Security News > 2023 > October > New DDoS Attack is Record Breaking: HTTP/2 Rapid Reset Zero-Day Reported by Google, AWS & Cloudflare
Find out what security teams should do now, and hear what Cloudflare's CEO has to say about this DDoS. Google, AWS and Cloudflare have reported the exploitation of a zero-day vulnerability named HTTP/2 Rapid Reset and tracked as CVE-2023-44487, which is currently used in the wild to run the largest Distributed Denial of Service attack campaigns ever seen.
The HTTP/2 Rapid Reset attack works by leveraging HTTP/2's stream cancellation feature: The attacker sends a request and cancels it immediately.
Cloudflare reported a peak at 201 million requests per second and mitigated more than 1,100 other attacks with more than 10 million RPS, and 184 attacks greater than the previous DDoS record of 71 million RPS. Google reported the biggest attack, which reached a peak of 398 millions RPS using the HTTP/2 Rapid Reset technique.
As stated by Google in its blog post about the DDoS attack, "For a sense of scale, this two minute attack generated more requests than the total number of article views reported by Wikipedia during the entire month of September 2023.".
Figure B. When we asked CloudFlare CEO and co-founder Matthew Prince about the number of bots needed to launch such attacks, he said that it needed, "Between 10,000 - 20,000 nodes in the botnet, which is relatively small. That's concerning because botnets today with hundreds of thousands or millions of nodes are common. And this attack should scale linearly with the number of nodes in the botnet. It may be possible to generate an attack larger than the estimated legitimate traffic volume of the web but all focused on a single victim. That's something that even the largest organizations would not be able to handle without appropriate mitigation."
From another Cloudflare blog post: "Because the attack abuses an underlying weakness in the HTTP/2 protocol, we believe any vendor that has implemented HTTP/2 will be subject to the attack. This included every modern web server."
News URL
https://www.techrepublic.com/article/http2-rapid-reset-ddos-attack/
Related news
- Cloudflare blocks largest recorded DDoS attack peaking at 3.8Tbps (source)
- Cloudflare Thwarts Largest-Ever 3.8 Tbps DDoS Attack Targeting Global Sectors (source)
- Google fixes two Android zero-days used in targeted attacks (source)
- Rackspace monitoring data stolen in ScienceLogic zero-day attack (source)
- CUPS vulnerabilities could be abused for DDoS attacks (source)
- Google Adds New Pixel Security Features to Block 2G Exploits and Baseband Attacks (source)
- Recently patched CUPS flaw can be used to amplify DDoS attacks (source)
- Largest Recorded DDoS Attack is 3.8 Tbps (source)
- New Gorilla Botnet Launches Over 300,000 DDoS Attacks Across 100 Countries (source)
- Qualcomm patches high-severity zero-day exploited in attacks (source)