Security Cloudflare IOT Cameras DDOS Attacks up to 1.75 millon HTTP requests/s !

eva2000 · Oct 20, 2016

Cloudflare blog has a new article on IOT Cameras DDOS attacks with layer 7 attacks reaching 1.75 million HTTP requests/s Say Cheese: a snapshot of the massive DDoS attacks coming from IoT cameras !

HTTP Requests per second
Often when DDoS attacks are reported the size of the attack is reported in Gbps (or even Tbps), but there are many ways to measure the size of an attack.

For L7 HTTP-based attacks it also makes sense to measure requests per second. That's because, unlike volumetric L3/4 attacks, HTTP-based attacks eat up resources by making actual HTTP requests to the attacked server.

Recently we were hit by a couple of unusually large L7 attacks, crossing 1 million HTTP requests per second (1 Mrps).

This attack continued for 15 minutes. Multiple recent attacks had >1 Mrps and lasted for minutes.

This particular attack peaked at 1.75 Mrps. It was composed of short HTTP requests (around 121 bytes per request), without anything unusual in the HTTP headers. The requests had a fixed Cookie header. We counted 52,467 unique IP addresses taking part in this attack.

Due to the Anycast nature of the Cloudflare network, the malicious traffic was spread across multiple Cloudflare cities and with 100 cities we are able to get a good picture of where the bots are located.
Click to expand...

Since the attack looks concentrated, we wondered if only a small number of AS numbers (networks) were the source of the attack. Unfortunately no, the IP addresses participating in the flood are evenly distributed. Out of 10,000 random requests we analyzed, we saw source IP addresses from over 300 AS numbers. These are the biggest sources:

48 AS24086 ; Vietnam
101 AS4134 ; China
128 AS7552 ; Vietnam
329 AS45899 ; Vietnam
2366 AS15895 ; Ukraine

These attacks are a new trend, so it's not fair to blame the AS operators for not cleaning up devices participating in them. Having said that, the Ukrainian ISP and Vietnamese AS45899 seem to stand out. We'll get back to those in a moment.
Click to expand...

interesting for forum spam AS45899 is commonly popping up for me too!

eva2000 · Oct 20, 2016

Sucuri and Incapsula had similar IOT DDOS attack articles too

Large CCTV Botnet Leveraged in DDoS Attacks

IoT Home Router Botnet Leveraged in Large DDoS Attack

https://www.incapsula.com/blog/cctv-ddos-botnet-back-yard.html

Log in / Register

Forums

Get the most out of your Centmin Mod LEMP stack

Security Cloudflare IOT Cameras DDOS Attacks up to 1.75 millon HTTP requests/s !

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Get the most out of your Centmin Mod LEMP stack

Security Cloudflare IOT Cameras DDOS Attacks up to 1.75 millon HTTP requests/s !

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.