398M rps means a request every 2.5ns. Most likely the figure is incorrect, or at least misleading.
Well .. it's a novel minimalistic attack. A trivial attack.
Cloud Flare also got one of these, 201 RPS.
The largest DDoS attack to date, peaking above 398M rps
281–290 of 487 posts
Re: The largest DDoS attack to date, peaking above 398M rps
#282Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it w…
I've never contemplated the cost of a DDos attack, I guess there's the upfront setup costs to secure the software and hardware that will execute the attack but are you speaking more about the costs on the day of the attack? Are those costs trivial, like the marginal costs I suppose it would be?
Re: The largest DDoS attack to date, peaking above 398M rps
#283I am impressed from both parties, from a tech perspective. The attackers who exploited HTTP2, and Google that mitigated it.
How did Google mitigate it exactly? Is there a technical deep dive?
Re: The largest DDoS attack to date, peaking above 398M rps
#284Earlier quoted context omitted.
I've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these big attacks for street cred amongst the botting community. They then use their street cred to get paid by less scrupulous actors to attack their rivals. Sometimes the people paying are governments, sometimes just shady companies. For example last year there wa…
Very useful, thanks. Do you know roughly what sort of resources, in time, money, and compromised machines, it takes to do something like this? (Order of magnitude.)
approx. 20,000 machines https://news.ycombinator.com/item?id=37831355
Re: The largest DDoS attack to date, peaking above 398M rps
#285Earlier quoted context omitted.
I've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these big attacks for street cred amongst the botting community. They then use their street cred to get paid by less scrupulous actors to attack their rivals. Sometimes the people paying are governments, sometimes just shady companies. For example last year there wa…
Seems like attacking Google would be a bad target for street cred as compared to govt websites.
Surely bringing down Google is a bigger technical achievement than some random government website maintained by someone who stumbled into their job after 20 years doing mid level government organizational work.
Re: The largest DDoS attack to date, peaking above 398M rps
#286Such attacks are possible because ISPs do not want to adopt a protocol that would allow any host to send a special packet to block malicious traffic on the upstream provider or even at the source network. In this case networks like Cloudflare would become unnecessary.
The tier 1 & 2 ISPs I've worked with have a blackhole BGP community. https://www.rfc-editor.org/rfc/rfc7999.html
Re: The largest DDoS attack to date, peaking above 398M rps
#287I am impressed from both parties, from a tech perspective. The attackers who exploited HTTP2, and Google that mitigated it. How did Google mitigate it exactly? Is there a technical deep dive?
Not Google, but there is one over at Cloudflare - https://blog.cloudflare.com/technical-breakdown-http2-rapid-...
Re: The largest DDoS attack to date, peaking above 398M rps
#288Earlier quoted context omitted.
Seems like attacking Google would be a bad target for street cred as compared to govt websites.
Surely bringing down Google is a bigger technical achievement than some random government website maintained by someone who stumbled into their job after 20 years doing mid level government organizational work.
Heck, I'd imagine that making headlines and having Google benchmark your attack would bring some amazing street cred.
Re: The largest DDoS attack to date, peaking above 398M rps
#289Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it w…
PR. Attack Google or cloudflare. Wait for them to publish a blog post about the biggest attack ever seen, then tell potential customers of your botnet that you can launch a bigger attack than anyone else and point to the above blog post.
And Google and Cloudflare also get good PR because how insanely good their are at deflecting those huge attacks. It's a win-win situation here... oh wait /s
(the /s is just on the "oh wait" part, not the whole post)
Re: The largest DDoS attack to date, peaking above 398M rps
#290Earlier quoted context omitted.
I've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these big attacks for street cred amongst the botting community. They then use their street cred to get paid by less scrupulous actors to attack their rivals. Sometimes the people paying are governments, sometimes just shady companies. For example last year there wa…
Very useful, thanks. Do you know roughly what sort of resources, in time, money, and compromised machines, it takes to do something like this? (Order of magnitude.)
They compromise home internet users and/or their IOT devices mostly with scripts and malware. So the investment for the scammer is mostly in researching exploits and seeding their malware. Most of them just use exploits created by others, but the best ones with the biggest networks are actually very capable security researchers. Given different circumstances they could probably be highly paid engineers.