But Roiter suggests there may plenty of examples that the police simply don't know about. Extortion, he says, is a crime that usually goes unreported, making it impossible to know how prevalent it is. While countries do differ in terms of the types of DDoS attacks they experience, certain industries are magnets for these types of crimes, Roiter says. He notes, for example, that Canada has a "healthy online gambling industry."
"Gambling sites are very popular targets. There's a lot of that that goes on in online gambling. And usually they'll pay the ransom. Think of it this way: somebody gives you that call before World Cup match when you know you're going to be doing hundreds of thousands, maybe a million dollars in business, and they say, 'pay us $50,000' or '£30,000' or whatever it is. You're going to pay."
Roiter says part of the reason that companies are forced to give into criminals' demands is not necessarily that they haven't taken protective measures, but that they haven't taken the right ones. They may be protected from network-based attacks and aren't ready for the newer application-level attacks.
"The networking flooding attacks, the SYN flood, the UDP attacks, the ICMP attacks, those sorts of things are becoming less prevalent, and application-layer attacks, which use far less bandwidth and are much harder to detect and mitigate, are becoming dominant."
To combat such attacks, Corero's security platform uses analysis to examine whether a protocol is behaving properly and a rate-limiting technique that assigns it either a credit or demerit point. With enough demerits, the system will perceive a threat and immediately block it off.
The company has more than 20 major Canadian clients, including financial and government institutions. Dave Millier, CEO of Toronto-based Sentry Metrics Inc., says his company was the primary reseller for Top Layer Networks Inc., a company Corero acquired in 2011 that was one of the biggest players in the DDoS market.
Millier says in general, Corero's "claim to fame" in preventing DDoS attacks is their ability to ensure business continuity in the midst of an attack. "They can sustain multi-hundred megabit attacks, while still allowing acceptable performance of the Web services that are running on the systems inside the network itself."
This is accomplished by placing the Corero boxes outside of the network and firewall to identify and block threats more quickly. "All the data still comes to the Corero box, but it's intelligent enough to actually in effect drop the connections before they ever get to the devices that are trying to be connected to."