Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/30/2019
04:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Massive DDoS Attack Generates 500 Million Packets per Second

January 10 torrent involved nearly four times as many packets as last year's huge attack on GitHub, says Imperva.

Distributed denial-of-service (DDoS) attacks do not have to be bandwidth-intensive to be disruptive and hard to mitigate.

Earlier this month, Imperva mitigated an attack against one of its clients that exceeded 500 million packets per second, making it possibly the largest DDoS attack by packet volume ever recorded.

The January 10 attack was a so-called SYN flood, in which an attacker attempts to overwhelm a target computer by sending it TCP connection requests faster than the machine can process them. In this case, the attacker sent both a flood of normal SYN packets and a large SYN flood, involving packets of between 800 and 900 bytes, at the target using a highly randomized and likely spoofed set of source ports and addresses, according to Imperva.

Attackers often combine these attacks so regular SYN packets exhaust server resources like the CPU, while the larger packets saturate the network, the vendor has previously noted.

Imperva's investigation of the January attack showed it was launched using two previously known tools — one for the flood of regular SYN traffic and the other for the large SYN attack. The tools appear to have been written by two different individuals and then used in a combined fashion to "launch the most intensive DDoS attack against network infrastructure in the history of the Internet," Imperva said in a report this week.

Businesses and the media often tend to focus on the size of DDoS attacks, says Tomer Shani, a security researcher at Imperva. "In reality, size isn't the best reflection of how difficult attacks are to mitigate or how damaging they can be," he says. "Packets per second (PPS) is actually a better indicator."

An attack directed at GitHub last year that generated peak traffic of some 1.35 terabits per second is considered one of the largest bandwidth-intensive DDoS attacks ever. The attack garnered a lot of attention at the time and has often been used as an example of the enormous challenges posed by large DDoS attacks.

Mitigation Challenges
But from a mitigation standpoint, provisioning enough network bandwidth can blunt such attacks. DDoS mitigation and protection services these days tend to provision network bandwidth that is far greater than the largest observed DDoS attacks, Imperva said. This has made the sheer volume of an attack less of an issue, according to the vendor.

Dealing with attacks involving very high PPS, on the other hand, is harder because of the compute processing power required to evaluate every packet. Often the limiting factor for the network routers, switches, and mitigation appliances that service providers use to mitigate DDoS attacks is the packet rate and not the packet size, Imperva said in its report. Mitigating high PPS attacks require significantly more processing capabilities than available on most of the network appliances that are used to route or switch a packet, the vendor noted.

"Organizations provision for capacity, so that's why size is the standard metric when measuring DDoS attacks, but organizations should be more concerned about attacks with high PPS," Shani says.

In the GitHub attack, for instance, the DDoS traffic consisted mainly of large packets sent from the same port from different servers at a relatively low PPS rate of around 129.6 million. In comparison, the attack that Imperva encountered this month involved nearly four times the volume of packets being sent from random sources.

"High PPS attacks are harder to generate because they require more compute resources, in the same way they take more compute resources to mitigate," Shani says. "Organizations should be more concerned about attacks with high PPS."

Ashley Stephenson, CEO of Corero Network Security, says the impact of a DDoS attack ultimately depends on the vector and the vulnerability of the targeted organization. In the right circumstances, both high bandwidth and high PPS DDoS attacks can be equally devastating. "It is not possible to predict in advance how a multivector DDoS attack will evolve," he says. Different vectors deliver different mitigation challenges.

For instance, "high PPS attacks do not saturate links as frequently as high [bandwidth] attacks," Stephenson says. "High [bandwidth] attacks often cause more collateral damage to innocent bystanders as they are crowded out by the resulting congestion."

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
How Attackers Infiltrate the Supply Chain & What to Do About It
Shay Nahari, Head of Red-Team Services at CyberArk,  7/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13961
PUBLISHED: 2019-07-18
A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php.
CVE-2019-13962
PUBLISHED: 2019-07-18
lavc_CopyPicture in modules/codec/avcodec/video.c in VideoLAN VLC media player through 3.0.7 has a heap-based buffer over-read because it does not properly validate the width and height.
CVE-2019-10101
PUBLISHED: 2019-07-18
OECMS v4.3.R60321 and v4.3 later is affected by: Cross Site Request Forgery (CSRF). The impact is: The victim clicks on adding an administrator account. The component is: admincp.php. The attack vector is: network connectivity. The fixed version is: v4.3.
CVE-2019-10102
PUBLISHED: 2019-07-18
MailCleaner before c888fbb6aaa7c5f8400f637bcf1cbb844de46cd9 is affected by: Unauthenticated MySQL database password information disclosure. The impact is: MySQL database content disclosure (e.g. username, password). The component is: The API call in the function allowAction() in NewslettersControlle...
CVE-2019-10102
PUBLISHED: 2019-07-18
Open Information Security Foundation Suricata prior to version 4.1.3 is affected by: Denial of Service - TCP/HTTP detection bypass. The impact is: An attacker can evade a signature detection with a specialy formed sequence of network packets. The component is: detect.c (https://github.com/OISF/suric...