Mēris botnet, climbing to the record

Yes and to mitigate your puny attack I need to block a few dozen IPs.

A botnet is probably coming from hundreds, if not thousands of IPs, sprinkled in with normal user requests and often with similar frequency.

I would like to understand the significance of each bullet point under "Specific features of Mēris botnet".

20 million requests per second from a single beefy AWS server is easy to detect and block.

20 million requests per second coming from a rotating list of hosts from generic IP addresses is a nightmare:

> However, we suppose the number to be higher – probably more than 200 000 devices, due to the rotation and absence of will to show the "full force" attacking at once.

If your site normally has 10,000 users per day and suddenly you’re flooded with 200,000 additional IP addresses hammering at your site, you have a problem.

To put it in perspective, the top post on HN most of yesterday was about someone benchmarking their personal server as being able to handle about 5 million requests per day (Granted, that’s quite slow, but it will suffice for making a point). This botnet can deliver 4X that server’s total daily capacity every second.

DDoS attacks like this are usually launched from large number of malware ridden personal computers. Since the attacks are coming from an IP addresses on a residential network they're very hard to differentiate from legitimate traffic.

What's different about this attack is that it appears to not be PCs but network devices (routers) that are being taken over and used to launch attacks.

People are much less likely to catch that this is occurring and as a result there's concerns that this botnet is going to persist as a threat for a much longer time than is typical. Additionally, network devices may have access to a greater amount of bandwidth than a PC increasing the threat.

One more thing: when the botnet makes a request (attack) against a site it's using a modern performance optimization technique of "pipelining" where instead of a GET to "/index.html" just interacting with the index.html file it's holding a connection open to also then request all the other assets from the site. In normal usage this is great as it makes a site feel more responsive and reduces network overhead. However, in the context of this botnet it also increases the number of requests that each bot can make (which is bad).

Thanks for linking to this.

Given the amount of misinformation in infosec, we should not be linking to intermediate sources for this kind of story.