DDoS attacks double as criminals leverage home routers, Wordpress plugins
The number of megasized attacks, larger than 100 gigabits per second, also doubled, while application layer attacks were up 122 percent and infrastructure layer attacks were up 134 percent.
"It's an arms race," said Eric Kobrin, director of adversarial resilience at Akamai Technologies. "There are larger and larger botnets out there used for attacks."
The attacks are increasingly coming from home and small business routers, as well as from hacked Wordpress sites.
Wordpress currently powers about a quarter of all websites, and that market share has been increasing steadily over the past few years -- as has the size of the web itself.
The number of third-party Wordpress plugins and themes has also been growing, written by developers with various skill levels and experience.
Last quarter, Akamai analyzed 1,322 popular plugins and themes and found 49 previously unknown vulnerabilities.
Akamai has reached out to the developers but not all were willing or able to fix the problems, Kobrin said.
"We see 5,000 or 10,000 compromised Wordpress sites attacking our customers at once," he said. "And we're seeing more Wordpress sites existing out there, so you start to see the potential for growth."
In addition, he said, Wordpress sites are often hosted on rented servers in data centers, where they have access to plenty of bandwidth.
Vulnerabilities in home and small business networks are also attractive to cyber criminals, he said. And these networks are starting to see improvements in bandwidth as well.
"And as people get fiber to their homes, you'll see residences being able to push attacks that are as large as a data center server," he added.
According to Akamai's analysis, traffic from Tor exit nodes was 30 times more likely to be malicious than traffic from non-Tor IP addresses.
Tor is slow and difficult to use, so not well suited for generic DDoS attacks, but it can work for application layer attacks, which typically require lower volumes of messages to be successful.
Some companies choose to block all Tor traffic as a result.
But that's not always the best idea, said Kobrin.
"Tor is a good technology, but it can be misused," he said. "It could be that this is a person in an abusive relationship seeking help."
Tor is also used internationally by Internet users trying to evade government censorship, and by regular Internet users who are concerned about privacy.
According to Kobrin, one Akamai customer, a travel agency, reports that every piece of Tor traffic that comes to their site leads to a purchase.
Other customers, however, get very little business via Tor connections.
"It's an individual choice for each customer," he said.