Filtering: The Biggest Cybersecurity Threat
According to surveys, the use of VPNs has tripled since the filtering of Instagram and WhatsApp in the fall of 2022. On average, each Iranian user spends about 4 hours a day using VPNs.
First Report from Communications Infrastructure Company Reveals Increased Cybersecurity Risks
The first report from the Communications Infrastructure Company on the performance of its Distributed Denial of Service (DDoS) attack mitigation system has been released. The statistics show that the national internet network has become increasingly insecure due to the ongoing restrictive policies and filtering measures.
Iran’s Internet Security and the Growing Threat of DDoS Attacks
According to the first report from the Communications Infrastructure Company on the performance of its Distributed Denial of Service (DDoS) attack mitigation system, there have been 430,000 DDoS attacks targeting 79,000 cyber destinations in the country over 21 months. The largest DDoS attack in the country represents 49.2% of the largest attack recorded globally. Network security experts believe that due to extensive filtering and widespread use of VPNs, Iran’s network has become highly polluted and vulnerable, effectively making it a hacker’s paradise. This is reflected in international reports, statistics from the E-commerce Association, and recent reports from the Communications Infrastructure Company. According to the company’s report, 65% of DDoS attacks in the country involve compromised devices.
49% Share of Iran in Largest Cyber Attack
Experts argue that Iran has become a hacker’s paradise in recent years due to extensive filtering and VPN usage, allowing hackers to conduct numerous and varied cyber attacks with ease. Over the past two years, various public and private entities have been added to the long list of cyber attack targets, ranging from the hacking of the Civil Registration Organization last year to an online accommodation booking platform in recent months. It appears that the trend of cyber attacks will continue due to ongoing filtering and increased network pollution. In response to the escalation of cyber attacks, the Communications Infrastructure Company launched the “Distributed Denial of Service (DDoS) Attack Detection and Mitigation System” in October 2022. The first performance report of this system reveals that over 79% of attacks thwarted since the system’s deployment were designed to deprive citizens of essential services. According to the report, all of these attacks were successfully repelled. Specifically, the system handled 430,322 DDoS attacks with the following results:
4,582 hours of successful mitigation against attacks on domestic messaging services
4,327 hours of successful mitigation against attacks on government service portals
2,307 hours of successful mitigation against attacks on internet business services
23,433 hours of successful mitigation against attacks on telecommunications and internet service providers’ infrastructure
5,822 hours of successful mitigation against attacks on the financial, banking, and insurance sector
4,827 hours of successful mitigation against attacks on public online service platforms
Report Highlights Surge in Cyber Attacks and Vulnerability of Internet Businesses in Iran
According to the report, over the past 21 months, there has been a significant increase in the number of cyber attacks during critical moments in the country. The largest DDoS attack in Iran accounts for 49.2% of the largest attack recorded globally. Additionally, the ratio of mitigated attacks in Iran in one day compared to the attacks mitigated by Cloudflare globally in one day is an impressive 95.99%.
Vulnerability of Internet Businesses
The report reveals that during this period, there have been 430,322 attacks on 79,478 destinations, with approximately 1,000 destinations being attacked more than 43 times. More than 6,266,880 destinations have been protected, with internet service providers and other industries accounting for the highest and lowest proportions of attacks, respectively, at 24.23% and 2%. Among every 100 attacks, 20 involved traffic of more than 100 gigabytes, 16 had a capacity of over one million packets per second, and 12 lasted more than 10 minutes. The report also analyzed the top 10 attacks based on the total number of packets mitigated. It further noted that 65% of DDoS attacks in the country were carried out via compromised devices (bot pools) and 15% had a capacity exceeding 10 gigabits per second.
Impact of Filtering on Security
The report from the Communications Infrastructure Company confirms network security experts’ concerns regarding the significant role of compromised device networks in DDoS attacks. Despite the company’s system successfully mitigating over 70% of attacks, the ongoing failed filtering policies have led to a substantial increase in cyber attacks in recent years. Saeed Sozangar, a network security expert, told reporters that the widespread filtering of the internet in the past two years and increasing restrictions have compromised most security protocols.
He believes that as long as filtering and VPN usage continue, Iran will remain an easy target for cyber attacks. Another expert also pointed out that Iran’s domestic internet network is opaque and serves as a platform for exposing personal information. Therefore, lifting filtering is necessary to gradually achieve a more secure internet network.
The third report from the E-commerce Association also indicates a significant increase in DDoS attacks over the past three years due to network vulnerabilities exacerbated by filtering. Unofficial reports suggest that DDoS attacks in April and May 2024 were dozens of times higher than similar attacks in previous years. According to the Communications Infrastructure Company, in the past three years, the capacity to counter DDoS attacks has grown from 200 s/Gb (exclusively purchased from Tata) to 1,800 s/Gb, including 800 s/Gb from foreign Scrubbing service providers and 1,000 s/Gb from domestic systems.
The E-commerce Association’s third report on Iran’s internet quality notes a substantial increase in DDoS attacks since September 2022, coinciding with extensive filtering. While the association acknowledges that managing and actively combating such a high volume of attacks requires substantial financial resources and centralized, reliable support, it also mentions that the Ministry of Communications’ measures to counter these attacks and increase mitigation capacity from 200 s/Gb to 1,800 s/Gb will minimize the impact on end-user experience.
Nevertheless, with ongoing filtering, the trend of increasing DDoS attacks is expected to continue, attributed to the widespread use of VPNs. The latest reports from the Sharif University of Technology think tank and ISPA surveys reveal that 83.6% of Iranian users use VPNs. ISPA’s survey in March 2024 shows that VPN usage has tripled since the Instagram and WhatsApp filtering in fall 2022, with each Iranian user spending an average of 4 hours per day using a VPN. International statistics also confirm the deteriorating state of Iran’s internet network.
According to real-time data from Surfshark, Iran has accounted for 0.9% of global data breaches since 2004, with over 160.7 million user accounts experiencing data breaches over the past two decades. On average, 223 out of every 100 Iranian citizens have experienced data breaches, with each email address being hacked about three times. For every 100 people, 88 Iranians have experienced email hacking. Although cyber attacks worldwide are also increasing due to expanding digital technologies, countries invest significantly in developing and strengthening their cybersecurity technologies.
In contrast, due to sanctions, Iran not only lacks the opportunity to advance these technologies but also remains more vulnerable due to the continuation of failed policies like filtering. This situation suggests that dealing with cyber attacks will be a key challenge for the Ministry of Communications in the 14th government, requiring both strengthening cybersecurity equipment and technologies and prioritizing the removal of filtering policies.
No Comment! Be the first one.