10 ms·
AWS said it mitigated a 2.3 Tbps DDoS attack
- McTossOut 6y agoTwist ending: it was made possible by <different large tech firm>'s neglect. Edit: syntax
- goalieca 6y ago1 Trillion = 1 million x 1 million. The scale of distribution must be astounding. How much traffic is being generated by a single endpoint in one of these?
- pamperson 6y agomany eu countries have gigabit per second connections, so thats like 2300 infected hosts at least. not many at an internet scale.
- kyrra 6y agoBut any given provider won't have a 2 Tbps uplink out of their own network. It would likely have to be highly distributed across many providers. ISP's don't build their networks to support all customers running at max at the same time, as most consumers will only push that 1Gbps limit for short bursts.
- sudosysgen 6y agoSure. You can spread your attack over a few countries and as a result a good 20 ISPs. I assure you if your ISP offers cheap gigabit they have a 100Gbps uplink.
- user5994461 6y agoI don't see why they would not have Tbps uplink. ISP infrastructure is symmetric fiber. A single fiber can do 100 Gbps without troubles. And when you have to bulldozer the road to lay the fiber, you don't put a single fiber but a pack of a hundred. There is no crosstalk between fibers unlike with copper, so one has interest to put as many as possible.
- t0mas88 6y agoMany providers in EU countries offer 1gbps fiber as an option, but the most sold option is more like 200-250mbit because the price is lower. And many of those are cable based which means only 25 or 50mbit uplink, not symmetrical like fiber. So that would require 100,000 endpoints participating. But this was a reflection attack, so most of the bandwidth was coming from poorly secured servers. In datacenters those would most likely have 1 Gbps uplink speeds.
- sudosysgen 6y ago... Or only 2300 high value endpoints. You can select your endpoints, you know. Also, even cable is capable of Gigabit speeds. I briefly had 1.2Gbps via cable, downgraded to 400Mbps as it became cheaper.
- zucker42 6y agoI feel like you didn't read the comment you replied to carefully. Did you have GB upload speeds with cable too?
- sudosysgen 6y agoNot gigabit upload, but I got close at 700Mbps, and some cable providers offer gigabit upload speeds in some regions, cogeco for example offers gigabit symmetrical cable in Trois-Rivières.
- user5994461 6y agoFrance is widely offering 1 Gbps symmetric fiber in major cities. The 3 major ISP offer the same unique package for 35e a month with internet and phone and TV, not negotiable. That's gigabit fiber if your home is in a area covered by fiber.
- tzs 6y agoDo the ISPs have enough outgoing bandwidth to the internet for all their 1 Gbps symmetric fiber customers to maintain a 1 Gbps sustained upload simultaneously?
- jaywalk 6y agoThis attack specifically involved servers.
- deleted 6y ago[deleted]
- an_opabinia 6y agoBut who are the attackers, and why? What is the motivation / objective? Is there an economically positive criminal activity that involves DDoSing an AWS-hosted UDP service (probably video calls... probably like Zoom)?
- tonydiv 6y agoI'd assume something sinister... There has to be a reason :)
- api 6y agoI would suspect extortion. Pay us or we DDOS you offline.
- antpls 6y agoI believe that sort of attack can't be achieved repeatedly. These attacks leave traces and clues behind them, and investigators are able to better pinpoint and protect for the next one. I heard they also can't be sustained for a long time. I believe they are more like an attempt to discover limits in the network or some targeted systems. Some systems are also vulnerable while they reboot, so attackers only need a one-time reboot.
- Red_Leaves_Flyy 6y agoNot an authority or expert in any fields of discussion itt From what I've been told, you're right. DDOS attacks can routinely expose information through failure modes the ops team never prepared for. What happens when your failsafes fail? If they didn't test for it and put mitigations in place then it's rather likely that sensitive error messages or service details, or whatever, is being exposed over the wire. So aws mitigated this attack. Does aws know for a certainty that they revealed nothing sensitive in the process? Maybe, maybe not. If the attacker is good, and 2.3tbps is pretty fing good, then could the victim even be positioned to know what to look for? In uncharted territories the attacked is always down from the attacker.
- elorant 6y ago
- jjeaff 6y agoIs there any research into making attacks like these less feasible? I think it's rather disconcerting that given a large enough botnet, anyone could take anyone offline that doesn't have the money and resources to fight it.
- deleted 6y ago[deleted]
- Scarbutt 6y agoIf you don't have money or other valuable resources, you won't be a target of this large botnets.
- dirtnugget 6y agoWell imagine somebody trying to push back a competitor which may be a young startup which is threatening to take part of their cake.
- Scarbutt 6y agoIf the young startup is a threat, then it has real value no?
- mixedCase 6y agoWhich might be cut by annoying all their customers. And there might not be value (now) but it might be cheaper to just DDOS any potential threat rather than risk competition. Of course, that's under the belief one's above the law.
- gxon 6y agoNo? A big player might decide to preemptively squash ANY startup that could possibly become a threat while it's cheap and nobody else cares enough to notice.
- dirtnugget 6y agoPotential can be worth more than assets
- GauntletWizard 6y agoI can't share details beyond I was working at Google at the time, but I saw a 1Tbps DOS attacks back in 2012ish; so I doubt that this is "the largest ever", though it might be AWS Shield's largest ever. I don't think Google shares their numbers, though.
- stepstop 6y ago> The previous record for the largest DDoS attack ever recorded was of 1.7 Tbps, recorded in March 2018. The article says this ^. 1tbps in 2012 might have been a record but it’s been nearly a decade
- jsnell 6y agoI think that was the point. It seems quite implausible that in 8 years the size of the maximum attack would only increase by a factor of 2.
- sidcool 6y agoHow is such a large attack even possible? Genuinely curious.
- close04 6y agoIn short in many cases an amplification attack is used where you send a small quantity of traffic from a spoofed address (the victim's) to a server that will reply to the victim with up to several hundreds of times (even 50000) more data [0]. [0] https://en.wikipedia.org/wiki/Denial-of-service_attack#Amplification https://en.wikipedia.org/wiki/Denial-of-service_attack#Ampli... More detailed descriptions: https://www.cloudflare.com/learning/ddos/memcached-ddos-attack/ https://www.cloudflare.com/learning/ddos/memcached-ddos-atta... https://www.cloudflare.com/learning/ddos/ntp-amplification-ddos-attack/ https://www.cloudflare.com/learning/ddos/ntp-amplification-d... https://www.cloudflare.com/learning/ddos/dns-amplification-ddos-attack/ https://www.cloudflare.com/learning/ddos/dns-amplification-d...
- solotronics 6y agosend out packets with fake source IP. the fake source IP is your attack target. servers / services respond with a larger packet back to the attack target. Its called DDoS amplification. you can prevent this on networks you own by implementing Unicast RPF https://en.wikipedia.org/wiki/Reverse-path_forwarding#Unicast_RPF https://en.wikipedia.org/wiki/Reverse-path_forwarding#Unicas...
- deleted 6y ago[deleted]
- dirtnugget 6y agoI wonder if this had to do with the T-Mobile outage
- vondur 6y agoThis attack took place in February.
- kitteh 6y agoWho says it's the largest ever? Plenty of folks keep this stuff secret.
- SketchySeaBeast 6y agoI mean, until someone says otherwise, it can be the largest ever[1]. [1] on public record
- dang 6y agoMaybe it's more 'might as well say it since no one can prove otherwise'. Ok, it's no longer the 'largest ever' in the title above.
- smarx007 6y ago2.3 Tbps is (peak) ingress, but AWS Shield egress of 2.3 Tbps costs around $53k per hour. I am curious what kind of bill would you get from AWS after this is over? Also interesting to know if the Cloudflare's price tag of $200/mo. will also cover such an attack without nullrouting or severe throttling where site becomes unusable.
- bArray 6y agoIt kind of feels like this is getting into insurance territory. Never thought I would ever consider the possibility of a "DDoS insurance" in all honesty.
- txcwpalpha 6y ago“DDoS insurance” would almost certainly be covered under cyber security insurance, which any decently sized organization should have these days. Even without that, I wouldn’t be surprised if it’s covered by other forms of insurance, such as policies that would cover an internet or power outage. It would probably be harder to get the insurance to pay out, but if your legal team is big enough, maybe...
- freehunter 6y agoYup. I've been working in cyber security for going on 10 years now and even when I started at my first company, we already had for-pay DDoS mitigation services and cyber attack insurance. The insurance covered the cost of compensating customers for any outages that came from a successful attack (fictional example: site was down for an hour due to a DDoS so we had to reimburse millions of dollars to thousands of customers all at once). These days incident response retainers are very common, where you would pay a security firm like Mandient or Verizon or IBM a small fee every month and in exchange they guarantee that they will have an expert on site within X hours if you have a security breach. Almost every major company has a retainer like this.
- deleted 6y ago[deleted]
- freebasenic 6y agoActivision should learn from AWS, their servers get DDoS'd constantly.
- thatlongthrow1 6y agoCan't deny service if the server isn't serving. :(
- DenisM 6y agoLittle known fact: the load balancer takes care of many DDOS attacks, and this protections requires no additional config or costs. For web applications, you can use ALB to route traffic based on its content and accept only well-formed web requests. This means that many common DDoS attacks, like SYN floods or UDP reflection attacks, will be blocked by ALB, protecting your application from the attack. When ALB detects these types of attacks, it automatically scales to absorb the additional traffic. This scaling activities are transparent for AWS Customers and do not affect your bill.
- jedberg 6y agoThey've been doing transparent DDOS mitigation for a long time. Almost since the beginning. When I moved reddit from datacenter to AWS in 2009, I no longer had to deal with DDOS attacks. They just magically disappeared. I'm pretty sure reddit was still getting DDOS attacks after the move. :)