GitHub was hit by a record 1.35-terabyte-per-second denial-of-service attack. So far until this moment, this was the most powerful DDoS attack ever recorded. But the website only endured a few minutes of intermittent downtime.
DDoS attack is one of the most common method used by hackers to take websites down. To initiate the attack, the hackers bombard a targeted website with more traffic than its server(s) can handle. As a result, the server will crash, taking the site offline.
In GitHub's case, the 126.9 million packets per second attack only made the website down for a total of 10 minutes.
After detecting the attack, Akamai Prolexic, a service that mitigates such incidents, handled the data by re-routing the huge traffic through its larger network and also blocking malicious requests.
The hackers that realized their efforts didn't go as expected, withdrew after less than an hour.
According to GitHub:
What makes the attack unique is that no botnets were involved. Usually DDoS incidents use a lot of botnets to aid the simultaneous attack. But when attacking GitHub, the hackers used what's known as "memcrashing" which uses an amplification attack.
Here, the hackers spoofed GitHub's IP address and repeatedly sends byte-sized (UDP) requests to memcached servers that are used to speed up database. The targeted servers were those that have been left open to the public internet with no authentication requirements in place. After being compromised, the hackers can then use those servers to amplify the returned data by a factor of 50 from those requests, and target all of them to GitHub.
But here, GitHub was prepared in the first place, for the very least. Here is what Josh Shaul, vice president of web security at Akamai, said:
"So I would have been certain that we could handle 1.3 Tbps, but at the same time we never had a terabit and a half come in all at once. It’s one thing to have the confidence. It’s another thing to see it actually play out how you’d hope."
According to Akamai, others can also mitigate this memcache-based amplification attacks by setting up an incoming rate-limit on port 11211.
"Because of its ability to create such massive attacks, it is likely that attackers will adopt memcached reflection as a favorite tool rapidly. Additionally, as lists of usable reflectors are compiled by attackers, this attack method's impact has the potential to grow significantly."
The last attack at this scale happened in October 2016 when 1.2Tbps DDoS hit Dyn and caused connectivity issues across the U.S..
