Largest DDoS in 2011 hits Asian organisation

The largest distributed denial of service (DDoS) attack of 2011 took place two weeks ago, according to Prolexic Technologies, a company that offers DDoS protection services.

The company has announced that it successfully mitigated the attack, which was the largest DDoS in terms of packets-per-second (PPS), a measure of network throughput.

According to Prolexic, the attacked targeted a large Asian organisation and its DNS provider, and took place between 5 November and 12 November 2011.

Paul Sop, CTO at Prolexic, said that the attack was not only the largest in 2011, but also the largest the company has ever dealt with.

Sop said the attack reached a peak level of 69 million packets per second, bandwidth of 45 Gb of traffic per second and 15,000 connections per second. Attackers used six different attack signatures during the event, including a combination of bandwidth-driven Layer 3 and targeted Layer 7 attacks aimed at the organisation’s critical application layer.

Prolexic mitigated a total of four separate DDoS attacks over the course of the event, which lasted 7 days and 20 hours.

"This attack was three times larger in packets per second volume than the biggest attack Prolexic has mitigated previously, which also occurred in 2011," Sop said.

"Frankly, we are not surprised since we have seen an almost fourfold increase in packet volume since Q3 2010. This increase reflects an emerging strategy in which attackers directly target a company's DDoS mitigation appliances, which are commonly vulnerable to such attacks, as they cannot handle such high PPS rates," he said.

Prolexic technicians identified a randomised attack consisting of the largest volume of GET, SYN, ICMP, UDP and DNS floods launched in a single attack campaign this year. They identified that the attack was coming from botnets in multiple worldwide locations.

In addition, unlike typical DDoS attacks that are coordinated from one geographic source, this attack was coordinated globally.

Prolexic said it was able to mitigate each DDoS attack within minutes of the time traffic began flowing through its "scrubbing centres".