October 13th – This week, a group of technology firms publicly shared information about a DDoS campaign that compressed a month’s worth of Wikipedia traffic into a two-minute deluge. Within the campaign, attackers exploited a flaw in the fundamental technology that powers the internet…
Most expansive DDoS ever seen
The DDoS campaign described by Google, Cloudflare and Amazon AWS reached more than 398 million requests per second (RPS) – meaning that it was 8X the size of the biggest DDoS attack previously observed by Google, which hit 46 million RPS.
This latest attack relies on a novel method. It leverages the zero-day vulnerability known as “HTTP/2 Rapid Reset,” which takes advantage of the protocol that manages how devices request data from websites.
“For a sense of scale, this two-minute attack generated more requests than the total number of article views reported by Wikipedia during the entire month of September 2023,” Google said on Tuesday.
Major infrastructure providers targeted
DDoS attacks exploiting the aforementioned vulnerability have been propagating since August, and have targeted major infrastructure providers, like Google Cloud, Amazon Web Services, and Cloudflare.
Experts note that this DDoS attack is particularly efficient. Only 20,000 botnets were deployed within the campaign.
“There are botnets today that are made up of hundreds or thousands or millions of machines,” writes Cloudflare. “Given that the entire web typically sees only…1-3 billion requests per second, it’s not inconceivable that using this method could focus an entire web’s worth of requests on a small number of targets.”
DDoS and the cloud: Insights
Among the things fueling these types of threats are cloud-based virtual machines and virtual private servers. On account of new technologies and threat actor innovation, even larger DDoS attempts are anticipated by experts.
For more on this story, click here. For additional DDoS insights from CyberTalk.org, please click here. Lastly, to receive timely cyber security insights and cutting-edge analyses, please sign up for the cybertalk.org newsletter.