Harrison St. Suite 403
1930 Hollywood, Florida, us
Michael E. Donner
+1 (954) 620-6017
Prolexic Stops Largest Ever DNS Reflection DDoS Attack
167 Gbps Attack Targets Real-Time Financial Exchange Platform
“This was a massive attack that made up in brute force what it lacked in sophistication,” said Scott Hammack, chief executive officer at Prolexic. “Because of the proactive DDoS defense strategies Prolexic had put in place with this client, no malicious traffic reached its website and downtime was avoided. In fact, the company wasn’t aware it was under attack.”
The DDoS mitigation for this attack was distributed across Prolexic’s four cloud-based scrubbing centers in Hong Kong, London, San Jose and Ashburn, Va. Prolexic’s London-based scrubbing center mitigated the majority of the malicious traffic, which peaked at 90 Gbps.
The DNS Reflection Denial of Service (DrDoS) technique exploits security weaknesses in the Domain Name System (DNS) Internet protocol.
In this type of DNS reflection attack, an attacker makes many spoofed queries to many public DNS servers. The source IP address is forged to appear as the target of the attack. When a DNS server receives the forged request it replies, but the reply is directed to the forged source address. This is the reflection component. The target of the attack receives replies from all the DNS servers that are used. This type of attack makes it very difficult to identify the malicious sources. If the queries (which are small packets) generate larger responses, then the attack is said to have an amplifying characteristic.
Prolexic’s digital forensics confirmed that 92 percent of the machines participating in the attack were open DNS resolvers, sourcing from port 53, which represented a malformed DNS response.
In March, Prolexic authored a white paper on DNS reflection attacks highlighting their increasing usage and illustrating how the DNS protocol can be exploited by cyber attackers. The white paper can be downloaded free of charge at www.prolexic.com/drdos. In addition, Prolexic’s Q1 Global DDoS Attack Report featured an in-depth case study on the technique.
“It’s only a matter of time, possibly by the end of this quarter, before the 200 Gbps marker is crossed,” said Hammack. “To keep pace with increasing attack sizes, Prolexic is continuing to build out its 800 Gbps DDoS mitigation infrastructure and by the end of the year, we will have approximately 1.2 Tbps of bandwidth on tap.”
Regardless of attack size, Prolexic recommends that all organizations proactively validate their DDoS mitigation service to minimize downtime. Best practices and guidance can be found in Prolexic’s latest white paper, "Planning for and Validating a DDoS Defense Strategy," which can be downloaded for a limited time from www.prolexic.com/planning.
The use of information published here for personal information and editorial processing is generally free of charge. Please clarify any copyright issues with the stated publisher before further use. In the event of publication, please send a specimen copy to firstname.lastname@example.org.