38-Day Long DDoS Siege Amounts to Over 50 Petabits in Bad Traffic

A Massive DDoS Attack Directed at an Undisclosed VideoGame Company Due to an Alleged Business Feud, Lasted No Less than 38 Days and Spewed over 50 Petabits of Malicious Traffic at the Target. The Perpetrators Used Extremely Large DNS Floods for the Entire Duration of the Attack that Started on June 21 and Ended on July 28, Channeling Several 10s of Millions of Requests per Second, according to Incapsula, Who Mitigated the Incident from Start to End. The Company Said in a Blog Post that, the Offenders “tried everything from massive network layer DDoS attacks to focused application layer (HTTP) floods, followed by dozens of SQLI and XSS attempts”. On a Regular Basis, they Relied on at least 2 of these Attack Vectors but, they Often Ramped Things Up with 5-Vector Attacks. Incapsula Says that, the Largest Amount of Packets was Over 90 Million per Second, Totaling a Bombardment of More than 110 Gbps.


Their DNS Infrastructure was also Hit with Large SYN Floods, in an Attempt to Disrupt the Protection of the Targeted Service. Suspicion of a Business Feud being at the Root of the Incident is Supported by the Fact that, the Attackers had Sufficient Firepower in their Hands and were Extremely Determined in their Activity. “The ‘business feud’ theory is reinforced by the resources used during the attack. Looking at source IP data, Incapsula noticed the majority of malicious packets were originating from the same IP ranges. We knew that 20% of C-classes are typically responsible for ~80% of all DDoS traffic”, Incapsula Says. The Resources Leveraged in the Incident were Far from being Consistent with an Off-the-Shelf Botnet for Hire Capable of Short-Lived 20 Gbps Blasts, which Could be Purchased on Underground Forums for a Few Hundred US Dollars.


An Offensive Lasting this Long with Capability to Generate 90+ Gbps of Unamplified DDoS Traffic is Clearly the Work of Professionals Who DDoS for a Living. The Long-Lasting Event was Handled by Incapsula Using a Single “Behemoth” Scrubbing Server, which is Capable of Processing Up to 170Gbps or 100Mpps Worth of Traffic. The Company under Attack had Contracted the DDoS Mitigation Services from Incapsula just a Day before the Incident Started. At the Time of the Event Behemoth had Spent a Month being Tested Internally. It Goes without Saying that, Incapsula is Mighty Proud of their Technology, especially after Proving itself in an Incident of this Magnitude.




Info Source:

http://www.incapsula.com/blog/38-day-long-ddos-attack.html