Google claims to have stopped one of the largest Distributed Denial of Service (DDoS) attacks ever seen.
In a blog post (opens in a new tab), Emil Kiner, the company's senior product manager for Cloud Armor, and technical lead Satya Konduru, said their tool stopped a Layer 7 HTTPS DDoS attack that reached a maximum of 46 million requests per second (rps), making it 76% larger than the previous record holder.
“To give an idea of the scale of the attack, it is like receiving all the daily queries to Wikipedia (one of the 10 most trafficked websites in the world) in just 10 seconds,” the blog explained.
Tor exit nodes used
The attack peaked about ten minutes later, but lasted for more than an hour (69 minutes). The researchers assume that the attackers stopped when they saw that their efforts were not producing the desired result.
From a technical point of view, it appears that the botnet used in the attack was quite powerful. A total of 5.256 source IP addresses were used, from 132 countries.
The attack used encrypted requests (HTTPS), which means additional computing resources were needed to generate it; It was quite an expensive task. Nearly a quarter (22%) of all source IP addresses (1169) were from Tor exit node endpoints (opens in a new tab), despite their request volume representing only 3% of all attack traffic.
"While we believe that Tor's involvement in the attack was incidental due to the nature of the vulnerable services, even at 3% of the peak (over 1,3 million rps), our analysis shows that Tor exit nodes can send a significant amount of unwanted traffic to web applications and services,” they added.
The top four countries contributed almost a third (31%) of the total attack traffic.
Google experts were unable to confirm for sure the threat actor behind the attack, but believe it was the work of Mēris, given that the geographic distribution and types of insecure services exploited in the attack match her patterns.