The largest DDoS attack to date, peaking above 398M rps

Post by southernplaces7 » Wed, Oct 11, 2023, 4:46 PM UTC

xnx wrote: post #444

southernplaces7 wrote: post #441

Earlier quoted context omitted.

If this attack takes only 20,000 machines to orchestrate, how is it the "largest DDoS attack to date"? It was to my understanding that some botnets and organizations have placed far more than 20,000 machines under their control before or currently. Could you explain a bit better?

I think they're measuring "largest" by the number of requests per second.

Post by southernplaces7 » Wed, Oct 11, 2023, 6:41 PM UTC

xnx wrote: post #472

southernplaces7 wrote: post #471

Earlier quoted context omitted.

But that's part of my question. If other botnets have previously been created with many more than 20,000 controlled machines, why has nobody else before orchestrated an attack with so many requests if it only requires 20,000 machines or so to pull off?

This is exploiting a new technique. This technique wasn't known previously, or wasn't viable when HTTP/2 wasn't widespread. This technique is a ~100x multiplier on the impact any size botnet can have. A previous botnet might have needed 20,000,000 machines to achieve the same impact.

Post by masklinn » Wed, Oct 11, 2023, 7:14 PM UTC

arp242 wrote: post #170

grotorea wrote: post #39

Earlier quoted context omitted.

20000 being modest really says a lot about the state of security on the Internet.

There are 5 billion people on the internet. This is 0.0004%. Even 2 million is only 0.04%. (this assumes that 1 person = 1 device; some people share devices, most people have more than one, e.g. I have a laptop and a router, many people also have a phone, a work laptop, and whatnot – the average is probably >1, maybe even >2)

Post by Prickle » Thu, Oct 12, 2023, 12:02 AM UTC

tristan9 wrote: post #171

Prickle wrote: post #70

Earlier quoted context omitted.

I've been on the receiving end of "Your" (dynamic) "IP has been blocked." I would greatly prefer not having my semi-randomized IP blocked because someone used it maliciously a year ago.

Thing is, don’t care. The problem is that ISPs whose customers are originating the attacks from don’t give a shit. If we have to give up 1% of legitimate traffic to thwart 90% of attacks, it is a good deal. If you and other customers complain to your ISP (or switch), eventually they’ll do something about it. We can’t seriously keep on accepting that « thousands of compromised devices » is a fine reality for a « small…

Post by 89vision » Thu, Oct 12, 2023, 4:01 PM UTC

rglullis wrote: post #469

89vision wrote: post #465

Earlier quoted context omitted.

sure, It's no doubt an arms race. The prevalance of websites going down due to scaling issues feels like order of magnitude less than it was 20 years ago though. Purely anecdotal with no real data to back that up.

Because the majority of sites run on/behind: - AWS - Cloudflare - Azure - GCP - Great Firewall of China Maybe there was some truth about "the world market for maybe five computers", after all...