According to the latest Prolexic Quarterly Global DDoS Attack Report for Q2of 2014, distributed denial of service (DDoS) attack activityand attack sizes have remained elevated throughout the first halfof this year. While DDoS activity normally fluctuates, theseresults are particularly significant, as activity has insteadcontinued near Q1's record-setting levels.

Compared to this time last year, DDoS attacks have becomeshorter, but stronger. The report reveals average attack bandwidthis up 72% and peak bandwidth increased more than 240% since Q2 of2013. At the same time, attack duration dropped significantly, nowaveraging 17 hours per attack.

Attacks are getting larger and more aggressive. Malicious actorswere able to generate such large attack sizes by employingreflection and amplification techniques and by infiltratingvulnerable, but powerful, servers instead of PCs.Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS)vendors with server instances running software with knownvulnerabilities, including versions of the Linux, Apache, MySQULand Microsoft Windows server operating systems are just some of thetargets for attacks. Also targeted are vulnerable versions ofcommon web Content Management Systems (CMS), such as WordPress,Joomla, or their plugins.

Attacks involving these servers have been observed only in themost sophisticated and carefully orchestrated DDoS campaigns, thereport reveals. Their high-volume infrastructure attacks have hadsignatures that appear to be specifically crafted to avoiddetection by DDoS mitigation technology.

Even though outages are shorter than ever before, they are stillclearly bad for business. Seventeen hours of unmitigated downtimeis too long for nearly any industry to tolerate. Webvulnerabilities have become the gateway for some of the mostsophisticated DDoS attack campaigns ever launched, andorganizations and vendors including PaaS and SaaS companies cannotignore current and future threats, the report claims.

The report also reveals that while the use of server-basedbotnets is on the rise, the itsokonoproblembro (Brobot) botnet maybe poised for a strategically targeted return at any time.Brobot-based DDoS attacks warrant complex mitigation strategies,highly skilled expertise and sophisticated defense strategies.

The effectiveness of attacks, along with the availability ofvulnerable cloud-based software, means that attacks are likely tocontinue, and attacks may be monetized in the underground DDoSmarketplace, the report claims. They pose a significant danger tobusinesses, governments and other organizations that could have anentire data center taken offline for the duration of theattack.