Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/30/2019
04:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Massive DDoS Attack Generates 500 Million Packets per Second

January 10 torrent involved nearly four times as many packets as last year's huge attack on GitHub, says Imperva.

Distributed denial-of-service (DDoS) attacks do not have to be bandwidth-intensive to be disruptive and hard to mitigate.

Earlier this month, Imperva mitigated an attack against one of its clients that exceeded 500 million packets per second, making it possibly the largest DDoS attack by packet volume ever recorded.

The January 10 attack was a so-called SYN flood, in which an attacker attempts to overwhelm a target computer by sending it TCP connection requests faster than the machine can process them. In this case, the attacker sent both a flood of normal SYN packets and a large SYN flood, involving packets of between 800 and 900 bytes, at the target using a highly randomized and likely spoofed set of source ports and addresses, according to Imperva.

Attackers often combine these attacks so regular SYN packets exhaust server resources like the CPU, while the larger packets saturate the network, the vendor has previously noted.

Imperva's investigation of the January attack showed it was launched using two previously known tools — one for the flood of regular SYN traffic and the other for the large SYN attack. The tools appear to have been written by two different individuals and then used in a combined fashion to "launch the most intensive DDoS attack against network infrastructure in the history of the Internet," Imperva said in a report this week.

Businesses and the media often tend to focus on the size of DDoS attacks, says Tomer Shani, a security researcher at Imperva. "In reality, size isn't the best reflection of how difficult attacks are to mitigate or how damaging they can be," he says. "Packets per second (PPS) is actually a better indicator."

An attack directed at GitHub last year that generated peak traffic of some 1.35 terabits per second is considered one of the largest bandwidth-intensive DDoS attacks ever. The attack garnered a lot of attention at the time and has often been used as an example of the enormous challenges posed by large DDoS attacks.

Mitigation Challenges
But from a mitigation standpoint, provisioning enough network bandwidth can blunt such attacks. DDoS mitigation and protection services these days tend to provision network bandwidth that is far greater than the largest observed DDoS attacks, Imperva said. This has made the sheer volume of an attack less of an issue, according to the vendor.

Dealing with attacks involving very high PPS, on the other hand, is harder because of the compute processing power required to evaluate every packet. Often the limiting factor for the network routers, switches, and mitigation appliances that service providers use to mitigate DDoS attacks is the packet rate and not the packet size, Imperva said in its report. Mitigating high PPS attacks require significantly more processing capabilities than available on most of the network appliances that are used to route or switch a packet, the vendor noted.

"Organizations provision for capacity, so that's why size is the standard metric when measuring DDoS attacks, but organizations should be more concerned about attacks with high PPS," Shani says.

In the GitHub attack, for instance, the DDoS traffic consisted mainly of large packets sent from the same port from different servers at a relatively low PPS rate of around 129.6 million. In comparison, the attack that Imperva encountered this month involved nearly four times the volume of packets being sent from random sources.

"High PPS attacks are harder to generate because they require more compute resources, in the same way they take more compute resources to mitigate," Shani says. "Organizations should be more concerned about attacks with high PPS."

Ashley Stephenson, CEO of Corero Network Security, says the impact of a DDoS attack ultimately depends on the vector and the vulnerability of the targeted organization. In the right circumstances, both high bandwidth and high PPS DDoS attacks can be equally devastating. "It is not possible to predict in advance how a multivector DDoS attack will evolve," he says. Different vectors deliver different mitigation challenges.

For instance, "high PPS attacks do not saturate links as frequently as high [bandwidth] attacks," Stephenson says. "High [bandwidth] attacks often cause more collateral damage to innocent bystanders as they are crowded out by the resulting congestion."

Related Content:

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17537
PUBLISHED: 2019-10-13
Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file deletion via the web/polygon/problem/deletefile?id=1&name=../ substring.
CVE-2019-17538
PUBLISHED: 2019-10-13
Jiangnan Online Judge (aka jnoj) 0.8.0 has Directory Traversal for file reading via the web/polygon/problem/viewfile?id=1&name=../ substring.
CVE-2019-17535
PUBLISHED: 2019-10-13
Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a related issue to CVE-2019-9647.
CVE-2019-17536
PUBLISHED: 2019-10-13
Gila CMS through 1.11.4 allows Unrestricted Upload of a File with a Dangerous Type via the moveAction function in core/controllers/fm.php. The attacker needs to use admin/media_upload and fm/move.
CVE-2019-17533
PUBLISHED: 2019-10-13
Mat_VarReadNextInfo4 in mat4.c in MATIO 1.5.17 omits a certain '\0' character, leading to a heap-based buffer over-read in strdup_vprintf when uninitialized memory is accessed.