Akamai: DDoS attacks on the rise, become more specialized

guest · Oct 16, 2020

Google says it mitigated a 2.54 Tbps DDoS attack in 2017, largest known to date
Google discloses previously unknown DDoS attack
October 16, 2020
https://www.zdnet.com/article/googl...ps-ddos-attack-in-2017-largest-known-to-date/

The Google Cloud team revealed today a previously undisclosed DDoS attack that targeted Google service back in September 2017 and which clocked at 2.54 Tbps, making it the largest DDoS attack recorded to date.
In a separate report published at the same time, the Google Threat Threat Analysis Group (TAG), the Google security team that analyzes high-end threat groups, said the attack was carried out by a state-sponsored threat actor.

TAG researchers said the attack came from China, having originated from within the network of four Chinese internet service providers (ASNs 4134, 4837, 58453, and 9394).
Damian Menscher, a Security Reliability Engineer for Google Cloud, said the 2.54 Tbps peak was "the culmination of a six-month campaign" that utilized multiple methods of attacks to hammer Google's server infrastructure.
Click to expand...

Menscher didn't reveal which services were targeted.

"The attacker used several networks to spoof 167 Mpps (millions of packets per second) to 180,000 exposed CLDAP, DNS, and SMTP servers, which would then send large responses to us," Menscher said.
"This demonstrates the volumes a well-resourced attacker can achieve: This was four times larger than the record-breaking 623 Gbps attack from the Mirai botnet a year earlier [in 2016]."
Click to expand...

Google: Exponential growth in DDoS attack volumes

The exponential growth across all metrics is apparent, often generating alarmist headlines as attack volumes grow. But we need to factor in the exponential growth of the internet itself, which provides bandwidth and compute to defenders as well. After accounting for the expected growth, the results are less concerning, though still problematic.
Click to expand...

guest · Dec 24, 2020

New DDoS attack takes inspiration from acoustic beat
A new type of attack has been spotted, which sends traffic in pulsating waves
December 23, 2020
https://www.itproportal.com/news/new-ddos-attack-takes-inspiration-from-acoustic-beat/

There is a new type of Distributed Denial of Service (DDoS) attack in town, and it’s inspired by an acoustic beat.

Spotted by web infrastructure firm Cloudflare, the attack sends traffic in pulsating waves instead of going for all out bombardment, simulating the beating of a drum. The goal of this new type of attack is likely to deceive security systems, which are armed against traditional DDoS patterns.
It lasted for two days and was globally distributed, with each node firing an equal number of packets at an equal rate.
Click to expand...

During the two-day onslaught, the company detected and mitigated more than 700 DDoS attacks targeting this single business. The attack traffic accumulated at almost 500 Terabytes, out of a total of 3.6 Petabytes of attack traffic that targeted this entity in November alone.
The attackers mostly utilized ACK floods, UDP floods, SYN floods and so-called “Christmas floods”, where all of the TCP flags are “lit”. Both ICMP and RTS floods were also deployed.
Click to expand...

Cloudflare: Beat - An Acoustics Inspired DDoS Attack

On the week of Black Friday, Cloudflare automatically detected and mitigated a unique ACK DDoS attack, which we’ve codenamed “Beat”, that targeted a Magic Transit customer. Usually, when attacks make headlines, it’s because of their size. However, in this case, it’s not the size that is unique but the method that appears to have been borrowed from the world of acoustics.
Click to expand...

guest · Jul 26, 2021

DDoS Attacks Are Back, More Aggressive Than Ever
Telia Carrier's recent research revealed alarming statistics concerning the rise in DDoS cyberattacks
July 25, 2021
https://news.softpedia.com/news/ddos-attacks-are-back-more-aggressive-than-ever-533549.shtml

The difference is significant: 1.18 Tb (Terabytes) per second, or 887 Megabits per second (Mpps) (Mega Packets Per Second). Last year alone, a whopping 57 Petabits of malicious information was cleaned, and the average size of a DDoS attack was 19 Gbps, with an average duration of 10 minutes.

Jorg Dekker, Head of Internet Services at Telia Carrier said

“The rise of carpet bombing as a popular attack vector and a dramatic increase in peak attack traffic are two important reasons why organizations need to move to automatic threat mitigation techniques”.
He added that it is increasingly common for cybercriminals to exploit the massive bandwidth available on the Internet to attack their victims with lightning speed and ferocity from multiple launch sites simultaneously.
Click to expand...

A noticeable trend has been observed in the ever-increasing coordinated attacks from numerous sources on dynamically changing hosts in a target network. This type of attack used to be observed in severe but isolated cases, but nowadays they are more persistent and protracted. Significant spring and fall blockages in the U.S. and Europe were found to be reflected in attack traffic.
Click to expand...

guest · Aug 13, 2021

Firewalls and middleboxes can be weaponized for gigantic DDoS attacks
August 13, 2021
https://therecord.media/firewalls-and-middleboxes-can-be-weaponized-for-gigantic-ddos-attacks/

In an award-winning paper today, academics said they discovered a way to abuse the TCP protocol, firewalls, and other network middleboxes to launch giant distributed denial of service (DDoS) attacks against any target on the internet.

Authored by computer scientists from the University of Maryland and the University of Colorado Boulder, the research is the first of its kind to describe a method to carry out DDoS reflective amplification attacks via the TCP protocol, previously thought to be unusable for such operations.
Making matters worse, researchers said the amplification factor for these TCP-based attacks is also far larger than UDP protocols, making TCP protocol abuse one of the most dangerous forms of carrying out a DDoS attack known to date and very likely to be abused in the future.
Click to expand...

TCP-based reflective amplified DDoS attack vector discovered
The flaw they found was in the design of middleboxes, which are equipment installed inside large organizations that inspect network traffic.
Middleboxes usually include the likes of firewalls, network address translators (NATs), load balancers, and deep packet inspection (DPI) systems.
Middleboxes provide huge DDoS amplification factors
In an interview this week, Kevin Bock, a researcher at the University of Maryland, told The Record that amplification factors varied based on middlebox device type, vendor, configurations, and network setup.
Click to expand...

Some of these countermeasures and mitigations are included in the team’s research paper, linked at the bottom of this article.

To aid in this complex process, the research team also plans to release scripts and tools that network administrators can use to test their firewalls, DPI boxes, and other middleboxes and see if their devices are contributing to this problem. These tools will be available later today via this GitHub repository.
Click to expand...

Weaponizing Middleboxes for TCP Reflected Amplification

hawki · Aug 19, 2021

"Botnet Generates One of the Largest DDoS Attacks on Record

Last month, someone attempted to launch one of the largest Distributed Denial of Service (DDoS) attacks on record to take down a financial website, according to Cloudflare...

The attack involved generating a flood of internet traffic via HTTP browser-based requests. At its peak, the bombardment reached 17.2 million requests per second...

In total, the attack bombarded the company’s servers with 330 million requests in less than one minute. However, Cloudflare says its automated systems were able to automatically detect and mitigate the flood of traffic..."

https://www.pcmag.com/news/botnet-generates-one-of-the-largest-ddos-attacks-on-record

guest · Aug 22, 2021

mood said: ↑

Firewalls and middleboxes can be weaponized for gigantic DDoS attacks
August 13, 2021
https://therecord.media/firewalls-and-middleboxes-can-be-weaponized-for-gigantic-ddos-attacks/

Weaponizing Middleboxes for TCP Reflected Amplification
Click to expand...

Web Censorship Systems Can Facilitate Massive DDoS Attacks
Systems are ripe for abuse by attackers who can abuse systems to launch DDoS attacks
August 20, 2021
https://threatpost.com/censorship-systems-ddos-attacks/168853/

Researchers are warning internet censorship systems are ripe for abuse by a new type of distributed denial of service (DDoS) attack. The potential for abuse is concerning, researchers say, because attacks would take advantage of a type of reflection and amplification, which would be “extremely detrimental to any network” if carried out.

Netscout, which detailed the attack vector, dubbed the type of DDoS attack a Middlebox HTTP Reflection/Amplification (MBHTTP) misconfiguration vulnerability. They say attacks can produce DDoS volumes as high as a 700,000 to 1 amplification factor.
An HTTP-based DDoS attack sends junk HTTP requests to a target’s server tying up resources and locking out users from using a particular site or service.
Click to expand...

Tens of Millions of Devices Exposed
Netscout credits a joint team of researchers from the University of Maryland and the University of Colorado Boulder for identifying the widespread configuration vulnerability. Netscout estimates that 200 million IP addresses can potentially be abused to launch attacks of this kind.

“Tens of millions of these devices are exposed and vulnerable to abuse from adversaries and approximately 18 million of these provide at least a 2:1 amplification factor, resulting in one of the most prolific types of reflectors/amplifiers available to adversaries,” wrote Roland Dobbins and Steinthor Bjarnason in a technical analysis posted Friday.
At the heart of the vulnerability is a common misconfiguration of censorship systems that responds to HTML block notification pages from Uniform Resource Identifiers (URI) in a specific way.
Click to expand...

guest · Oct 12, 2021

Microsoft: Azure customer hit by record DDoS attack in August
October 12, 2021
https://www.bleepingcomputer.com/ne...customer-hit-by-record-ddos-attack-in-august/

Microsoft has mitigated a record 2.4 Tbps (terabytes per second) Distributed Denial-of-Service (DDoS) attack targeting a European Azure customer during the last week of August.

"This is 140 percent higher than 2020's 1 Tbps attack and higher than any network volumetric event previously detected on Azure," said Amir Dahan, a Senior Program Manager for Azure Networking, also describing it as a User Datagram Protocol (UDP) reflection attack.
The huge DDoS attack was launched using roughly 70,000 bots, mainly across the Asia-Pacific region (e.g., Malaysia, Vietnam, Taiwan, Japan, and China) and from the United States.

Dahan added that three attack peaks stood out, with the first reaching the maximum throughput at 2.4 Tbps and the subsequent going up to 0.55 Tbps and 1.7 Tbps.
Click to expand...

DDoS attacks are ramping up
Distributed Denial-of-Service (DDoS) attacks ramping up significantly in both complexity and volume matches the surge in internet activity after the onset of the current COVID-19 pandemic.

In early August, Alethea Toh, a Program Manager for Azure Networking, said that Microsoft recorded a sharp increase in daily DDoS attacks in the first six months of 2021, with a rise of 25% compared to Q4 2020.
The largest attack bandwidth that hit Azure's infrastructure during the first six months of 2021 was 625 Gbps, almost half of a 1 Tbps DDoS attack mitigated in Q3 2020.
Click to expand...

guest · Oct 25, 2021

Large DDoS attack shuts down KT's nationwide network
October 25, 2021
https://www.zdnet.com/article/large-ddos-attack-shuts-down-south-korean-telcos-nationwide-network/

South Korea telco KT said on Monday that the temporary nationwide shutdown of its network earlier today was caused by a large-scale distributed denial-of-service (DDoS) attack.

Customers who use the telco's network were unable to access the internet for around 40 minutes at around 11am on Monday.
Users were unable to use credit cards, trade stocks, or access online apps during that time period. Some large commercial websites were also shut down during the outage.
Click to expand...

A KT spokesperson said the telco's network was shut down due to a large-scale DDoS attack. They said that, during the outage, the company's crisis management team was working to quickly restore the network back to normal.

Despite not being victims of the DDoS attack, users of SK Telecom and LG Uplus' services voiced complaints on social media about these telcos having network failures. Spokespeople for these telcos said the network failures were due to a sudden surge of traffic from KT users shifting onto their services due to KT's internet outage.
Click to expand...

guest · Nov 15, 2021

Cloudflare blocked a massive 2 Tbps DDoS attack
November 15, 2021
https://techcrunch.com/2021/11/15/cloudflare-terabits-ddos-attack/

Cloudflare says it has blocked a distributed denial-of-service (DDoS) attack that peaked at just under 2 Tbps, making it one of the largest ever recorded.

The internet company said in a blog post that the attack was launched from approximately 15,000 bots running a variant of the original Mirai code on exploited Internet of Things (IoT) devices and unpatched GitLab instances.
Click to expand...

The DDoS attack comes just two weeks after Rapid7 warned of a GitLab vulnerability — rated a full 10.0 on the CVSS severity scale — that could be exploited to allow an attacker to remotely run code, like botnet malware, on an affected server.

The company wasn’t wrong; Cloudflare said it blocked the massive DDoS attack just one week later.
Click to expand...

Cloudflare says the attack, which lasted less than a minute, was the largest it had witnessed to date. It comes just a month after Microsoft said it mitigated a “record-breaking” 2.4 Tbps DDoS attack targeting one of its Azure customers in Europe.

While Cloudflare mitigated the attack in seconds, it warns that it witnessed multiple terabit-strong DDoS attacks last month, adding that this is unlikely a trend that’s going to slow down any time soon.
Click to expand...

Cloudflare: Cloudflare blocks an almost 2 Tbps multi-vector DDoS attack

Earlier this week, Cloudflare automatically detected and mitigated a DDoS attack that peaked just below 2 Tbps — the largest we’ve seen to date. This was a multi-vector attack combining DNS amplification attacks and UDP floods. The entire attack lasted just one minute. The attack was launched from approximately 15,000 bots running a variant of the original Mirai code on IoT devices and unpatched GitLab instances.
Click to expand...

guest · Jul 17, 2022

Mantis botnet behind the record-breaking DDoS attack in June
July 14, 2022

The record-breaking distributed denial-of-service (DDoS) attack that Cloudflare mitigated last month originated from a new botnet called Mantis, which is currently described as "the most powerful botnet to date."

The attack peaked at 26 million requests per second that came from 5,067 devices. The previous record was held by Mēris botnet, which launched an attack that spiked at 21.8 million requests per second.
Click to expand...

Not your ordinary botnet
Cloudflare explains in a report today that its analysts named the botnet Mantis [...]
Mantis targets focuses on servers and virtual machines, which come with significantly more resources.

Generating many HTTPS requests is a resource-demanding process, so the more powerful the devices that constitute the botnet swarm, the more potent the DDoS attacks they can launch.
Click to expand...

Cloudflare: Mantis - the most powerful botnet to date

In June 2022, we reported on the largest HTTPS DDoS attack that we’ve ever mitigated — a 26 million request per second attack - the largest attack on record. Our systems automatically detected and mitigated this attack and many more. Since then, we have been tracking this botnet, which we’ve called “Mantis”, and the attacks it has launched against almost a thousand Cloudflare customers.

When we take a look at Mantis’ targets we can see that the top attacked industry was the Internet & Telecommunications industry with 36% of attack share. In second place, the News, Media & Publishing industry, followed by Gaming and Finance.
Click to expand...

guest · Jul 28, 2022

Akamai blocked largest DDoS in Europe against one of its customers
July 28, 2022

The largest distributed denial-of-service (DDoS) attack that Europe has ever seen occurred earlier this month and hit an organization in Eastern Europe.

The target, a customer of cybersecurity and cloud service company Akamai, has been under constant assault, facing dozens of DDoS rounds over the past 30 days.
In a report this week, Akamai notes that the record-breaking attack occurred on July 21 and in 14 hours it peaked at 853.7 Gbps (gigabits per second) and 659.6 Mpps (million packets per second).
Click to expand...

UDP (user datagram protocol) flood was the most popular vector and also the one observed in both record spikes.

However, other methods were used, including UDP fragmentation, ICMP flood, RESET flood, SYN requests flood, TCP anomaly, TCP fragment, PSH ACK flood, FIN push flood, and PUSH flood.
Click to expand...

Akamai: Largest European DDoS Attack on Record

The risk of distributed denial-of-service attacks (DDoS) has never been greater. Over the past several years, organizations have encountered a deluge of DDoS extortion, novel threats, state-sponsored hacktivism, and unprecedented innovation in the threat landscape.

On Thursday, July 21, 2022, Akamai detected and mitigated the largest DDoS attack ever launched against a European customer on the Prolexic platform, with globally distributed attack traffic peaking at 853.7 Gbps and 659.6 Mpps over 14 hours. The attack, which targeted a swath of customer IP addresses, formed the largest global horizontal attack ever mitigated on the Prolexic platform.
Click to expand...

guest · Aug 18, 2022

Imperva: DDoS Threat Landscape Report Q2 2022
August 2022

Today’s DDoS attacks are reaching new heights in terms of rate, frequency, and complexity. During the second quarter of 2022, Imperva detected and mitigated record-breaking DDoS attacks that were able to maintain extremely high rates over a period of several hours as opposed to only minutes.

Using HTTP pipelining and multiplexing, cybercriminals are changing the game with more sophisticated attacks that regularly break records and maintain high rates for a longer duration. This new trend underscores the need for a mitigation solution that stops DDoS attacks within seconds.
Click to expand...

Here are a few highlights from this quarter’s report:

The number of major DDoS attacks (over 500 Gbps) rose by 287%

Imperva detected a 10M Rps DDoS attack that used only 12K IPs and mitigated a record-breaking 25.3 billion requests measuring 3.9M Rps in a single attack

Repeat attacks are up this quarter, with 91% of network-layer DDoS attacks being targeted again within 24 hours

Hacktivists are leveraging DDoS attacks to disrupt government websites in Ukraine, Russia, and Israel

Click to expand...

(PDF): https://www.imperva.com/resources/reports/DDoS-Threat-Landscape-Report-Q2-2022.pdf

Today’s DDoS attacks are reaching new records in rates, frequency, and complexity
Also in Q2, the number of application-layer attacks increased overall compared to Q2 2021, and while network-layer attacks decreased compared to Q1, the number
of major attacks (over 500 Gbps) rose by 287%, suggesting that attackers are focusing their efforts on stronger attacks than ever before.
DDoS attacks are also being leveraged by hacktivists to disrupt government websites and operations.

Finally, repeat attacks were up 5% compared to Q1 in the application layer, and in the network layer, 91% of DDoS targets were attacked again within just 24 hours.
Click to expand...

HIGHLIGHTS
Imperva mitigated a record-breaking attack of 25.3 billion requests
Imperva detected a 10 M rps DDoS attack
60% of all application-layer DDoS attacks lasted 15+ minutes, and 21% of all network-layer attacks lasted 1+ hours
55% of sites hit by layer 7 DDoS attacks in Q2 were attacked again
91% of network-layer DDoS targets were attacked again within 24 hours
25% of gambling sites were attacked in the final month of Q2
Click to expand...

guest · Aug 18, 2022

Google blocked the largest Layer 7 DDoS reported to date
August 18, 2022

Google announced to have blocked the largest ever HTTPs DDoS attack that hit one of its Cloud Armor customers. The IT giant revealed that the attack reached 46 million requests per second (RPS).

The attack took place on June 1st, at 09:45, it started with more than 10,000 requests per second (rps) and targeted a customer’s HTTP/S Load Balancer. Eight minutes later, the attack grew to 100,000 requests per second, and two minutes later reached 46 million RPS. The DDoS attack lasted 69 minutes.
Click to expand...

The company pointed out that the volume of requests per second is at least 76% more than the previous record, which was blocked by Cloudflare in June and that reached 26 million RPS.

“This is the largest Layer 7 DDoS reported to date—at least 76% larger than the previously reported record. To give a sense of the scale of the attack, that is like receiving all the daily requests to Wikipedia (one of the top 10 trafficked websites in the world) in just 10 seconds.” reported Google.
The experts reported that the attack originated from 5,256 source IPs from 132 countries, the top 4 countries contributed approximately 31% of the total attack traffic.
Click to expand...

Google: How Google Cloud blocked the largest Layer 7 DDoS attack at 46 million rps

Over the past few years, Google has observed that distributed denial-of-service (DDoS) attacks are increasing in frequency and growing in size exponentially. Today’s internet-facing workloads are at constant risk of attack with impacts ranging from degraded performance and user experience for legitimate users, to increased operating and hosting costs, to full unavailability of mission critical workloads.

The attack was stopped at the edge of Google’s network, with the malicious requests blocked upstream from the customer’s application.
Click to expand...

guest · Sep 9, 2022

Neustar Security Services enhances its DDoS attack mitigation scrubbing capacity to 15 Tbps
September 8, 2022

Neustar Security Services has expanded its distributed-denial-of-service (DDoS) attack mitigation scrubbing capacity to more than 15 Terabits per second (Tbps) across its worldwide network.

Neustar Security Services is committed to maintaining the dedicated DDoS and application security network. The company uses multiple tier 1 providers, along with other providers assisting with higher-performing localized presence, to ingest inbound clean (legitimate) and dirty (attack) traffic and then deploys additional partners to route the clean traffic back to customers using a variety of connections, including virtual connections, physical direct connections, and tunnels.
Click to expand...

This latest investment to increase global capacity and resilience of its network parallels an expansion into the Middle East with the October 1 opening of a new data center — the company’s 15th global node — in Dubai, which will provide a local security presence and help ensure data sovereignty and low-latency performance for customers across the region.

“As the size, volume, velocity and complexity of DDoS attacks continue to increase, these infrastructure investments further reinforce our ability to mitigate multiple large-scale attacks simultaneously,” said James Willett, Senior Vice President, Operations, at Neustar Security Services.
Click to expand...

hawki · Sep 16, 2022

"DDoS Attack Against Eastern Europe Target Sets New Record

The target has been under relentless DDoS attack, which ultimately set a new packets-per-second record for Europe.

Researchers at Akamai are reporting a distributed denial-of-service (DDoS) attack in Eastern Europe, which set records by peaking at 704.8 Mpps as the cyberattackers tried to cripple the organization's business operations.

The attackers began by targeting the victim's primary data center, before expanding unexpectedly and hitting six different global locations, from Europe to North America..."

https://www.darkreading.com/attacks-breaches/ddos-attack-eastern-europe-target-sets-new-record

guest · Jan 23, 2023

Russia’s largest ISP says 2022 broke all DDoS attack records
By Bill Toulas @billtoulas - January 23, 2023

Russia's largest internet service provider Rostelecom says 2022 was a record year for Distributed denial of service attacks (DDoS) targeting organizations in the country.
Click to expand...

In a report published today, Rostelecom says its experts recorded 21.5 million critical web attacks aimed at roughly 600 Russian organizations from various industries, including telecom, retail, financial, and the public sector.

The most powerful DDoS attack recorded by Rostelecom was 760 GB/sec, almost twice as big as the most potent attack of the previous year, while the longest DDoS lasted nearly three months.
Click to expand...

Overloading Russia
The most attacked region in 2022 was Moscow, where the largest number of Russia's top companies are located. Rostelecom says it detected over 500,000 DDoS attempts targeting the city's entities.

March marked the beginning of the attacks, while May 2022 was the culmination point of the DDoS activities. Rostelecom says the origin of these attacks based on the IP addresses was the United States, while the targets were in the banking sector.
The spike in the attacks coincides with when Sberbank, one of Russia's largest banks, reported it suffered the most significant DDoS attack it had ever seen, measured at 450 GB/sec.
Click to expand...

Log in or Sign up

Akamai: DDoS attacks on the rise, become more specialized

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

Log in or Sign up

Akamai: DDoS attacks on the rise, become more specialized

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

Useful Searches