Tech Giants Foil Massive DDoS Attack To Save The Internet From Doom!

DDoS attacks have become increasingly common in recent times. In June, Microsoft reported a substantial layer seven attack that temporarily crippled Outlook for thousands of its users.

The success in mitigating these attacks can be attributed to a newfound vulnerability in the HTTP/2 protocol, dubbed "HTTP/2 Rapid Reset." This protocol is renowned for accelerating webpage loading times by facilitating multiple concurrent requests to a website over a single connection. However, malevolent actors exploited this feature by orchestrating a relentless barrage of "hundreds of thousands" of requests to websites employing HTTP/2, leading to the inundation of servers and, consequently, the shutdown of targeted platforms.

Among these tech giants, Google grappled with the most ferocious onslaught, witnessing an astonishing 398 million requests per second—over seven times larger than any previous attack in its records. Cloudflare, too, saw an unprecedented peak at 201 million requests per second. In contrast, Amazon reported comparatively fewer requests but still staggering at 155 million per second, while Microsoft chose to keep its figures under wraps.

According to the company, "In the two minutes that followed, the attack began to ramp up, growing from 100,000 RPS (requests per second) to a peak of 46 million RPS." However, the massive surge in traffic failed to disrupt Google Cloud. "Since Cloud Armor was already blocking the attack traffic, the target workload continued to operate normally. Over the next few minutes, the attack started to decrease in size, ultimately ending 69 minutes later at 10:54 a.m. Presumably the attacker likely determined they were not having the desired impact while incurring significant expenses to execute the attack," the company said.

The source of this massive DDoS onslaught appears to have been the Meris botnet, comprised of hundreds of thousands of compromised internet routers and modems, with a significant number linked to MikroTik. The botnet's creation was facilitated by a vulnerability in MikroTik products that allowed hackers to take control of these devices remotely.

Google's strategy for mitigating such attacks involves establishing a "baseline model of normal traffic patterns" for customer websites. Furthermore, it includes a "rate-limiting capability" that enables customers to regulate malicious web traffic without adversely impacting legitimate website requests.

The tech giant shared detailed insights about this attack, not only as a warning to the tech community but also as an invitation for potential corporate clients to embrace its cloud services. Google Cloud Armor offers a robust solution for safeguarding internet-facing applications, effectively intercepting unwelcome traffic long before it reaches the core applications.