Week long, 20 wave DDoS attacks thwarted by Radware

The cyber security world is in turmoil. A new generation of aggressive, layer 7 (L7), HTTPS Flood attacks, also known as Web DDoS Tsunami attacks, is disrupting the market by bypassing organisations' traditional DDoS protection and web application firewall (WAF) solutions. 

The destructive attacks, which roll out in multiple waves, last for days, hit with ultra-high volumes, and are aimed at wearing down an organisation's security team. They also masquerade as legitimate traffic, making them very difficult to detect and mitigate.

Recently, my company took on one of these attacks to defend a customer and major global business. The attack started with a ransom demand and evolved daily with more attacks and demands.

This is what we encountered: 

• Ultra-high volumes: Some attack waves peaked at nearly two million requests per second (RPS).
• Persistent and long attacks: Over the course of seven days, we observed nearly 20 different waves. Some lasted several hours, reaching over 10 billion requests in aggregate.
• Complex attacks: They were encrypted and crafted as HTTPS GET requests, posing as legitimate web requests.

In the news, we often see attacks making headlines over huge RPS numbers. What makes this new breed of attack and recent attack campaign unique is the dangerous combination of volume, plus duration and complexity.

As part of their latest campaigns, hackers are combining network and application layer attacks and using new tools to create these giant L7 DDoS Tsunamis. To elude detection, the attacks leverage multiple evasion techniques, such as randomising HTTP headers, cookies, spoofing IPs, and more.

Defending against this combination during a prolonged period of attack calls for more than traditional rate-limiting solutions. The reality is traditional mitigation tools based on pre-existing signatures, or rate-based detections are not built to protect against these attacks.

Network-based DDoS protection cannot detect and mitigate L7 DDoS attacks. Standard on-prem or cloud-based WAFs fail to keep up with the scale and randomisation. And rate-limiting techniques have a major negative impact on legitimate traffic. 

As a result, companies are being caught off guard. Without a behavioural-based approach and automated real-time signatures, standard protections are simply overwhelmed and outmaneuvered, and businesses are left vulnerable.

To defend against this emerging generation of DDoS attacks, companies need to start thinking differently about mitigation solutions. To mitigate automated offensive cybersecurity activity, organisations must deploy defensive automation capabilities.

This includes behavioural-based algorithms that can automatically detect and quickly generate new signatures for unknown malicious requests at a high scale, on the fly, and in real-time without generating false positives and blocking legitimate traffic.

The level of service and support that back the solution is also important, especially now when so many security teams are running lean.

The evolution of the DDoS attack might not be new, but the debut of the Web DDoS Tsunami represents a whole new level of sophisticated attacks and emboldened actors.