Another 100 Gigabit DDoS Attack Strikes — This Time Unreflected 93
darthcamaro writes "In March of this year, we saw the first ever 100 Gigabit DDoS attack, which was possible due to a DNS Reflection Amplification attack. Now word is out that a new 100 Gigabit attack has struck using raw bandwidth, without any DNS Reflection. 'The most outstanding thing about this attack is that it did not use any amplification, which means that they had 100 Gigabits of available bandwidth on their own,' Incapsula co-founder Marc Gaffan said. 'The attack lasted nine hours, and that type of bandwidth is not cheap or readily available.'"
How much bandwidth is that? (Score:4, Interesting)
Is that 100 GB/sec, 100 Gbps/sec, 100 GiB/sec, or 100 GiB over 9 hours?
Re:Incapsula (Score:5, Interesting)
They don't name the site, they don't name the attacker, the customers were "completely unaffected"....they could be making it up for all we know.
Re:Incapsula (Score:5, Interesting)
"....this reads like a brochure for Incapsula's services..."
http://bgp.he.net/AS19551#_whois [he.net]
Well, I imagine most US server farms are hurting pretty bad right now, what with all the NSA luvin' going around over here. Now imagine a company that has all of it's servers in the US, Israel and Germany (with a few in Japan)--in light of recent revelations regarding NSA spying--and maybe you'll understand why Incapsula is paying for ads/articles all over the damn place, including /.
They are fucked, and this marketing blitz is a Hail-Mary attempt to save their ass from the fire that Snowden just lit under it. Personally, I love a good BBQ.
Re:Incapsula (Score:5, Interesting)
We are an Incapsula customer and I can tell you we were NOT "completely unaffected".
Maybe you could call Sean Michael Kerner at eWeek and tell them Marc Gaffan was lying.
He's also on twitter: https://www.twitter.com/techjournalist [twitter.com]
Re:I can't get one thing (Score:4, Interesting)
This, and you can easily distinguish a reflected attack by the type of packet, which will be an unsolicited reply to an application level request.
I just wish the stupid script kiddies would realize that not every SNMPv2/SNMPv3 client that responds actually amplifies traffic or gives maybe a 30% gain (because what you're getting back is an "access denied") and so isn't worth it, and stop trying to reflect off the printers here. I'm sick of chasing around the people who are supposed to lock them down, and banning entire protocols that don't really, really deserve it just fills me with ick.