Stories
Slash Boxes
Comments

SoylentNews is people

posted by martyb on Wednesday October 13, @12:32AM   Printer-friendly [Skip to comment(s)]

Microsoft Azure fends off huge DDoS Attack:

Distributed Denial of Service (DDoS) attacks are happening ever more often and growing ever bigger. At 2.4 terabits per second (Tbps), the DDoS attack Microsoft just successfully defended European Azure cloud users against could be the biggest one to date.

What we know for certain is it's the biggest DDoS attack on an Azure cloud customer. It was bigger than the previous high, 2020's Azure 1 Tbps attack, and Microsoft reported it was "higher than any network volumetric event previously detected on Azure."

[...] Microsoft isn't saying which was used in this case but it did mention DNS. Attacks exploiting DNS can produce 28 to 54 times the original number of bytes. So, if an attacker sends a request payload of 64 bytes to a DNS server, they can generate over 3,400 bytes of unwanted traffic to an attack target.

While Microsoft also didn't go into detail about how it blocked the attack, the company said Azure's DDoS protection platform, built on distributed DDoS detection and mitigation pipelines, can absorb tens of terabits of DDoS attacks: "This aggregated, distributed mitigation capacity can massively scale to absorb the highest volume of DDoS threats, providing our customers the protection they need."


Original Submission

Display Options Threshold/Breakthrough Reply to Article Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
  • (Score: -1, Spam) by Anonymous Coward on Wednesday October 13, @12:36AM (1 child)

    by Anonymous Coward on Wednesday October 13, @12:36AM (#1186535)

    Whoa, no, Jews pissing off everybody and now poor Jewish interests are being questioned.

    FUCK JEW SCUM

    • (Score: -1, Spam) by Anonymous Coward on Wednesday October 13, @03:14AM

      by Anonymous Coward on Wednesday October 13, @03:14AM (#1186559)

      Wow, nazi incel wants his ass sucked?

      Maybe he is just constipated! Why do I call it a he? Well c'mon, we all know it is some virgin chud angry at the world because no woman wants to touch his racist angry dough body. You don't have to be super sexy, you don't have to have a big dick, you just have to be a not-racist-piece-of-shit that makes women scared to be around you.

      Best of luck you scummy fuck.

  • (Score: 5, Insightful) by stretch611 on Wednesday October 13, @01:57AM (2 children)

    by stretch611 (6199) Subscriber Badge on Wednesday October 13, @01:57AM (#1186544)

    From the Article:

    At 2.4 terabits per second (Tbps), the DDoS attack Microsoft just successfully defended European Azure cloud users against could be the biggest one to date.

    Who was targeted? We don't know. Microsoft isn't talking.

    Microsoft isn't saying which was used in this case but it did mention DNS.

    While Microsoft also didn't go into detail about how it blocked the attack, the company said Azure's DDoS protection platform, built on distributed DDoS detection and mitigation pipelines, can absorb tens of terabits of DDoS attacks

    For better, more comprehensive protection, Microsoft recommends you subscribe to Azure DDoS Protection Standard.

    So, other than tooting its own horn, Microsoft is not providing any details. It sounds more like marketing than a news story... We just protected against the largest ddos... but refuse to provide proof... but we can protect your website too if you buy our services and pay us for additional ddos protection.

    Of course what do I know... I'm just an IT guy that distrusts M$ so much that there is not a single microsoft product on any device in my home network. I am sure all the Pointy-haired bosses out there are salivating over this story, believing but not understanding every one of the numbers used in this "story" and will ask the IT guys why they are not using Azure yet because it is the greatest.

    --
    I think; therefore, I am vaccinated.
    • (Score: 1, Informative) by Anonymous Coward on Wednesday October 13, @02:54AM

      by Anonymous Coward on Wednesday October 13, @02:54AM (#1186550)

      Maybe Microsoft just has a (confidential) contract with Cloudflare.

      Back in the day, when MS was still calling Linux, "a cancer", If you did an OS fingerprint of www.microsoft.com (e.g., with nmap -A), it came back as running linux. MS was (quietly) using Akamai's reverse proxies to keep their IIS boxes from falling over.

    • (Score: 0) by Anonymous Coward on Wednesday October 13, @05:13AM

      by Anonymous Coward on Wednesday October 13, @05:13AM (#1186588)

      But, who is going to protect them from Micro$erft??

  • (Score: 1) by shrewdsheep on Wednesday October 13, @06:58AM (2 children)

    by shrewdsheep (5215) Subscriber Badge on Wednesday October 13, @06:58AM (#1186599)

    This is more of a general question as no details seem to be given in this particular case. I believe that once a DDOS is detected, packets will be dropped at an entry point into the network. However, if 100k hosts from a large botnet participate such mitigation seems difficult, at least with a standard Linux network stack. How can mitigation be distributed? Your valuable insights are appreciated.

    • (Score: 3, Interesting) by Anonymous Coward on Wednesday October 13, @08:29AM

      by Anonymous Coward on Wednesday October 13, @08:29AM (#1186609)

      That depends on the DDoS itself. One thing you have to keep in mind is that these providers have BIG pipes utilizing multiple physical links and different peers for the incoming traffic. The second is that the bigger the DDoS, the lower the level of the network stack where they operate or they utilize particular protocols that are prone to abuse. The third important factor is that the services providing the DDoS reflection usually doesn't appreciate being used that way and many will cooperate with your efforts or utilize their own protection. You can use all three of those factors to your advantage to mitigate DDoS attacks with the "how" depending on the particular attack in question.

      Suffice to say, the easiest way to handle this is to add a source null route to your RIB and use BGP to forward that to providers upstream. Or if they are using a small number of servers or a very public one, a phone call to the AS technical contact can go a long way and sometimes they even call you first. Or you can use a link-layer drop rule on similar traffic. It really depends, but the hardware that handles large attacks usually don't use a software stack like a Linux firewall to directly analyze each and every packet.

    • (Score: 2, Funny) by Anonymous Coward on Wednesday October 13, @11:30AM

      by Anonymous Coward on Wednesday October 13, @11:30AM (#1186614)

      >> How can mitigation be distributed? Your valuable insights are appreciated.

      Clippy: I see you're trying to networking. Would you like to subscribe to Azure Cloud Services?

  • (Score: 4, Funny) by SomeGuy on Wednesday October 13, @03:53PM (1 child)

    by SomeGuy (5632) on Wednesday October 13, @03:53PM (#1186681)

    So the real news here is that UNFORTUNATELY they survived.

    Damn.

(1)