Prolexic Stops Largest Ever DNS Reflection DDoS Attack

Hollywood, FL – Prolexic, the global leader in Distributed Denial of Service (DDoS) protection services, announced today that it has successfully mitigated the largest DNS reflection attack ever recorded, which peaked at 167 Gigabits per second (Gbps). The attack, the largest single DDoS attack Prolexic has mitigated in its 10-year history, was directed against a real-time financial exchange platform on May 27, 2013.

"This was a massive attack that made up in brute force what it lacked in sophistication," said Scott Hammack, chief executive officer at Prolexic. "Because of the proactive DDoS defense strategies Prolexic had put in place with this client, no malicious traffic reached its website and downtime was avoided. In fact, the company wasn't aware it was under attack."

The DDoS mitigation for this attack was distributed across Prolexic's four cloud-based scrubbing centers in Hong Kong, London, San Jose and Ashburn, Va. Prolexic's London-based scrubbing center mitigated the majority of the malicious traffic, which peaked at 90 Gbps.

The DNS Reflection Denial of Service (DrDoS) technique exploits security weaknesses in the Domain Name System (DNS) Internet protocol.

In this type of DNS reflection attack, an attacker makes many spoofed queries to many public DNS servers. The source IP address is forged to appear as the target of the attack. When a DNS server receives the forged request it replies, but the reply is directed to the forged source address. This is the reflection component. The target of the attack receives replies from all the DNS servers that are used. This type of attack makes it very difficult to identify the malicious sources. If the queries (which are small packets) generate larger responses, then the attack is said to have an amplifying characteristic.

Prolexic's digital forensics confirmed that 92 percent of the machines participating in the attack were open DNS resolvers, sourcing from port 53, which represented a malformed DNS response.

In March, Prolexic authored a white paper on DNS reflection attacks highlighting their increasing usage and illustrating how the DNS protocol can be exploited by cyber attackers. The white paper can be downloaded free of charge at http://www.prolexic.com/drdos/ . In addition, Prolexic's Q1 Global DDoS Attack Report featured an in-depth case study on the technique.

"It's only a matter of time, possibly by the end of this quarter, before the 200 Gbps marker is crossed," said Hammack. "To keep pace with increasing attack sizes, Prolexic is continuing to build out its 800 Gbps DDoS mitigation infrastructure and by the end of the year, we will have approximately 1.2 Tbps of bandwidth on tap."

Regardless of attack size, Prolexic recommends that all organizations proactively validate their DDoS mitigation service to minimize downtime. Best practices and guidance can be found in Prolexic's latest white paper, "Planning for and Validating a DDoS Defense Strategy," which can be downloaded for a limited time from www.prolexic.com/planning.

About Prolexic
Prolexic is the world's largest, most trusted Distributed Denial of Service (DDoS) mitigation provider. Able to absorb the largest and most complex attacks ever launched, Prolexic restores mission-critical Internet-facing infrastructures for global enterprises and government agencies within minutes. Ten of the world's largest banks and the leading companies in e-Commerce, SaaS, payment processing, travel/hospitality, gaming and other at-risk industries rely on Prolexic to protect their businesses. Founded in 2003 as the world's first in-the-cloud DDoS mitigation platform, Prolexic is headquartered in Hollywood, Florida and has scrubbing centers located in the Americas, Europe and Asia. To learn more about how Prolexic can stop DDoS attacks and protect your business, please visit http://www.prolexic.com/, follow us on LinkedIn, Facebook, Google+ , YouTube , and @Prolexic on Twitter.