Google blocked the largest DDoS attack in history with the help of its cloud service

Google reported that he managed to block the largest DDoS attack June 1st stories through his service Cloud. The tech firm said this denial-of-service attack reported a whopping 46 million requests per second.

Through it official blog, Google cloud He mentioned that this particular attack was 76% larger than the previous record, and to give users an idea of ​​its scale, he compared it to receiving all daily requests from Wikipedia – one of the 10 most visited websites in the world – in just 10 seconds.

Google Cloud succeeded in blocking a destructive attack

The company explained that its services Adaptive Cloud Armor Protection was able to detect and analyze traffic in the early stages of the attack life cycle. cloud armor alerted the client with a recommended protection rule that was deployed before the attack reached its maximum scale. The service blocked the attack after making sure that the client service remained online and continued to serve its end users.

They appeared on the attack 5256 IP addresses from 132 different countries who contributed to the attack. The first four countries account for approximately 31% of all attack traffic. The attack used encrypted requests, the generation of which would require additional computing resources.

Approximately 22% (1169) of IP addresses corresponded to exit nodes Thoralthough the volume of requests originating from these nodes is only 3% of the attack traffic. Google considers Tor’s involvement in the attack to be coincidental due to the nature of the vulnerable services, even at a 3% spike. The analysis shows that Tor exit nodes can send a significant amount of unwanted traffic to web applications and services.

The geographic distribution and types of insecure services used to create an attack are similar to a family of attacks. merisknown for his massive attacks that broke records DDoS. Method meris It uses insecure proxy servers to hide the true origin of the attacks.

Google Cloud method to block attack

Google details that the attack was stopped at the edge of their network and malicious requests were blocked on top of the client application. Before the attack began, the victim had already configured the function Adaptive Protection in your respective security policy cloud armor to study and compare normal traffic patterns for your service.

Thereby, Adaptive Protection was able to detect DDoS attack early in its life cycle, analyze incoming traffic and create alerts with a recommended protection rule, all before an attack escalates. The affected party responded to the alert by deploying the recommended rule, using the recently launched service rate limiting feature to limit attack traffic. He chose the “throttle” option instead of the “deny” action to reduce the impact on his actual traffic, severely limiting the possibility of an attack.

When the attack peaked at 46 million requests, the rule proposed cloud armor already worked to block most of DDoS attack and ensure that targeted applications and services remain available.

We recommend you METADATA, an RPP tech podcast. News, analytics, reviews, recommendations and everything you need to know about the world of technology. To hear better, #StayHome.