Pierluigi Paganini
July 04, 2024
The cloud services provider OVHcloud announced it has mitigated a record-breaking distributed denial of service (DDoS) attack earlier this year. The attack reached a record packet rate of 840 million packets per second (Mpps).
“Our infrastructures had to mitigate several 500+ Mpps attacks at the beginning of 2024, including one peaking at 620 Mpps. In April 2024, we even mitigated a record-breaking DDoS attack reaching ~840 Mpps, just above the previous record reported by Akamai.” reads the post published by OVHcloud.
Since early 2023, the company observed a significant increase in both the frequency and intensity of DDoS attacks. Starting from November, the attacks of 1 Tbps or more are becoming more frequent. Over the past 18 months, the highest bit rate recorded was approximately 2.5 Tbps.
The expert noticed that the recent announcement of the 911 S5 Botnet takeover between May 25th and May, 30th 2024 coincides with a significant decline of DDoS attacks.
The analysis of the malicious traffic revealed that most of the source IPs are known as Internet-facing MikroTik routers.
Most of the impacted MikroTik router families are the CCR1036-8G-2S+ and CCR1072-1G-8S+ series.
99% of the malicious traffic were TCP ACK flood, originating from around 5,000 source IPs. The remaining 1% was a DNS reflection attack that involved about 15,000 DNS servers, which is not efficient for achieving high packet rate attacks.
“While the attack was distributed worldwide, 2/3 of total packets entered from only 4 PoPs, all located in the US with 3 of them being on the west coast. This highlights the capability of the adversary to send a huge packet rate through only few peerings, which can prove very problematic.” continues the report.
The experts speculate that the use of MikroTik devices in coordinated DDoS attacks might be due to the “Bandwidth test” feature in RouterOS, which allows administrators to test router throughput by crafting packets and performing stress tests. Since version 6.44beta39, this feature uses all available bandwidth by default, potentially impacting network usability. Most of the offending IPs identified were running RouterOS v6.44 or above.
OVHcloud discovered 99,382 devices exposed online that can be potentially exploitable.
The researchers also attempted to evaluate the possible capacity of a botnet composed of these devices. Focusing their analysis on packet rate attacks, the experts determined that theoretically, the botnet could be able to generate 2.28 billions packets per second (or Gpps).
“we reached out to MikroTik through several communication channels to expose them the situation, but had no feedback so far. We are also currently contacting different AS to report them the issue” concludes the report.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, botnet)
