Cloudflare Mitigates Historic World Record 3.8Tbps DDoS Attack!

Internet infrastructure provider Cloudflare says it mitigated a record-breaking distributed denial-of-service (DDoS) attack that reached 3.8Tbps. This represents the largest publicly recorded volumetric DDoS attack to date.

This attack targeted critical sectors such as financial services, telecommunications, and internet providers. The attacks lasted for a month and consisted of over 100 hyper-volumetric assaults, overwhelming network infrastructures with vast amounts of "garbage" data.

Volumetric DDoS attacks, as in this case, flood the target's bandwidth or exhaust its resources, making applications, devices, or network systems unreachable to legitimate users. In this instance, many of the attacks reached up to two billion packets per second (pps) and over three Tbps, specifically affecting layers 3 and 4 of the network and transport infrastructure.

Cloudflare successfully mitigated these attacks and reported that the infected devices forming the botnet included Asus routers, MikroTik systems, DVRs, and web servers. These devices were spread across multiple countries, including Russia, the U.S., Vietnam, Brazil, and Spain, using the User Datagram Protocol (UDP) on fixed ports, which allows fast data transmission without establishing formal connections. The attack that peaked at 3.8 Tbps lasted 65 seconds before being mitigated.

Prior to this, Microsoft held the record for the largest DDoS defense, having defended against a 3.47 Tbps volumetric attack on an Azure customer in Asia.

Amplification attacks like these often leverage botnets or specific vulnerabilities to maximize the volume of data sent. A new vulnerability in Linux’s CUPS (Common UNIX Printing System) was highlighted as a potential vector for future DDoS attacks. Akamai's research revealed that over 58,000 publicly exposed systems were vulnerable to exploitation of the CUPS flaw, capable of generating high-amplification responses that could significantly impact future DDoS campaigns.

Types of DDoS Attacks

Distributed Denial of Service (DDoS) attacks can be categorized into three main types: volumetric attacks, protocol attacks, and resource layer attacks.

1. Volumetric Attack: This type of attack aims to flood the network with traffic that initially appears legitimate. Volumetric attacks are the most frequent type of DDoS attack. A common example is DNS (Domain Name Server) amplification, which leverages open DNS servers to overwhelm a target with an excessive volume of DNS response traffic.
2. Protocol Attack: Protocol attacks disrupt services by exploiting weaknesses in the layer 3 and layer 4 protocol stack. A well-known example is a SYN flood attack, where an attacker consumes all available server resources by repeatedly initiating connection requests.
3. Resource (or Application) Layer Attack: This type of attack focuses on targeting web application packets, disrupting the flow of data between hosts. Examples include HTTP protocol violations, SQL injections, cross-site scripting, and other layer 7 attacks.

Cyber-attackers may use a combination of these types to maximize damage. For instance, an attack might start as one type and evolve into or combine with others to amplify its impact on the target system.

Furthermore, each category contains a variety of attack methods, with the frequency of new cyber threats continuing to rise as attackers become more advanced.

How to Detect and Respond to a DDoS Attack

Although there isn’t a single method to detect a DDoS attack, there are a few telltale signs your network might be under assault:

• A sudden and unusual spike in web traffic, often from the same IP address or range.
• A significant slowdown in network performance or erratic behavior.
• Complete inaccessibility of your website, online store, or service.

Modern security software can assist in identifying potential threats by alerting you to unusual system changes, allowing for quick responses. It’s also vital to have a pre-defined DDoS action plan in place, detailing specific roles and response procedures. Since not all DDoS attacks are identical, it’s crucial to tailor your response to the particular attack you're facing.

How to Prevent DDoS Attacks

Prevention is the best defense. Having a well-prepared process in place before a cyberthreat emerges is critical for detecting and addressing attacks promptly.

Here are some key steps to prepare:

• Develop a comprehensive denial-of-service defense strategy to detect, prevent, and mitigate DDoS attacks.
• Regularly assess potential threats and identify any vulnerabilities in your security setup.
• Ensure all protective software and technologies are up to date and functioning properly.
• Train your team and assign clear roles in case of an attack.

By implementing the right products, processes, and services, your business will be better equipped to respond when an attack is detected.

DDoS Protection

To better protect your network from future attacks, consider the following actions:

• Conduct regular risk assessments to identify areas that need threat protection.
• Establish a dedicated DDoS response team tasked with identifying and addressing attacks.
• Implement robust detection and prevention tools across your online operations, and train employees on what to watch out for.
• Continuously evaluate the effectiveness of your defense strategy, conduct practice drills, and plan for next steps to improve.

A proactive approach to DDoS protection is essential for safeguarding your business from evolving cyber threats.

Read the complete Cloudflare report here