Prolexic , a company that specializes in protecting organizations from denial-of-service (DDOS) attacks, has seen many cyberattacks in its decade-long history. However, an attack that hit a financial exchange platform on May 27, 2013, is the largest DDOS the company has seen in years.
Prolexic any evidence exposing the operation but did provide some interesting information about the attack.
According to the company, the DNS reflection hit 167 Gigabytes per second (Gbps). In these types of attacks, cybercriminals use the DNS Reflection Denial of Service (DRDOS) to exploit security weaknesses in the Internet DNS protocol.
“In this type of DNS reflection, an attacker sends multiple spoofed requests (queries) to multiple public DNS servers. The source IP address is spoofed to appear as the target of the attack. When a DNS server receives the spoofed request, it responds, but the response is directed to the spoofed source address,” Prolexic reports.
“The target of the attack receives responses from all DNS servers in use. This type of attack makes it very difficult to identify the malicious sources, i.e. the attackers. If the requests (which are small packets) produce larger responses, then the attack has proliferative characteristics.”
Data provided by Prolexic shows that 92% of the devices involved in the attack were open DNS resolvers.
Not long ago, CloudFlare reported that the number of open DNS resolvers had decreased, but it's clear that there are still enough to allow cybercriminals to launch these kinds of massive DRDOS attacks.
As a countermeasure, Prolexic said it distributed this attack to four of the company's cloud-based cleaning centers located in Ashburn, San Jose, London, and Hong Kong.
The company also said that DDOS attacks coming by the end of the year are very likely to exceed 200 Gbps.
