The Internet infrastructure company Cloudflare said that a massive denial-of-service (DDoS) – 26 million requests per second, the largest HTTPS DDoS attack detected to date.
See also: FBI seizes domains selling DDoS services
The attack that broke the record occurred last week and targeted one of Cloudflare's customers who were using the free plan.
The threat actor behind this likely used compromised servers and virtual machines, seeing as the attack originated from Cloud service providers instead of weaker Internet of Things (IoT) devices from compromised Residential Internet Service Providers.
According to Cloudflare, the attacker also used a relatively small but very powerful botnet of 5,067 devices, each capable of generating about 5,200 rps at its peak.
See also: Italy warns of DdoS attacks against country's organizations
«To compare the size of this botnet, we are monitoring another much larger but less powerful botnet with more than 730,000 devices», revealed the Cloudflare product director Omer Yoachimik.
“The latest, larger botnet was not able to generate more than one million requests per second, i.e., about 1.3 requests per second on average per device. To be clear, this botnet was, on average, 4,000 times stronger due to the use of virtual machines and servers.
This is one of the many massive volumetric attacks detected by Cloudflare in recent years, with the company recording a short-lived HTTP DDoS attack that peaked at 17.2 million requests per second (rps) in August 2021.
The company mitigated a 15.3 million rps attack in April 2022 that used about 6,000 bots to target a Cloudflare client running a crypto launchpad platform.
It is also noteworthy that the June and April attacks were volumetric attacks that used giant junk requests to exhaust the resources ( CPU and RAM ) of the targeted server and were both carried out over HTTPS .
“HTTPS DDoS attacks are more expensive in terms of computing resources due to the higher cost of establishing a secure TLS encrypted connection,” Yoachimik explained.
“Therefore, it costs more for the attacker to launch the attack and for the victim to mitigate it. We have seen very large attacks in the past over (unencrypted) HTTP, but this attack stands out because of the resources it required at its scale.”
See also: Sberbank says it faces huge waves of DDoS attacks
The botnet used in the DDoS attack with 26 million rps this month generated over 212 million HTTPS requests within 30 seconds via requests from more than 1,500 networks in 121 countries worldwide.
Microsoft revealed that in November another massive DDoS attack was mitigated, with a speed of 3.47 terabit per second (Tbps) that flooded the servers used by an Azure client from Asia with malicious packets.
The DDoS threat landscape
Looking at our recent Cloudflare DDoS Trends report, we can see that most attacks are small, e.g. cyber vandalism. However, even small attacks can seriously impact the unprotected properties of the Internet . On the other hand, large attacks are increasing in size and frequency — but remain short and fast. Attackers are gathering the power of their botnet to try to wreak havoc with a single , quick knockout — while trying to avoid detection .
DDoS attacks may be initiated by humans, but they are generated by machines. By the time humans can respond to the attack, it may be over. And even if the attack was quick, network and application failure events can extend long after the attack is complete – costing money and reputation. For this reason, it is recommended that you protect your online properties with an always-on, automated protection service that does not rely on humans to detect and mitigate attacks.
Information source: bleepingcomputer.com
