While working on the annual report this year we have decided to avoid retelling the news headlines of the previous year and, though it is almost impossible to ignore memories absolutely, we want to share with you the result of a clear thought and a strategic view to the point where we all are going to arrive in the nearest time - the present.

Leaving introduction words behind, here are our key findings:

• Average DDoS attack duration dropped to 2.5 hours;
• During 2018, the capability appeared for attacks at hundreds of gigabits-per-second within a country or region, bringing us to the verge of “quantum theory of bandwidth relativity”;
• The frequency of DDoS attacks continues to grow;
• The continuing growth of HTTPS-enabled (SSL) attacks;
• PC is dead: most of the legitimate traffic today comes from smartphones, which is a challenge for DDoS actors today and would be the next challenge for DDoS mitigation companies;
• BGP finally became an attack vector, 2 years later than we expected;
• DNS manipulation has become the most damaging attack vector;
• Other new amplification vectors are possible, like memcached & CoAP;
• There are no more “safe industries” that are invulnerable to cyberattacks of any kind.

In this article we have tried to cherrypick all the most interesting parts of our report, though if you would like read the full version in English, the PDF is available.

The report explains how the outage of a single AS affects the global connectivity of the region, especially when it is the biggest ISP of a given country. Internet connectivity at the network level is driven by the interaction between autonomous systems (AS’s). As the number of alternate routes between AS’s increases, so goes the fault-resistance and stability of the internet in a given country. However, some paths become more important than others and having as many alternate routes as possible is the only viable way ensure the system is adequately robust.

The global connectivity of any AS, regardless of whether it is a minor provider or an international giant, depends on the quantity and quality of its paths to Tier-1 ISP’s. Usually, Tier-1 implies an international company offering global IP transit service over connections to other Tier-1 providers. But there is no obligation to maintain such connectivity. Only the market can motivate them to peer with other Tier-1’s to deliver the highest quality service. Is that motivation enough? We explore this question in the IPv6 section below. If an ISP loses its connection to at least one of its Tier-1 peers, it would likely become unreachable in some parts of the world.

We would like to present you, the reader, a shorter version of the annual Qrator Labs report on cyber- and infosecurity, as well as DDoS, that covers the year 2017. Special thanks to our longstanding partner — Wallarm, for supporting us with content on notable vulnerabilities and hacks.

In 2017 Qrator Labs and Wallarm noticed increasing diversification of threats from a widening variety of attack methods. The range of critical vulnerabilities on today’s web is so broad that attackers can choose from many different methods to create problems for almost any organization. A growing number of tools can operate automatically making centralized command & control unnecessary.

If 2016 could be named the year of botnets and terabit attacks, then 2017 was the year of ransomware and routing. The incidents, like Google in Japan and Level3 in the United States, Rostelecom in Russia, and many others demonstrate the persistently strong risks from human factors rooted in mismanagement and insufficient automation. A brave engineer who confidently cancels an important automated script could create the possibility of severe issues in internet service availability and accessibility.