Answer to Question #314130 in Computer Networks for Junaid

Question

According to Recent Media, Amazon Web Services recently had to defend against a DDoS assault with a peak traffic level of 2.3 Tbps, the most ever recorded. According to Amazon's Q1 2020 threat report, the incident happened in February and was neutralized by AWS Shield, a solution meant to protect users of Amazon's on-demand cloud computing platform against DDoS attacks, malicious bots, and application vulnerabilities. The corporation did not reveal the attack's aim or its source.

Your task is to compile a complete report on the attack mentioned above, considering the following criteria.

-Attack Mechanism.

-Impact of the Attack.

-Mitigation Techniques applied by the organization.

-As a cyber security officer, what will be your strategy to encounter such scale of the attack.

Answer 1

Amazon Web Services recently had to defend against a DDoS attack with a peak traffic volume of 2.3 Tbps, the largest ever recorded, ZDNet reports. Detailing the attack in its Q1 2020 threat report, Amazon said that the attack occurred back in February, and was mitigated by AWS Shield, a service designed to protect customers of Amazon’s on-demand cloud computing platform from DDoS attacks, as well as from bad bots and application vulnerabilities. The company did not disclose the target or the origin of the attack.

To put that number into perspective, prior to February of this year, ZDNet notes that the largest DDoS attack recorded was back in March 2018, when NetScout Arbor mitigated a 1.7 Tbps attack. The previous month, GitHub disclosed that it had been hit by an attack with a peak of 1.35 Tbps.

February’s attack was a so-called “reflection attack.” As Cloudflare explains, the attempt here is to use a vulnerable third-party server to amplify the amount of data being sent to a victim’s IP address. It mainly relied on exploiting CLDAP servers to amplify its traffic. Attacks using this protocol, which is normally used to access and edit directories shared over the internet, have been taking place since 2016, ZDNet notes.

Amazon said that between Q2 2018 and Q4 2019, the largest attacks it saw were smaller than 1 Tbps, and that in the first quarter of this year 99 percent of attacks were 43 Gbps or smaller. ZDNet notes that the 2018 attacks relied on exploiting a new Memcached attack vector, but says that in the years since, internet service providers and content delivery networks have worked to secure Memcached servers that are vulnerable to being exploited.