World's Largest DDOS attack takes down CloudFlare

[Umbreon]

http://arstechnica.com/security/2014/02 ... y-network/

A distributed denial-of-service attack targeting a client of the content delivery network Cloudflare reached new highs in malicious traffic today, striking at the company’s data centers in Europe and the US. According to a Twitter post by Cloudflare CEO Matthew Prince, the full volume of the attack exceeded 400 gigabits per second—making it the largest DDoS attack ever recorded.

The attack used Network Time Protocol (NTP) reflection, the same technique used in recent attacks against gaming sites by a group called DERP Trolling. NTP is used to synchronize the time settings on computers across the Internet. The attack made fraudulent synchronization requests to NTP servers that caused them to send a flood of replies back at the targeted sites.

Reflection attacks have been a mainstay of DDoS tools and botnets, but the use of NTP in such attacks is relatively new. Last year’s attack on Spamhaus, which previously set the record for the largest DDoS ever, used a Domain Name Service (DNS) protocol attack—a much more common approach that takes advantage of the Internet’s directory service, forging requests for DNS lookups from the intended target and sending them to scores of open DNS servers. The size of the traffic directed back at the target from these requests far exceeds the size of the requests sent to the DNS servers, which is why the technique is often called a DNS amplification attack.

By comparison, NTP sends much smaller amounts of data in response to requests. But as efforts have been made to prevent DNS amplification attacks by reducing the number of open DNS servers available to attackers, there are over 3,000 active public time servers configured to reply to NTP requests, as well as many more time servers on smaller networks that may be open to outside requests.

Further, a recently discovered vulnerability in NTP allows for amplification attacks similar to those previously performed with DNS, exploiting a command in the protocol called “monlist” that sends the IP addresses of the last 600 devices connected to the server. These requests, sent via a packet with the forged address of the victim, send a torrent of data back at the targeted site. Like DNS reflection attacks, NTP attacks can be diminished in effectiveness by network operators if they configure firewalls to block external requests.

They also took down League of Legends as well. Just absolutely amazing.

 

[Quacker Jack]

400 GBpS? That's absolutely crazy! :O Wow. I really hate DDoS'ers, though. They quickly become a pain to deal with.

 

[Deleted member 1609]

A game that I play, APB Reloaded, has been getting hit by DDoS attacks as well. They also took down EVE Online.

 

[Red Herring]

Some people just want to watch the world burn, it seems.

It's unfortunate that we still lack a more permanent solution in dealing with DDoS attacks.

 

[Deleted member 1609]

Some people just want to watch the world burn, it seems.

It's unfortunate that we still lack a more permanent solution in dealing with DDoS attacks.

I've been DDoSed before (yes, my personal network). It's terrible.

 

[Areeb Majeed]

Awww! That's insane!

 

[Deleted member 7467]

Runescape seems to have been brought down by them (allegedly). It's a shame really

 

[Bennie]

Why do people even DDoS?
Yeah, you could say it's for "proving a point" but ya know, it's really a dumbass move.
It's illegal and you can be sent to prison for it; most of the times it's just kids trying to be funny or show their friends or something.
People who take the whole lot of time to organize a DDoS really have no life, do they?

 

[Deleted member 1609]

It's illegal and you can be sent to prison for it...

That's true, but it's extremely hard to trace a DDoS attack. People very, very rarely get caught for them.

 

[Umbreon]

Because they're doing it "for teh lulz". smh....

 

[milksheikh]

How do you fix yourself after being DDosed?

 

[J Greig]

How do you fix yourself after being DDosed?

Make sure to have an up to date backup. Besides, a DDoS doesn't wouldn't normally effect your files on the server. It's mainly to bring the website down and when the attack stops, your website will come back online again.

The only reason they do it is to feel like they are on top of everyone else, but the truth is, they'd be more upset than any of us if the internet wasn't here.

 

[Areeb Majeed]

Last year, a attack slowed down the internet.

 

[Pvcomputers]

Wow. That must be a record. But still this would cripple everyones sites on cloudflair

 

[VirusZero]

DDoS attacks have become far more prevalent in recent years. And it's even easier/cheaper now than ever to launch an attack. It's not like you need to build your own botnet or anything like that now. For a 10-20 bucks they'll launch an attack for you that'll bring down most smaller-medium sites.

To make matters worse, there really is no adequate way to defend against DDoS attacks. I mean even refusing the connection still takes resources to answer and deny. So any attack would still largely succeed because it's still using resources somewhere along the network.

The only somewhat plausible solution is to just ramp up bandwidth to insane levels. But even then that doesn't really matter (like demonstrated in that attack on Cloudflare) since determined DDoSers will just up the attack to match.

Unfortunately, things are only going to get worse as more powerful servers and internet connections roll out.

 

[Joshua Farrell]

I hate DDOS attacks. One of the servers that I had a website on suffered from one, due to a website that someone did not like, was on that server, so the DDOS attack went after that server, and my website got caught in the middle of it.

 

[froggyboy604]

DDOS is risky thing to do since if someone DDOS the government, a big company like a major bank, or a website who has strong relationships with the government, the DDOSer can go to prison, and get sued for lots of money.

 

[Centur]

Wow. Just wow.

Didn't something similar happen with that whole Spamhaus-CyberBunker fiasco? I think it was like, 300Gbps, that one.

 

[SEO]

The reason this all happened:

The group was targeting a streamer on www.twitch.tv
They wanted to make his day crappy.
They started to DDoS all the games/companies that he was seen playing/checking out on his live stream.

They took down a lot of games that day.
Overall, it's nothing spectacular. It's honestly probably just some kids who have money to pay for freelance DDoS, or some script kiddies.

There's nothing "that cool" about a 400GBPS DDoS attack. Just some kids being more retarded than usual.

 

[Centur]

The reason this all happened:

The group was targeting a streamer on http://www.twitch.tv
They wanted to make his day crappy.
They started to DDoS all the games/companies that he was seen playing/checking out on his live stream.

They took down a lot of games that day.
Overall, it's nothing spectacular. It's honestly probably just some kids who have money to pay for freelance DDoS, or some script kiddies.

There's nothing "that cool" about a 400GBPS DDoS attack. Just some kids being more retarded than usual.

I fear dealing with DDoS attacks in the future, considering I want to be a datacenter technician or an IT guy once I'm out of college.

I've even thought of starting a datacenter, the selling point being it'd be in a small town and is one of the cheaper Midwestern choices than Chicago.