RESEARCHERS have uncovered a 'record-breaking' 1.7Tbps distributed denial of service (DDoS) attack, just days after Github was whacked with a massive 1.35Tbps attack.
Arbor Networks detected the 1.7Tbps attack, which it says was aimed at an as-yet-unidentified 'US service provided'. Just like the DDoS attack that hit GitHub last week, this one was also carried out via Memcached servers left exposed online, allowing the attacker's sent data to be amplified by a factor of 51,000.
Carlos Morale, VP of sales, engineering and operations at Arbor Networks, said that prior to this, the biggest DDoS attack that Arbor had experienced was 650Gbps aimed at a target in Brazil.
"NETSCOUT Arbor can confirm a 1.7Tbps reflection/amplification attack targeted at a customer of a US-based Service Provider has been recorded by our ATLAS global traffic and DDoS threat data system.
"The attack was based on the same memcached reflection/amplification attack vector that made up the Github attack.
"While the internet community is coming together to shut down access to the many open mecached servers out there, the sheer number of servers running memcached openly will make this a lasting vulnerability that attackers will exploit."
Impressively, while Github was taken down for less than 10 minutes as a result of last week's attack, the US service provider in question suffered no outages as it had adequate safeguards in place.
"It's a testament to the defence capabilities that this Service Provider had in place to defend against an attack of this nature that no outages were reported because of this," Arbor noted.
Seperately, security firm Cybereason is reporting that last week's DDoS attack on Github included a ransom demand embedded in the payload.
It claims that the message was embedded within a line of Python code that was delivered by the compromised machines, and demanded GitHub hand over 50 Monero cryptocurrency (around $15,000). µ
What could possibly go wrong...
Committee clams firm failed to implement 'adequate security'
Meme Ban means Meme Ban
It's anonymous data at first but the NYT figured out how to make it personal