Slashdot Mirror

← Back to Stories (view on slashdot.org)

Bigger Than Mirai: Leet Botnet Delivers 650 Gbps DDoS Attack (betanews.com)

Posted by msmash on from the security-woes dept.

Reader Mark Wilson writes: Earlier in the year, a huge DDoS attack was launched on Krebs on Security. Analysis showed that the attack pelted servers with 620 Gbps, and there were fears that the release of the Mirai source code used to launch the assault would lead to a rise in large-scale DDoS attacks. Welcome Leet Botnet. In the run-up to Christmas, security firm Imperva managed to fend off a 650 Gbps DDoS attack. But this was nothing to do with Mirai; it is a completely new form of malware, but is described as "just as powerful as the most dangerous one to date". The concern for 2017 is that "it's about to get a lot worse". Clearly proud of the work put into the malware, the creator or creators saw fit to sign it. Analysis of the attack showed that the TCP Options header of the SYN packets used spelled out l33t, hence the Leet Botnet name.

3 of 74 comments (clear)

  1. Internet of shit strikes again! by Desler · · Score: 5, Insightful

    Should rename these from IoT devices to Internet of DDoS devices.

  2. DDOS has had its 15 minutes by xanthos · · Score: 3, Insightful

    Ok, everybody who was effected by this raise your hands! Anybody?

    These DDOS attacks are mildly interesting but irrelevant in the grander scheme of things. Given the nature of the attack payloads, it probably would have been effective at less than 100 Gbps so why hype the new high watermark? AFAIK, DDOS isn't a huge money maker so this isn't a threat in the same league as ransomware.

    Quit trying to promote vandalism as news and maybe, just maybe it will become less interesting a thing to do.

    --
    Average Intelligence is a Scary Thing
  3. Re:Not a huge number by Anonymous Coward · · Score: 3, Interesting

    > This is a big attack as attacks go but not really pushing a well-built network.

    This attack is 5% _larger_ than the one that was directed at Krebs's site. Krebs was forced offline because the provider that was keeping his site up could no longer do so pro-bono, and there was no way in hell he could pay market rate for those services: https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/

    Also, the attack against Krebs's site was -prior to this most recent one- the largest reported DDoS, ever. So... yeah, not only is this "a big attack as attacks go", it is _the biggest attack_.