What was the largest* DDoS attack of all time?
The biggest DDoS attack to date took place in February of 2018. This attack targeted GitHub, a popular online code management service used by millions of developers. At its peak, this attack saw incoming traffic at a rate of 1.3 terabytes per second (Tbps), sending packets at a rate of 126.9 million per second.
This was a memcached DDoS attack, so there were no botnets involved. Instead the attackers leveraged the amplification effect of a popular database caching system known as memcached. By flooding memcached servers with spoofed requests, the attackers were able to amplify their attack by a magnitude of about 50,000x!
Luckily, GitHub was using a DDoS protection service, which was automatically alerted within 10 minutes of the start of the attack. This alert triggered the process of mitigation and GitHub was able to stop the attack quickly. The world’s largest DDoS attack only ended up lasting about 20 minutes.
*It should also be noted that there was an alleged 1.7tbps DDoS attack 5 days after the attack on GitHub. However the victim of this attack was never publicly disclosed and there was not very much information released about it, making it difficult to verify.
What are some other famous DDoS attacks?
The 2016 Dyn attack
The second biggest DDoS attack was directed at Dyn, a major DNS provider, in October of 2016. This attack was devastating and created disruption for many major sites, including AirBnB, Netflix, PayPal, Visa, Amazon, The New York TImes, Reddit, and GitHub. This was done using a malware called Mirai. Mirai creates a botnet out of compromised Internet of Things (IoT) devices such as cameras, smart TVs, radios, printers, and even baby monitors. To create the attack traffic, these compromised devices are all programmed to send requests to a single victim.
Fortunately Dyn was able to resolve the attack within one day, but the motive for the attack was never discovered. Hacktivist groups claimed responsibility for the attack as a response to WikiLeaks founder Julian Assange being denied internet access in Ecuador, but there was no proof to back up this claim. There are also suspicions that the attack was carried out by a disgruntled gamer.
The 2015 GitHub attack
The largest DDoS attack ever at the time, this one also happened to target GitHub. This politically motivated attack lasted several days and adapted itself around implemented DDoS mitigation strategies. The DDoS traffic originated in China and it is strongly suspected that the Chinese Government oversaw the attack.
This DDoS attack specifically targeted the urls of two GitHub projects aimed at circumventing Chinese state censorship. It is speculated that the intent of the attack was to try and pressure GitHub into eliminating those projects.
The 2013 Spamhaus attack
Another largest-ever-at-the-time attack was the 2013 attack launched on Spamhaus, an organization that helps combat spam emails and spam-related activity. Spamhous is responsible for the filtering as much as 80% of all spam, which makes them a popular target to people who would like to see spam emails reach their intended recipients.
The attack drove traffic to Spamhous at a rate of 300 gbps. Once the attack began, Spamhous signed up for Cloudflare. Cloudflare’s DDoS protection mitigated the attack. The attackers responded to this by going after certain internet exchanges and bandwidth providers in an attempt to bring down Cloudflare. This attack did not achieve its goal, it did however cause major issues for LINX, the London internet exchange. The main culprit of the attack turned out to be a teenage hacker-for-hire in Britain who was paid to launch this DDoS attack.
Read more about this attack and how it was mitigated on the Cloudflare blog.
The 2000 Mafiaboy attack
In 2000 a 15-year-old hacker known as ‘Mafiaboy’ took down several major websites including CNN, Dell, E-Trade, eBay, and Yahoo, which at the time was the most popular search engine in the world. This attack had devastating consequences including creating chaos in the stock market.
Mafiaboy, who was later revealed to be a high schooler named Michael Calce, coordinated the attack by hacking into the networks of several universities and leveraging their servers to conduct the DDoS attack. The aftermath of this attack directly led to the creation of many of today’s cybercrime laws.
The 2007 Estonia attack
In April 2007 the nation of Estonia was hit with a massive DDoS attack targeted at government services as well as financial institutions and media outlets. This had a crushing effect since Estonia’s government was an early adopter of online government and was practically paperless at the time; even national elections were conducted online
The attack, considered by many to be the first act of cyber warfare, came in response to a political conflict with Russia over the relocation of the ‘Bronze Soldier of Tallinn’, a World War II monument. The Russian government is suspected of involvement and an Estonian national from Russia was arrested as the result, but the Russian government has not let Estonian law enforcement do any further investigation in Russia. This ordeal led to the creation of international laws for cyber warfare.