Github Faces biggest DDos Attack(1.35 TBPS)

On Wednesday, February 28, 2018 GitHub.com was unavailable from 17:21 to 17:26 UTC and intermittently unavailable from 17:26 to 17:30 UTC due to a distributed denial-of-service (DDoS) attack.

Background

Cloudflare described an amplification vector using memcached over UDP in their blog post this week, “Memcrashed - Major amplification attacks from UDP port 11211”. The attack works by abusing memcached instances that are inadvertently accessible on the public internet with UDP support enabled. Spoofing of IP addresses allows memcached’s responses to be targeted against another address, like ones used to serve GitHub.com, and send more data toward the target than needs to be sent by the unspoofed source. The vulnerability via misconfiguration described in the post is somewhat unique amongst that class of attacks because the amplification factor is up to 51,000, meaning that for each byte sent by the attacker, up to 51KB is sent toward the target.

Over the past year we have deployed additional transit to our facilities. We’ve more than doubled our transit capacity during that time, which has allowed us to withstand certain volumetric attacks without impact to users. We’re continuing to deploy additional transit capacity and develop robust peering relationships across a diverse set of exchanges. Even still, attacks like this sometimes require the help of partners with larger transit networks to provide blocking and filtering.

What’s DRDoS attack?

A DDoS (Distributed Denial of Service) attack is a well known method for attackers to paralyse an online service by overwhelming it with huge amount of traffic from multiple endpoints controlled by the attacker. 

The purpose of DRDoS (Distributed Reflection Denial of Service) is no difference. Yet DRDoS attackers disguise themselves as the targeted victims with IP spoofing technique, and send small packets to servers, which reflect back to victims with massive data instead of the attackers. In this way, attackers do not have to control many PC to launch an attack, but also can hide themselves from the attack.