Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/30/2019
04:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Massive DDoS Attack Generates 500 Million Packets per Second

January 10 torrent involved nearly four times as many packets as last year's huge attack on GitHub, says Imperva.

Distributed denial-of-service (DDoS) attacks do not have to be bandwidth-intensive to be disruptive and hard to mitigate.

Earlier this month, Imperva mitigated an attack against one of its clients that exceeded 500 million packets per second, making it possibly the largest DDoS attack by packet volume ever recorded.

The January 10 attack was a so-called SYN flood, in which an attacker attempts to overwhelm a target computer by sending it TCP connection requests faster than the machine can process them. In this case, the attacker sent both a flood of normal SYN packets and a large SYN flood, involving packets of between 800 and 900 bytes, at the target using a highly randomized and likely spoofed set of source ports and addresses, according to Imperva.

Attackers often combine these attacks so regular SYN packets exhaust server resources like the CPU, while the larger packets saturate the network, the vendor has previously noted.

Imperva's investigation of the January attack showed it was launched using two previously known tools — one for the flood of regular SYN traffic and the other for the large SYN attack. The tools appear to have been written by two different individuals and then used in a combined fashion to "launch the most intensive DDoS attack against network infrastructure in the history of the Internet," Imperva said in a report this week.

Businesses and the media often tend to focus on the size of DDoS attacks, says Tomer Shani, a security researcher at Imperva. "In reality, size isn't the best reflection of how difficult attacks are to mitigate or how damaging they can be," he says. "Packets per second (PPS) is actually a better indicator."

An attack directed at GitHub last year that generated peak traffic of some 1.35 terabits per second is considered one of the largest bandwidth-intensive DDoS attacks ever. The attack garnered a lot of attention at the time and has often been used as an example of the enormous challenges posed by large DDoS attacks.

Mitigation Challenges
But from a mitigation standpoint, provisioning enough network bandwidth can blunt such attacks. DDoS mitigation and protection services these days tend to provision network bandwidth that is far greater than the largest observed DDoS attacks, Imperva said. This has made the sheer volume of an attack less of an issue, according to the vendor.

Dealing with attacks involving very high PPS, on the other hand, is harder because of the compute processing power required to evaluate every packet. Often the limiting factor for the network routers, switches, and mitigation appliances that service providers use to mitigate DDoS attacks is the packet rate and not the packet size, Imperva said in its report. Mitigating high PPS attacks require significantly more processing capabilities than available on most of the network appliances that are used to route or switch a packet, the vendor noted.

"Organizations provision for capacity, so that's why size is the standard metric when measuring DDoS attacks, but organizations should be more concerned about attacks with high PPS," Shani says.

In the GitHub attack, for instance, the DDoS traffic consisted mainly of large packets sent from the same port from different servers at a relatively low PPS rate of around 129.6 million. In comparison, the attack that Imperva encountered this month involved nearly four times the volume of packets being sent from random sources.

"High PPS attacks are harder to generate because they require more compute resources, in the same way they take more compute resources to mitigate," Shani says. "Organizations should be more concerned about attacks with high PPS."

Ashley Stephenson, CEO of Corero Network Security, says the impact of a DDoS attack ultimately depends on the vector and the vulnerability of the targeted organization. In the right circumstances, both high bandwidth and high PPS DDoS attacks can be equally devastating. "It is not possible to predict in advance how a multivector DDoS attack will evolve," he says. Different vectors deliver different mitigation challenges.

For instance, "high PPS attacks do not saturate links as frequently as high [bandwidth] attacks," Stephenson says. "High [bandwidth] attacks often cause more collateral damage to innocent bystanders as they are crowded out by the resulting congestion."

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3738
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Improper Verification of Cryptographic Signature vulnerability. A malicious remote attacker could potentially exploit this vulnerability to coerce two parties into computing the same predictable shared key.
CVE-2019-3739
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy vulnerabilities during ECDSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover ECDSA keys.
CVE-2019-3740
PUBLISHED: 2019-09-18
RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy vulnerabilities during DSA key generation. A malicious remote attacker could potentially exploit those vulnerabilities to recover DSA keys.
CVE-2019-3756
PUBLISHED: 2019-09-18
RSA Archer, versions prior to 6.6 P3 (6.6.0.3), contain an information disclosure vulnerability. Information relating to the backend database gets disclosed to low-privileged RSA Archer users' UI under certain error conditions.
CVE-2019-3758
PUBLISHED: 2019-09-18
RSA Archer, versions prior to 6.6 P2 (6.6.0.2), contain an improper authentication vulnerability. The vulnerability allows sysadmins to create user accounts with insufficient credentials. Unauthenticated attackers could gain unauthorized access to the system using those accounts.