The total number and average size of distributed denial of service (DDoS) attacks against French websites soared in the week following the country’s mass rally against terrorism on 11 January, according to new figures from Arbor Networks.
Kirk Soluk, threat and intelligence response manager for Arbor’s Security Engineering & Response Team (ASERT), said the security firm had compiled the stats to verify claims by French military cyber-defense chief admiral Arnaud Coustillière that the country had seen an “unprecedented surge” in DDoS attacks.
Coustillière claimed that as many as 19,000 websites were knocked offline, adding: “This is the first time that a country has been faced with such a large wave.”
To gauge the response to the 3.7m-strong demonstrations against terrorism across France, Arbor compared the period 3-10 January with 11-18 January.
It found an increase of 26% in the number of DDoS attacks in the period after 11 January, somewhat backing up the French cyber-military leader’s comments. There were around 5,000 attacks before 11 January and over 6,300 during the week after.
The average size of attack also increased – by 35%, from 1.21Gbps to 1.64Gbps – while the largest single attack (63.02Gbps) came in the period following 11 January.
“This is yet another striking example of significant online attacks paralleling real-world geopolitical events,” wrote Soluk.
However, although many sites appear to have been defaced with pro-Islamic messages in the days following the march – by groups such as Anon Ghost and Middle East Cyber Army (MECA) – at least some of the DDoS claims were wide of the mark.
The denial of service attacks were successful mainly against smaller sites which are naturally more vulnerable to being taken offline.
However, when major French news sites such as L’Express, 20 Minutes and Le Parisien briefly went down, they all blamed shared hosting firm Oxalide, which ruled out a DDoS.