Akamai: DDoS attacks increased since Q1 2013, Indonesia marked as biggest cyberbully

The latest Akamai report on the state of the internet is out, and it looks like DDoS attacks have spiked since the last one. What's more, China's reign as the number one perpetrator was cut short by Indonesia, which almost doubled its first-quarter malicious traffic from 21 percent to 38 percent. China's traffic dropped from 34 percent to 33 percent, but combined, the two countries still comprise more than half of observed attack traffic. The US on the other hand, stays in third place even though attack traffic dropped from 8.3 percent to 6.9 percent.

There is a bright side to the research, though: Global internet speeds rose at a much higher rate since the last report. High broadband (any speed greater than or equal to 10Mbps) adoption rose to 14 percent worldwide quarter over quarter, while average-connection speeds rose to 3.3Mbps from the previous 3.1Mbps. If you've been keeping tabs on mobile device traffic numbers, cellular network traffic was about even between Android Webkit and Apple's Mobile Safari, coming in at just under 38 and 34 percent respectively. In terms of raw traffic across all network types though, Cupertino's ecosystem nearly doubled Google's, at 54 percent compared to 27.6 percent respectively. You're more than welcome to check out the press release and the source for full details, but we recommend putting on a pot of coffee first -- it's a heady read.

Correction: We initially reported that DDoS attacks had dropped since Q1 2013, though in fact the report shows they have increased.

Show full PR text

Akamai Releases Second Quarter 2013 'State of the Internet' Report

- Quarter is first in which half of all connections to Akamai occurred at 4 Mbps or higher
- Observed attack traffic originating from Indonesia nearly doubled quarter-over-quarter
- More than 752 million unique IP addresses connected to the Akamai Intelligent Platform

CAMBRIDGE, Mass. (October 16, 2013) – Akamai Technologies, Inc. (NASDAQ: AKAM), the leading cloud platform for helping enterprises provide secure, high-performing user experiences on any device, anywhere, today released its Second Quarter, 2013 State of the Internet Report. Based on data gathered from the Akamai Intelligent Platform™, the report provides insight into key global statistics such as network connectivity and connection speeds, attack traffic, and broadband adoption and availability, among many others.

The Second Quarter, 2013 State of the Internet Report includes insights into attacks for which a group calling itself Syrian Electronic Army has claimed responsibility, as well observations on Akamai traffic activity due to Internet disruptions in Sudan and Syria. The report also reviews mobile browser usage by network type based on data from Akamai IO.

Highlights from Akamai's Second Quarter, 2013 Sate of the Internet Report:

Global Average and Peak Connection Speeds
Global average peak connection speeds increased slightly during the second quarter of 2013, up 0.1 percent to 18.9 Mbps. Among the top 10 countries/regions that saw higher average peak connection speeds in the quarter, increases ranged from 3.1 percent in Japan (to 48.8 Mbps) to 22 percent in Taiwan (to 39.5 Mbps). Hong Kong continued to maintain the number one ranking at 65.1 Mbps, and South Korea crossed the 50 Mbps threshold, coming in second at 53.3 Mbps.

Year-over-year, global average peak connection speeds continued to demonstrate solid growth, rising 17 percent. Yearly growth rates among the top 10 countries ranged from 14 percent in South Korea to 61 percent in both Singapore and Taiwan. Around the rest of the world, all but six qualifying countries/regions saw yearly growth in average peak connection speeds, ranging from 8.5 percent in Bermuda (to 13.4 Mbps) to increases of more than 200 percent in Bahrain (284 percent to 40.3 Mbps) and Iraq (274 percent to 27.3 Mbps).

Quarter-over-quarter, the global average connection speed rose 5.2 percent to 3.3 Mbps (up from 3.1 Mbps). A total of 129 countries/regions that qualified for inclusion saw average connection speeds increase in the second quarter, ranging from 0.1 percent in Bulgaria (to 6.7 Mbps) to 93 percent in Sudan (to 2.1 Mbps).

Year-over-year, average connection speeds were up 9.2 percent, with nine of the top 10 countries/regions demonstrating positive growth of more than 10 percent. Worldwide, 127 qualifying countries/regions saw a year-over-year increase in average connection speeds, ranging from 0.6 percent in Argentina (to 2 Mbps) to 262 percent in Côte d'Ivoire (to 1.6 Mbps).

Global high broadband (>10 Mbps) adoption rose to 14 percent thanks to a 13-percent quarter-over-quarter increase. Global broadband (>4 Mbps) improved 11 percent on the quarter, and Q2 2013 marked the first time that half of all connections to Akamai from around the world took place at speeds of at least 4 Mbps.

Attack Traffic and Security
Akamai maintains a distributed set of unadvertised agents deployed across the Internet that log connection attempts, which the company classifies as attack traffic. Based on the data collected by these agents, Akamai is able to identify the top countries from which attack traffic originates, as well as the top ports targeted by these attacks. It is important to note, however, that the originating country as identified by the source IP address may not represent the nation in which an attacker resides. For example, an individual in the United States may be launching attacks from compromised systems anywhere in the world.

In the second quarter, Akamai observed attack traffic originating from 175 unique countries/regions, two fewer than was observed in the first quarter of 2013. Indonesia pushed China out of the top spot this quarter, nearly doubling its first-quarter traffic from 21 percent to 38 percent, while China moved to second at 33 percent (down from 34 percent). The United States remained in third even after dropping to 6.9 percent in the second quarter from 8.3 percent in the first quarter.

The top 10 countries/regions generated 89 percent of observed attacks, up from 82 percent in the previous quarter. Like the first quarter, Indonesia and China again originated more than half of the total observed attack traffic.

For the first time since the inaugural State of the Internet Report (first quarter of 2008), Port 445 (Microsoft-DS) was not the most targeted port for attacks, dropping to third place at 15 percent, behind Port 443 (SSL [HTTPS], 17 percent) and Port 80 (WWW [HTTP], 24 percent). The vast majority (90 percent) of attacks targeting Ports 80 and 443 originated from Indonesia, up from 80 percent last quarter. Indonesia was observed to originate the majority of attacks targeting Ports 80 and 443, up to 90 percent from last quarter's 80 percent.

In addition to observations on attack traffic, the State of the Internet Report includes insight into distributed denial of service (DDoS) attacks based on reports from Akamai customers. In the second quarter of 2013, Akamai customers reported 318 attacks, a 54 percent increase over the 208 reported in the first quarter. At 134 reported attacks, the Enterprise sector continued to be the leading target of DDoS attacks, followed by Commerce (91), Media & Entertainment (53), High Tech (23) and Public Sector (17).

Also, a group calling itself the Syrian Electronic Army (SEA) claimed responsibility for several attacks against news and media companies during the second quarter of 2013. The attacks all employed similar spear-phishing tactics in which internal email accounts were compromised and leveraged to collect credentials to gain access to targets' Twitter feeds, RSS feeds and other sensitive information.

Global Internet Penetration
More than 752 million unique IPv4 addresses from 242 unique countries/regions connected to the Akamai Intelligent Platform, a 2 percent quarter-over-quarter increase and 13 percent more than the second quarter of 2012. Since a single IP address can represent multiple individuals in some cases – such as when users access the Web through a firewall or proxy server – Akamai estimates the total number of unique Web users connecting to its platform during the quarter to be well over one billion.

The global number of unique IP addresses seen by the Akamai Intelligent Platform grew by almost 19 million during the quarter. Among the top 10 countries that connected to
Akamai in the second quarter, six demonstrated growth in unique IP counts, ranging from 0.1 percent in South Korea to 12 percent in Brazil. Across the full set of countries/regions worldwide, slightly more than 60 percent saw a quarterly increase in unique IP address counts.

Year-over-year, the number of global unique IP addresses connecting to Akamai grew by 13 percent – an increase of more than 87 million from the second quarter of 2012. All of the top 10 countries experienced growth over the year, ranging from 2.3 percent in Japan to double-digit growth in Italy (12 percent), Russia (14 percent), China (22 percent) and Brazil (44 percent). Globally, just more than 75 percent of countries had higher unique IP address counts, with triple-digit growth seen in numerous countries, including Angola (101 percent) and Sudan (316 percent).

"The Second Quarter, 2013 State of the Internet Report notes some significant milestones and trends, including the fact that half of all connections to Akamai occurred at speeds of 4 Mbps or higher, a 25 percent increase since the first quarter of 2012," said David Belson, the report's editor. "We also saw a decline in the number of countries/regions with average connection speeds of 1 Mbps or less – down to 11 from 14 in the last quarter – likely indicative of improved broadband connectivity across some of the slowest geographies. These positive trends bode well for the continued increase and adoption of broadband connectivity around the world."

Mobile Connectivity
During the second quarter of 2013, average connection speeds on surveyed mobile network operators ranged from a high of 9.7 Mbps to a low of 0.5 Mbps. Eleven operators demonstrated average connection speeds in the broadband (>4 Mbps) range, and 62 operators showed average connection speeds above 1 Mbps. Data collected by Ericsson shows that the volume of mobile data traffic grew 14 percent during the quarter and nearly doubled year-over-year.

Based on data derived from Akamai IO for the second quarter of 2013, mobile devices on cellular networks using the Android Webkit accounted for slightly less than 38 percent of requests while Apple Mobile Safari saw nearly 34 percent of requests. In measuring mobile devices across all network types, Apple Mobile Safari accounted just more than 54 percent of usage while Android Webkit was responsible for 27.6 percent.