bk99.de entertain the web since 1997

bk99.de
KrebsOnSecurity · DDoSCurated

6.3 Tbit/s: What came after Mirai

Summary

Brian Krebs examines a short 6.3 Tbit/s attack and links it to Aisuru, compromised IoT devices and a publicly rented DDoS service. The attack reached more than 6.3 Tbit/s. Google measured around 585 million packets per second.

Ideas

  • Very short DDoS peaks can serve as proof of performance for buyers.
  • High packet rates load infrastructure differently from pure bit rates.
  • Aisuru combined default credentials with new router vulnerabilities.
  • Public rental turns botnet capacity into a service you can book.
  • Protection platforms push the attack size they can absorb far beyond classic hosting limits.
  • Mirai’s published code produced successors and at the same time made them easier to analyse.

Insights

  • DDoS records also measure the concentration of global defence capacity.
  • Short attacks that cause no damage can be preparation and advertising for later operations.
  • Competition between botnets limits individual operators but enlarges the overall attack surface.

Quotes

  • For most companies, this size of attack would kill them. – Damian Menscher

Habits

  • Krebs compares measurement data from different protection providers with public traces of the suspected operator.

Facts

  • The peak lasted about 45 seconds.
  • Google attributed the attack to the IoT botnet Aisuru, also known as Airashi.

References

Critique

  • The botnet attribution is based on technical fingerprints and remains an analytical assessment.
  • An extremely short peak does not describe the effect of a long-lasting attack.

Remarks

  • The measured bit rate was about ten times that of the 2016 attack.
  • Project Shield prevented any visible interruption of the site.

Recommendations

  • Dimension protection separately by bit rate, packet rate and attack duration.
  • Practise switching over and communicating with upstream DDoS providers.
  • Patch reachable routers and remove management access you do not need.

Read the original article

Search the Web Archive

KrebsOnSecurity · 2016

620 Gbit/s: Mirai announces a new class of DDoS

Brian Krebs documents a DDoS attack that was exceptional at the time and whose direct traffic floods pointed to a large botnet of compromised IoT devices. The attack began on the evening of 20 September 2016. After analysis, Akamai put the peak load at around 620 Gbit/s.

Own note · 2016

A DDoS with almost 100 Mbit/s of incoming traffic

During a DDoS attack, live monitoring of eth0 showed 93.72 Mbit/s of incoming traffic at 21,246 packets per second, while almost nothing went out. vnStat was watching the network interface in live mode. Outgoing traffic was only 44 kbit/s at 19 packets per second.

Hostblogger · 2007

DDoS against a public DNS blacklist

Manuel Schmitt reports on a DDoS attack on ix.dnsbl.manitu.net and then considers a list of permitted query networks. ix.dnsbl.manitu.net was hit by a DDoS attack in June 2007. Bert Ungerer and Manuel discussed operating on a whitelist basis.