The largest DDoS attack to date, peaking above 398M rps

Related ongoing threads:<p><i>The novel HTTP&#x2F;2 &#x27;Rapid Reset&#x27; DDoS attack</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37830987">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37830987</a><p><i>HTTP&#x2F;2 Zero-Day Vulnerability Results in Record-Breaking DDoS Attacks</i> - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37830998">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37830998</a>

Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it worthwhile. Can anyone help me understand?

At a previous company, we were subject to semi-frequent attacks (of a much smaller scale). The operating assumption internally was that it’s a competitor trying to undermine us but it remains a mystery.<p>Anyone involved in these type of attacks (at internet-infrastructure scale or targeting specific companies) brave&#x2F;crazy enough to create a throwaway account and tell hn about the motivations?

Same attack on Cloudflare <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;zero-day-rapid-reset-http2-record-breaking-ddos-attack&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;zero-day-rapid-reset-http2-recor...</a>

&gt; We noticed these attacks at the same time two other major industry players — Google and AWS — were seeing the same.<p>Curious if there&#x27;s anyone in the HN crowd that works at this level in one of the major vendors. What happens during an attack of this scale? Are there people from Cloudflare + Google + AWS on a live videoconference call co-ordinating with each other in real-time to mitigate it? Or is each vendor mostly observing from a distance what is happening elsewhere, and solely focussed on sorting their own problems out?

How does DDoS mitigation work? When people say &quot;I put my website behind Cloudflare to mitigate DDoSes&quot;, what does it mean exactly?<p>Is it only about having a large enough ingress pipe that you can weather however many Gb&#x2F;s you are being bombarded with, and still having some spare capacity for legitimate traffic?

Linked in this article is more info on the rapid reset feature of HTTP2 which was used at part of the ddos <a href="https:&#x2F;&#x2F;cloud.google.com&#x2F;blog&#x2F;products&#x2F;identity-security&#x2F;how-it-works-the-novel-http2-rapid-reset-ddos-attack" rel="nofollow noreferrer">https:&#x2F;&#x2F;cloud.google.com&#x2F;blog&#x2F;products&#x2F;identity-security&#x2F;how...</a>

No word on the origin of these attacks? This must require massive amounts of hardware, you’d imagine it to be easily traceable unless some kind of botnet.

Couldn&#x27;t cloudflare show a page to the next handful of http requests from an IP informing the user that &quot;something on your network is participating in DDoS attacks&quot;.<p>All the big providers could do this, just inject a little turnstile like page in front of the next cloudflare site you visit.<p>I would love to know if there&#x27;s a compromised device on my network, and I don&#x27;t have any real monitoring set up to detect it.<p>It&#x27;s not a full solution, but at least informing users there is a problem is a good start.

Cloudflare blog: <a href="https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;zero-day-rapid-reset-http2-record-breaking-ddos-attack&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;blog.cloudflare.com&#x2F;zero-day-rapid-reset-http2-recor...</a>

The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax.<p>I honestly don&#x27;t see any other options, but I&#x27;d really wish for them to come through some community coordinated list of botnet infected IPs or something.

Sorry, I forgot to break out of my while loop

So given that minimum size of HTTP request is something under 32 bytes, some sources say 18 bytes but let&#x27;s be generous here HTTP can be complex. In theory I could send 4M requests in second with 1 Gbps connection. 1 Tbps total connection capacity could do close to 4.3B rps given perfect distribution.<p>I imagine distributing the load becomes harder&#x2F;more expensive the bigger the scale. In real network you probably have to find the paths that don&#x27;t slow you down and then strike for short time before you are banned.<p>Cloudflare has made post about mitigating 2 Tbps DDOS in 2021, so in real attacks request sizes aren&#x27;t quite that optimal.

&quot;In the end, H2 [HTTP&#x2F;2] is not much robust but each implementation has certain possibilities to cover some of the limitations and these differ due to many architectural constraints.&quot;<p>&quot;The good point in this is that this will probably make more people want to reconsider H3&#x2F;QUIC [HTTP&#x2F;3] if they don&#x27;t trust their products anymore :-)&quot;<p><a href="https:&#x2F;&#x2F;www.mail-archive.com&#x2F;haproxy@formilux.org&#x2F;msg44136.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;www.mail-archive.com&#x2F;haproxy@formilux.org&#x2F;msg44136.h...</a>

Such attacks are possible because ISPs do not want to adopt a protocol that would allow any host to send a special packet to block malicious traffic on the upstream provider or even at the source network. In this case networks like Cloudflare would become unnecessary.

AWS blog: <a href="https:&#x2F;&#x2F;aws.amazon.com&#x2F;blogs&#x2F;security&#x2F;how-aws-protects-customers-from-ddos-events&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;aws.amazon.com&#x2F;blogs&#x2F;security&#x2F;how-aws-protects-custo...</a>

Interestingly, the CVE is still &quot;reserved&quot;: <a href="https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2023-44487" rel="nofollow noreferrer">https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2023-44487</a> .

How large of a “botnet” did it take to cause 398M rps?

Any info on where these attacks originate? I&#x27;m guessing it&#x27;s hacked routers and IoT devices. I wonder if it&#x27;s time for governments to start giving IoT vendors &quot;DDoS scores&quot; and mandating that they appear on the label.

398 million requests per second is really the largest DDOS attack to date?

You can send thousands of such Request+RST to an Apache httpd per connection, but it will only work on 2 of them at a time.<p>We are an old server. You have to be nice to us before we do more for you. -.-

I am impressed from both parties, from a tech perspective. The attackers who exploited HTTP2, and Google that mitigated it.<p>How did Google mitigate it exactly? Is there a technical deep dive?

Is there a chance that these cloud ddos service providers are attacking each other or themselves to create PR opportunities?

Wonder how you could even handle this if you weren’t using a big cloud provider and didn’t have a lot of money to spend.

Should Google actually provide the DDoS initiators with debug information like this graph? Just thinking...

Novice here. Should I seek the patch from the web application framework I use (e.g. Jetty, Spring Boot)?

Hmm wasn&#x27;t there like 3.47Tbps attack on MS that&#x27;s prob about same magnitude

This is just Google bs. There is no way in hell they can&#x27;t mitigate anything at the edge of this nature. If this was a real problem it most likely originated from within GCP. The article does not even state where the traffic comes from.<p>EDIT: Ok, so this was a 0-day issue. Then it all makes more sense. Sorry.

So is this a new world record?

Any clue who was the target?<p>Can such an attack be performed with botnets?

Who was the target?!

As elections are getting closer, the public needs to be primed for adversary attacks and disinformation.

398M rps means a request every 2.5ns.<p>Most likely the figure is incorrect, or at least misleading.

Cut China, North Korea, Iran and Russia off from the Internet and problem solved. It will be difficult but it can be done.