CloudFlare, the content delivery network, internet security services and distributed domain name server services, has disclosed one of the largest DDoS attack against one of its customers which was a French website.
The attack was peaked at 400Gbps.
The company's CEO Matthew Prince, said that the attack caused trouble "even off our network," suggesting that some upstream service providers particularly in Europe may have experienced slowdowns. The attack was mostly absorbed by the company's mitigation systems.
"We've seen a handful of other attacks at this scale, but this is the largest attack we've seen that uses NTP amplification," said CloudFlare on its blog post.
What the attackers did, was using NTP amplification from a controlled server on a network that allowed source IP address spoofing. Because the source IP address was forged, the attackers were able to create a large number of UDP packets and send those data to the victim.
The method of attack was sending a packet that was apparently from the intended victim to some server on the internet that will reply immediately.
The attacker used 4,529 NTP servers running on 1,298 different networks. On average, each of the servers sent 87Mbps of traffic to the intended victim on CloudFlares network. It's also possible that the attacker used only one single server running on a network that allowed source IP address spoofing to initiate the requests.
The chart below lists the AS Numbers and names of the top 24 networks CloudFlare saw traffic from in the attack, as well as the number of exploited NTP servers running on them.
The number of DDoS attacks that included NTP reflection-attack techniques increased after January 2, when US-CERT released vulnerability advisory CVE-2013-5211 that detailed a network time protocol daemon (ntpd) bug that can be exploited to launch DDoS reflection attacks.
As early as January, there was a massive shift in the tactics used by attackers when they began tapping the NTP vulnerability.
The attack CloudFlare experienced, was about 30 percent larger than the 300Gbps DDoS Spamhaus experienced.
