Google Reveals it Was Hit by 2.5Tbps DDoS

The 2.5Tbps DDoS struck in September 2017 but was made public for the first time on Friday in a report designed to share best practices on cyber-defense and plug Google Cloud mitigations.

According to Google security reliability engineer, Damian Menscher, the attack topped a six-month campaign against the firm.

“Despite simultaneously targeting thousands of our IPs, presumably in hopes of slipping past automated defenses, the attack had no impact. The attacker used several networks to spoof 167 Mpps (millions of packets per second) to 180,000 exposed CLDAP, DNS, and SMTP servers, which would then send large responses to us,” he explained.

“This demonstrates the volumes a well-resourced attacker can achieve: this was four times larger than the record-breaking 623 Gbps attack from the Mirai botnet a year earlier. It remains the highest-bandwidth attack reported to date, leading to reduced confidence in the extrapolation.”

A separate report on the same day from Shane Huntley of Google’s Threat Analysis Group revealed that this was a state-sponsored UDP amplification attack “sourced out of several Chinese ISPs (ASNs 4134, 4837, 58453, and 9394).”

“Addressing state-sponsored DDoS attacks requires a coordinated response from the internet community, and we work with others to identify and dismantle infrastructure used to conduct attacks,” he added.

Menscher also argued that collaboration and transparency is important to help reduce the opportunities for such attackers.

For example, Google reported thousands of servers exploited in the DDoS attack to their network providers, so that they could take action.

Neustar last month claimed to have neutralized the largest DDoS it has ever encountered, at just under 1.2Tbps — less than half the size of the attack on Google.