Akamai Technologies, Inc. (NASDAQ: AKAM), the global leader in content delivery network (CDN) services, today published new research from the company’s Security Intelligence Response Team (SIRT). Akamai researchers Jose Arteaga and Wilber Majia have identified a new Connection-less Lightweight Directory Access Protocol (CLDAP) reflection and amplification method. Akamai SIRT has observed this attack vector producing Distributed Denial of Service (DDoS) attacks consistently exceeding 1 Gbps, comparable to Domain Name System (DNS) reflection attacks. A full report detailing the SIRT findings is available for download at http://akamai.me/CLDAPAdvisory.
Unlike other reflection-based vectors, where compromised hosts may number in the millions, the observed CLDAP amplification factor has been able to produce significant attack bandwidth with significantly fewer hosts.
Since October 2016, Akamai has detected and mitigated a total of 50 CLDAP reflection attacks, 33 of which were single vector attacks using CLDAP reflection exclusively. A 24 Gbps attack mitigated by Akamai on January 7, 2017 is currently the largest DDoS attack using CLDAP reflection as the sole vector observed by the SIRT. The average bandwidth for CLDAP attacks has been 3 Gbps.
While gaming is typically the most targeted industry for DDoS attacks, observed CLDAP attacks have primarily targeted the software and technology industry. Other industries targeted include Internet and telecom, media and entertainment, education, retail and consumer goods, and financial services.
The largest concentration of unique CLDAP reflectors observed in attacks were located within the United States.
Like many other reflection and amplification attack vectors, CLDAP attacks would not be possible if organizations had proper ingress filtering in place. Potential hosts are discovered using Internet scans and filtering User Datagram Protocol (UDP) destination port 389.
Akamai observed a total of 7,629 unique CLDAP attack reflectors based on sources collected during actual CLDAP reflection attacks. The usable pool of CLDAP reflectors is larger than this number, however, as revealed by Internet scanning. Unless there is a legitimate need for an organization to have CLDAP available over the Internet, there should be no reason to compound the DDoS reflection problem by exposing this protocol. Once a server is identified as a viable source for a CLDAP reflection attack, Akamai adds it to a list of known reflectors to prevent subsequent abuse of this service.
“More than 50 percent of all attacks are consistently comprised of UDP-based reflection attacks,” explained Jose Arteaga, Security Intelligence Response Team, Akamai. “Based on similarities shared with UDP reflection attack scripts, CLDAP has likely been included, or will be included, into a full attack script, and integrated into the booter/stresser infrastructure. If it has yet to be included, we may not have seen the worst of these attacks.”
Akamai continues to monitor and analyze data related to this ongoing threat. To learn more, please download a complimentary copy of the research at http://akamai.me/CLDAPAdvisory.
Akamai secures and delivers digital experiences for the world’s largest companies. Akamai’s intelligent edge platform surrounds everything, from the enterprise to the cloud, so customers and their businesses can be fast, smart, and secure. Top brands globally rely on Akamai to help them realize competitive advantage through agile solutions that extend the power of their multi-cloud architectures. Akamai keeps decisions, apps and experiences closer to users than anyone — and attacks and threats far away. Akamai’s portfolio of edge security, web and mobile performance, enterprise access and video delivery solutions is supported by unmatched customer service, analytics and 24/7/365 monitoring. To learn why the world’s top brands trust Akamai, visit www.akamai.com, blogs.akamai.com, or @Akamai on Twitter. You can find our global contact information at www.akamai.com/locations.