(ValeryBrozhinsky via Getty)
Internet infrastructure provider Cloudflare says it fended off a record-breaking DDoS attack that reached a whopping 3.8Tbps.
The attack exceeds the 3.47Tbps DDoS that Microsoft encountered in November 2021, the previous record holder. In both cases, the hackers launched a “volumetric” distributed denial-of-service attack, which is designed to consume all the available internet bandwidth of a website or app, exhausting the capacity and forcing it offline.
In Cloudflare’s case, the 3.8Tbps assault was part of a month-long hacking campaign that began early last month, and has so far spanned over 100 especially large volumetric DDoS attacks, with many surpassing 3Tbps. Cloudflare says it was able to mitigate the record-breaking DDoS attack partly because the company has individual servers across the globe, which can effectively dilute the incoming traffic from a botnet. The company also has systems that can analyze traffic in real time and filter out the malicious data flow.
(Credit: Cloudflare)Without revealing names, Cloudflare said the DDoS campaign has been targeting “multiple customers in the financial services, Internet, and telecommunication industries, among others.” But despite the severity of the assault, Cloudflare was able to essentially shrug off the attacks, citing its robust network coverage and defense systems.
“Detection and mitigation was fully autonomous,” the company wrote in a blog post. Cloudflare facilitates internet access to numerous websites, in addition to providing DDoS protection.
The company’s investigation traced the campaign to a hacker-controlled botnet made up of hijacked internet devices, including Asus and MikroTik routers, DVRs, and web servers. When used together, the hijacked devices can be exploited to bombard a website or app with internet traffic, resulting in a DDoS attack.
(Credit: Cloudflare)In this case, the botnet leveraged the User Datagram Protocol (UDP), which is designed to transfer data quickly, but can be exploited to create a large DDoS, also known as a UDP flood attack.
The internet traffic from the DDoS also shows the hijacked devices are based in countries including Vietnam, Russia, Brazil, Spain, and the US. Cloudflare adds that hackers likely took over the Asus home routers by exploiting a recently disclosed high-severity vulnerability that’s estimated to affect 157,000 router models.
The incident once again underscores the danger of unpatched hardware devices being abused for hacking campaigns.