffic from recognized malicious IP addresses or specific geographic regions. Users can also create custom WAF rules to block automatically and rate limit HTTP or HTTPS attacks with identifiable signatures.
In conclusion, the evolving tactics of threat actors like Storm-1359 emphasize organizations’ need to stay one step ahead by employing advanced protection strategies and visiting updated with the latest cybersecurity trends. The digital world can be a battleground, but we can safeguard our digital assets effectively with vigilance and smart defensive tactics.