CLDAP is Now the No.3 Reflection Amplified DDoS Attack Vector, Surpassing  SSDP and CharGen
<!--kg-card-begin: markdown--><p>Author: Xu Yang，kenshin</p>
<p>With our <a href="https://ddosmon.net/">DDoSMon</a>, we are able to perform continuous and near real-time monitoring on global DDoS attacks. For quite a long time, DNS, NTP, CharGen and SSDP  have been the most frequently abused services in DDoS reflection amplification attacks. They rank respectively 1st, 2nd, 3rd and 4th in the last 365 days.</p>
<p>Recently, we noticed that CLDAP-based reflection amplification attacks (hereinafter referred to as CLDAP attack) have surpassed SSDP and CharGEN as the third biggest reflective DDoS attack vector. The figures below display the percentage of CLDAP attacks in the last 365 and 90 days among all reflective amplification DDoS attacks:</p>
<p><img src="__GHOST_URL__/content/images/2017/11/CLDAP_share_comparation_365day_90day.png" alt="" loading="lazy"></p>
<p>(Source: <a href="https://ddosmon.net">DDoSMon</a>. The <a href="https://ddosmon.net/insight">Insight</a> web page on this site covers most of the data in this blog.)</p>
<p>CLDAP attack first appeared in the end of October last year, just a year ago. In this blog, we look at the rise of the CLDAP attack:</p>
<ul>
<li>Over the last 365 days, we have observed a total of 304,146 CLDAP reflection amplification attacks involving 215,229 unique IPs.</li>
<li>In the last three months, CLDAP attack has entered into a new stage, the number of CLDAP attacks in the last three months has reached to 168k (11.2%), slightly more than CharGen attack(164k, 11%), and much more than SSDP attack (70k, 4.4%).</li>
</ul>
<p>Our <a href="http://data.netlab.360.com/drdos-reflector/">DRDoS data feed</a> at our <a href="http://data.netlab.360.com/">OpenData page</a> maintain a list of top reflector IPs  being used in the last 30 days, security researchers can contact <a href="emailto:netlab@360.cn">netlab@360.cn</a> to apply for free feed download.</p>
<h3 id="stagesofattackevolution">Stages of Attack Evolution</h3>
<p><img src="__GHOST_URL__/content/images/2017/11/cldap_trend_last_year-2.png" alt="" loading="lazy"></p>
<p>The above figure shows last years’ weekly counts of CLDAP reflection attack.</p>
<p>We can divide CLDAP attack activity into three stages:</p>
<ul>
<li>Initial stage: 2016-10 ~ 2017-04, about 1000 attacks per week on average</li>
<li>The first climbing stage: 2017-04 ~ 2017-08, about 6000 attacks per week on average</li>
<li>The second climbing stage: 2017-08 ~ now, about 15000 attacks per week on average</li>
</ul>
<p>From the above statistics, you can see that CLDAP has become one of the workhorses in DDoS attack.</p>
<p>We also extracted all the LDAP reflector IPs that had been used in ddos attacks, did a month to month comparison, and generated the following diagram.<br>
From the diagram, you can tell that the overlap rate of CLDAP ips has been going up and getting stable at around 40%.</p>
<p><img src="__GHOST_URL__/content/images/2017/11/reflector_comparation_by_month.png" alt="" loading="lazy"></p>
<h3 id="attackvectors">Attack Vectors</h3>
<p>In all attacks involving CLDAP, over 84% are CLDAP only, with no other combined attacking vector. There are also some other combinations, which be seen as below.</p>
<p><img src="__GHOST_URL__/content/images/2017/11/attack_vector_distribution.png" alt="" loading="lazy"></p>
<h3 id="attackingduration">Attacking Duration</h3>
<p>The duration of CLDAP attack varies: the shortest attack was less than 1 minute, and the longest one lasted more than 3 days. As shown in the figure below, the attack time span at 1, 2 and 3 standard deviations (68%, 95%, 99.7%) are respectively 30 minutes, 10 hours and 24 hours.</p>
<p><img src="__GHOST_URL__/content/images/2017/11/attack_duration_distribution.png" alt="" loading="lazy"></p>
<p>The 3-days attack mentioned above occurred from 2017-09-24 15:00:00 to 2017-09-28 09:00:00. The victim IP address, 151.<em><strong>.</strong></em>.15 belongs to a CDN service provider.</p>
<p><img src="__GHOST_URL__/content/images/2017/11/a_3_days_CLDAP_attack.png" alt="" loading="lazy"></p>
<h3 id="destinationports">Destination Ports</h3>
<p>The distribution of the victim's destination port is shown in the following table:</p>
<ul>
<li>In most cases(96.5%) of CLDAP attack, the destination ports are randomized. This is consistent with other reflection amplified DDoS attacks.</li>
<li>Note port 26383 stands out, which is not a commonly used service port, we suspect a particular CLDAP attack toolkit gets reused all the time by different attackers, or maybe there is big CLDAP attack provider somewhere.</li>
</ul>
<p><img src="__GHOST_URL__/content/images/2017/11/dst_port_distribution.png" alt="" loading="lazy"></p>
<!--kg-card-end: markdown-->
Author: Xu Yang，kenshin


With our DDoSMon, we are able to perform continuous and near real-time monitoring on global DDoS attacks. For quite a long time, DNS, NTP, CharGen and SSDP have been the most frequently abused services in DDoS reflection amplification attacks. They rank respectively 1st, 2nd, 3rd and 4th in the last 365 days.


Recently, we noticed that CLDAP-based reflection amplification attacks (hereinafter referred to as CLDAP attack) have surpassed SSDP and CharGEN as the third biggest reflective DDoS attack vector. The figures below display the percentage of CLDAP attacks in the last 365 and 90 days among all reflective amplification DDoS attacks:





(Source: DDoSMon. The Insight web page on this site covers most of the data in this blog.)


CLDAP attack first appeared in the end of October last year, just a year ago. In this blog, we look at the rise of the CLDAP attack:


 * Over the last 365 days, we have observed a total of 304,146 CLDAP reflection amplification attacks involving 215,229 unique IPs.
 * In the last three months, CLDAP attack has entered into a new stage, the number of CLDAP attacks in the last three months has reached to 168k (11.2%), slightly more than CharGen attack(164k, 11%), and much more than SSDP attack (70k, 4.4%).


Our DRDoS data feed at our OpenData page maintain a list of top reflector IPs being used in the last 30 days, security researchers can contact netlab@360.cn to apply for free feed download.



Stages of Attack Evolution





The above figure shows last years’ weekly counts of CLDAP reflection attack.


We can divide CLDAP attack activity into three stages:


 * Initial stage: 2016-10 ~ 2017-04, about 1000 attacks per week on average
 * The first climbing stage: 2017-04 ~ 2017-08, about 6000 attacks per week on average
 * The second climbing stage: 2017-08 ~ now, about 15000 attacks per week on average


From the above statistics, you can see that CLDAP has become one of the workhorses in DDoS attack.


We also extracted all the LDAP reflector IPs that had been used in ddos attacks, did a month to month comparison, and generated the following diagram.

From the diagram, you can tell that the overlap rate of CLDAP ips has been going up and getting stable at around 40%.






Attack Vectors


In all attacks involving CLDAP, over 84% are CLDAP only, with no other combined attacking vector. There are also some other combinations, which be seen as below.






Attacking Duration


The duration of CLDAP attack varies: the shortest attack was less than 1 minute, and the longest one lasted more than 3 days. As shown in the figure below, the attack time span at 1, 2 and 3 standard deviations (68%, 95%, 99.7%) are respectively 30 minutes, 10 hours and 24 hours.





The 3-days attack mentioned above occurred from 2017-09-24 15:00:00 to 2017-09-28 09:00:00. The victim IP address, 151...15 belongs to a CDN service provider.






Destination Ports


The distribution of the victim's destination port is shown in the following table:


 * In most cases(96.5%) of CLDAP attack, the destination ports are randomized. This is consistent with other reflection amplified DDoS attacks.
 * Note port 26383 stands out, which is not a commonly used service port, we suspect a particular CLDAP attack toolkit gets reused all the time by different attackers, or maybe there is big CLDAP attack provider somewhere.




{"version":"0.3.1","markups":[],"atoms":[],"cards":[["markdown",{"cardName":"card-markdown","markdown":"Author: Xu Yang，kenshin\n\n\nWith our [DDoSMon](https://ddosmon.net/), we are able to perform continuous and near real-time monitoring on global DDoS attacks. For quite a long time, DNS, NTP, CharGen and SSDP  have been the most frequently abused services in DDoS reflection amplification attacks. They rank respectively 1st, 2nd, 3rd and 4th in the last 365 days.\n\nRecently, we noticed that CLDAP-based reflection amplification attacks (hereinafter referred to as CLDAP attack) have surpassed SSDP and CharGEN as the third biggest reflective DDoS attack vector. The figures below display the percentage of CLDAP attacks in the last 365 and 90 days among all reflective amplification DDoS attacks:\n\n![](__GHOST_URL__/content/images/2017/11/CLDAP_share_comparation_365day_90day.png)\n\n(Source: [DDoSMon](https://ddosmon.net). The [Insight](https://ddosmon.net/insight) web page on this site covers most of the data in this blog.)\n\nCLDAP attack first appeared in the end of October last year, just a year ago. In this blog, we look at the rise of the CLDAP attack:\n\n* Over the last 365 days, we have observed a total of 304,146 CLDAP reflection amplification attacks involving 215,229 unique IPs.\n* In the last three months, CLDAP attack has entered into a new stage, the number of CLDAP attacks in the last three months has reached to 168k (11.2%), slightly more than CharGen attack(164k, 11%), and much more than SSDP attack (70k, 4.4%).\n\n\nOur [DRDoS data feed](http://data.netlab.360.com/drdos-reflector/) at our [OpenData page](http://data.netlab.360.com/) maintain a list of top reflector IPs  being used in the last 30 days, security researchers can contact [netlab@360.cn](emailto:netlab@360.cn) to apply for free feed download.\n\n###Stages of Attack Evolution\n\n![](__GHOST_URL__/content/images/2017/11/cldap_trend_last_year-2.png)\n\nThe above figure shows last years’ weekly counts of CLDAP reflection attack.\n\nWe can divide CLDAP attack activity into three stages:\n\n\n* Initial stage: 2016-10 ~ 2017-04, about 1000 attacks per week on average\n* The first climbing stage: 2017-04 ~ 2017-08, about 6000 attacks per week on average\n* The second climbing stage: 2017-08 ~ now, about 15000 attacks per week on average\n\nFrom the above statistics, you can see that CLDAP has become one of the workhorses in DDoS attack.\n\nWe also extracted all the LDAP reflector IPs that had been used in ddos attacks, did a month to month comparison, and generated the following diagram.\nFrom the diagram, you can tell that the overlap rate of CLDAP ips has been going up and getting stable at around 40%.\n\n\n![](__GHOST_URL__/content/images/2017/11/reflector_comparation_by_month.png)\n\n\n###Attack Vectors\n \nIn all attacks involving CLDAP, over 84% are CLDAP only, with no other combined attacking vector. There are also some other combinations, which be seen as below.\n\n![](__GHOST_URL__/content/images/2017/11/attack_vector_distribution.png)\n\n###Attacking Duration\n\nThe duration of CLDAP attack varies: the shortest attack was less than 1 minute, and the longest one lasted more than 3 days. As shown in the figure below, the attack time span at 1, 2 and 3 standard deviations (68%, 95%, 99.7%) are respectively 30 minutes, 10 hours and 24 hours.\n\n![](__GHOST_URL__/content/images/2017/11/attack_duration_distribution.png)\n\nThe 3-days attack mentioned above occurred from 2017-09-24 15:00:00 to 2017-09-28 09:00:00. The victim IP address, 151.***.***.15 belongs to a CDN service provider.\n\n![](__GHOST_URL__/content/images/2017/11/a_3_days_CLDAP_attack.png)\n\n\n###Destination Ports\nThe distribution of the victim's destination port is shown in the following table:\n\n* In most cases(96.5%) of CLDAP attack, the destination ports are randomized. This is consistent with other reflection amplified DDoS attacks.\n* Note port 26383 stands out, which is not a commonly used service port, we suspect a particular CLDAP attack toolkit gets reused all the time by different attackers, or maybe there is big CLDAP attack provider somewhere.\n\n![](__GHOST_URL__/content/images/2017/11/dst_port_distribution.png)"}]],"sections":[[10,0]],"ghostVersion":"3.0"}