Akamai releases Q3 2016 ‘State of the Internet’ security report

Akamai Technologies, a provider of content delivery network (CDN) services, has released its Third Quarter, 2016 State of the Internet / Security Report. The report, using data gathered from the Akamai Intelligent Platform, provides analysis of the current cloud security and threat landscape, including insight into two record‑setting DDoS attacks caused by the Mirai botnet.

Download the latest State of the Internet / Security Report for data, analysis, and graphics at https://content.akamai.com/pg7426-pr-soti-report.html .

“Every couple of years the industry faces what could be considered ‘harbinger attacks’, where the size and scope of a security event are radically different than what has come before. I believe the industry faced its latest ‘harbinger’ with the Mirai botnet,” explained Martin McKeay, senior security advocate and senior editor, State of the Internet/Security Report. “The Mirai botnet also made concrete the industry’s fear that Internet of Things (IoT) and other Internet connected devices could be used for both web application and DDoS attacks, illustrating the need for device manufacturers to place a greater emphasis on security.”

Highlights from Akamai’s Third Quarter, 2016 State of the Internet / Security Report include:

DDoS attacks

• The two largest DDoS attacks this quarter, both leveraging the Mirai botnet, were the biggest observed by Akamai to-date – recorded at 623 Gbps and 555 Gbps.
• Compared to Q3 2015, total DDoS attacks increased 71% in Q3 2016.
• During the third quarter, Akamai mitigated a total of 4,556 DDoS attacks, an eight percent decrease from Q2.
• There were 19 mega attacks mitigated in Q3 that peaked at more than 100 Gbps, matching the Q1 2016 highpoint.
• Q3 2016 showed that NTP reflection attacks are apparently becoming a less viable option for attackers. The average size of an attack relying solely on NTP reflection is approximately 700 Mbps, a significant drop from the June 2014 average of more than 40 Gbps.

Web application attacks

• Q3 2016 showed an 18% decrease in total web application attacks from Q3 2015.
• In Q3 2016, web application attacks sourced from the United States decreased by 67% from Q3 2015.
• Brazil, the top country of origin for all web application attacks in Q2 2016, experienced a 79% decrease in attacks this quarter. The United States (20%) and Netherlands (18%) were the countries with the most web application attacks.
• Web application attack metrics measured around major sporting events suggest malicious actors may take time off to watch their favourite teams. For example, on the day that France played Portugal in the European soccer championship, there was a 95% decrease in attacks sourcing from Portugal (20 attacks) as opposed to a day one month later (392 attacks). On the same day in France, there were 50,597 attacks as compared to 158,003 one month later – a 68% difference.

Spotlight on attack vectors

• UDP fragments and DNS reflection attacks were the two most common vectors in Q3, accounting for 44%of all vectors – an increase of 4.5% from Q2.
• Application layer attacks drove just 1.66% of all DDoS attacks, likely because of the level of technical knowledge needed to execute them. Infrastructure layer attacks are much easier to launch with point-and-click tools.

A complimentary copy of the Q3 2016 State of the Internet / Security Report is available for download at https://content.akamai.com/pg7426-pr-soti-report.html. Download individual figures, including associated captions, at http://akamai.me/2fT7Ppl.

For a detailed analysis on Mirai, please see section 2.4 of the report.