Hackers prove prowess with Android-based DDoS malware

Dive Brief:

Researchers from Cloudflare, Akamai, Flashpoint, Google, Dyn, RiskIQ and Team Cymru say a botnet was recently used to launch a distributed denial of service (DDoS) attack on Google's Android operating system, according to Ars Technica.
The WireX botnet consisted of approximately 300 apps available in the Google Play market that cumulatively hit targets with up to 20,000 HTTP requests per second.
Once installed, WireX launched DDoS attacks on certain websites in an attempt overwhelm servers. The botnet was able to control over 120,000 IP addresses across 100 countries at its peak, Ars Technica reports.

Dive Insight:

Last October's record-breaking 620 Gpbs Mirai botnet DDoS attack affected Twitter, Etsy, Github, Spotify, Reddit, Netflix and SoundCloud, among others. It was particularly notable because for the first time the Mirai botnet was able to harness "zombie" Internet of Things devices to work on its behalf.

Now it appears hackers have figured out a way to use app-based botnets to attack Android phones and tablets. The discovery is worrisome because Android-based phones are quite common, and an attack leveraging Android-based devices to launch DDoS attacks could have widespread effects.

Researchers believe they caught the botnet before gained significant power, but it’s yet another example of why IT security is so challenging. While hackers often spend big money and time finding new and innovative ways to bypass security systems or develop new types of attacks, DDoS attacks can cost them as little as $7 per hour.

The growing popularity of DDoS attacks is made evident by a 380% growth rate since Q1 of 2016. As they require minimal resources for hackers to cause widespread chaos, DDoS attacks are motivating some companies, like Netflix, to prepare preventative plans of actions. This month Netflix launched a controlled, self-inflicted DDoS attack to test and help prevent an entire network shutdown.

Because of the vulnerabilities found in company servers and an inability to process high volumes of requests, cybersecurity efforts need to be aimed at reverse-engineering the risk of a DDoS attack and isolating the attack while redirecting onsite customers.