A 100 Gbit/s DDoS attack, beaten in 10 minutes

One day a system administrator at our client received an extraordinary e-mail. A group calling itself “DD4BC” threatened to launch a powerful DDoS attack on the company’s site unless it paid, and gave it one day.

“Your sites are going under attack unless you pay 25 Bitcoin. […] We are giving you 24 hours to get it and pay us.”

Nobody replied, and nobody paid.

The next day the attack started, as promised. The attackers used the client’s IP addresses as targets for a UDP amplification attack against its uplinks.

Comparing normal daily traffic with traffic during the attack, the network was taking roughly 100 Gbit/s of load. A traffic dump showed about 120,000 infected nodes producing it, a measure of how much firepower an average DDoS group has at hand.

Because the target was an IP address, we used BGP to send the attack traffic nowhere:

1. Captured all traffic hitting the router uplinks during the attack.
2. Applied BGP blackhole communities for the attacked IP addresses, so the traffic was discarded at the edge routers of the upstream Tier 1 ISPs.
3. Brought the website up on other uplinks and routed it through Cloudflare to protect the infrastructure from the UDP flood.

The attack was beaten in 10 minutes. The site stayed online behind Cloudflare, no ransom was paid, and the client’s infrastructure was protected from further UDP floods.

24/7 emergency IT support →
Managed IT services →