In the vast realm of cybersecurity, organizations often find themselves at the forefront of relentless attacks which test their defenses and resilience. CloudSEK has recently found itself plunged into the depths of a massive Distributed Denial of Service (DDoS) attack. As the digital onslaught intensifies, CloudSEK's dedicated team of experts are diligently working to thwart the attackers and safeguard their systems. However, this attack comes at a time when CloudSEK discovered a serious threat facing the Android ecosystem —a supply chain breach affecting millions of users. In this blog post, we delve into the gripping tale of CloudSEK's battle against the DDoS assault, revealing the critical importance of a robust cybersecurity posture in today's interconnected world.

Understanding DDoS : The Disruptive Force Targeting Organizational Systems

Distributed Denial of Service (DDoS) attacks reign supreme as a formidable weapon employed by malicious actors to wreak havoc on organizational systems. Understanding the nature of DDoS is crucial in comprehending the scale of its impact and the urgency it demands in today's digital age.

What is DDoS?

DDoS, short for Distributed Denial of Service, is a malicious attack in which multiple compromised devices, often forming a botnet, are orchestrated to flood a target system or network with an overwhelming volume of traffic. This influx of traffic inundates the system's resources, rendering it incapable of responding to legitimate user requests.

Impact on Systems

The effects of a DDoS attack can be catastrophic for organizations. It leads to a significant degradation in system performance, resulting in slow or unresponsive websites, inaccessible online services, and disrupted business operations. The loss of availability not only causes financial losses but also tarnishes an organization's reputation and erodes customer trust.

Creation of DDoS Attacks

Perpetrators employ various techniques to launch DDoS attacks. These include leveraging botnets, compromised devices infected with malware, and even employing amplification techniques like DNS reflection or SYN flood attacks. Attackers exploit vulnerabilities in the network infrastructure, web applications, or the Internet of Things (IoT) devices, to initiate a sustained barrage of traffic aimed at overwhelming the target system.

Impact on End Servers

End servers, the targets of DDoS attacks, bear the brunt of the assault. The massive influx of traffic overloads the server's processing capacity, exhausting its computational resources, network bandwidth, or application layer capabilities. As a result, legitimate user requests are denied, leading to service interruptions, unresponsiveness, or even complete system downtime.

The Process of DDoS

During a DDoS attack, the targeted organization experiences a significant surge in incoming traffic which is well beyond its capacity to handle. The influx may consist of different types of traffic, such as volumetric attacks that flood the network, application layer attacks that target specific services, or protocol attacks that exploit weaknesses in network protocols. This sustained onslaught consumes system resources, preventing legitimate traffic from reaching its intended destination.

Significance of the Attack for Organizations

DDoS attacks pose a grave concern for organizations due to their potential for severe disruption. Beyond the immediate financial implications, such attacks can result in reputational damage, customer attrition, and legal consequences. Additionally, organizations may face extortion attempts, where attackers demand ransom to cease the attack. Moreover, DDoS attacks are often used as a smokescreen to divert attention from other security breaches or to test an organization's security posture, highlighting the critical need for robust defense mechanisms.

Targeted by Chaos: CloudSEK's Encounter with the DDoS Onslaught

In an unprecedented turn of events, CloudSEK found itself under siege by a relentless DDoS attack starting on May 31st, 2023. The magnitude of the assault became evident as our servers were inundated with an excessive volume of malicious traffic. We present the factual numbers behind this audacious attack to provide a better understanding of the challenge CloudSEK faced.

Total Requests Received

Within a span of 72 hours, CloudSEK's servers experienced an unprecedented surge in incoming requests with the number skyrocketing to an astounding 1.62 Billion which served a total 4TB of data. Such a barrage of requests exceeded the Webflow hosting server's capacity in the tier we were at to handle them effectively, resulting in severe performance degradation and a significant slowdown of services. Ofcourse we could shift to a higher teir of Webflows offering but that would not solve the problem

Unique IP Addresses Used for the Attack 

Analyzing the attack patterns further revealed a staggering number of unique IP addresses involved in the assault. Over 6.38 Million distinct IP addresses were identified as sources of the attack, indicating a highly distributed nature. This strategy allowed the attackers to amplify their impact by leveraging a large botnet of compromised devices, making it more challenging to mitigate the attack effectively.

Countries from which the Offensive Originated

A noteworthy aspect of this DDoS attack was the diverse geographical origin of the malicious traffic. Notably, a significant portion of the traffic originated from India, accounting for a majority of the total requests followed by Pakistan, Nepal, Bangladesh and the UAE. This broad international distribution of attack sources further complicated the defense and mitigation efforts for CloudSEK.

As the attack continued to unfold, CloudSEK swiftly sprang into action, implementing robust traffic filtering mechanisms, scaling up our server infrastructure, and collaborating with network service providers to mitigate the offensive. Our security operations center worked round the clock, analyzing traffic patterns, identifying anomalous behavior, and deploying sophisticated countermeasures to fend off the attack.

Riding the Storm: CloudSEK's Strategic Response to the DDoS Attack

Mitigating a DDoS attack requires a multi-layered approach that combines various defensive strategies. In the face of the relentless assault on CloudSEK's infrastructure, the cybersecurity team swiftly implemented several effective mitigation methods to neutralize the threat. We explore the key strategies employed by CloudSEK to fend off the DDoS attack.

1. Web Application Firewall (WAF) and Pattern Matching

CloudSEK leveraged a powerful Web Application Firewall (WAF) as the first line of defense against the DDoS onslaught. The WAF employed an intelligent pattern matching mechanism to identify and block malicious requests. By analyzing the user agent, a field in the HTTP header that identifies the client making the request, CloudSEK detected a consistent pattern indicating that a significant portion of the attack traffic originated from Android emulators.

By crafting a pattern-matching rule, such as "http.user_agent contains '<host-pattern>'," CloudSEK effectively blocked requests from these emulators. This proactive measure prevented the influx of requests from Android emulators that were likely part of the botnet orchestrating the attack. Through continuous monitoring and refining of pattern-matching rules, we successfully thwarted a substantial portion of the DDoS traffic and safeguarded our systems.

2. URI Path Blocking

Another important mitigation method employed by CloudSEK involved identifying a pattern exploited by the attackers in the URI path of their requests. The attackers were attempting to hit URIs with random numbers appended to them, such as "/<6……yw>". This tactic aimed to evade browser caching mechanisms, ensuring that each unique request from the agent reached the server, thereby intensifying the DDoS attack.

To counter this strategy, CloudSEK implemented URI path blocking. By crafting a rule like "http.request.uri.path contains '/<regex>'," the team effectively identified and blocked requests with these randomized URIs. This measure mitigated a significant portion of the attack traffic, as the requests carrying random numbers were denied at the initial stage, reducing the strain on CloudSEK's server infrastructure.

3. Query Matching or Pattern Matching based on URL Query 

The DDoS attack on CloudSEK also involved the bombardment of our services with requests containing random queries in the URL, such as "http.request.uri contains '/search?query=<regex>'." This attack vector not only targeted the web application layer but also impacted the internal microservices, causing further disruption.

To counter this type of attack, CloudSEK employed query matching or pattern matching rules. By detecting the specific pattern in the query part of the URL, CloudSEK was able to identify and block the requests carrying random queries. This method significantly reduced the impact on internal microservices, ensuring the stability and availability of critical resources.

4. Rate Limiting Rules

While rate limiting rules can be an effective mitigation method in certain DDoS scenarios, CloudSEK encountered challenges with their implementation in this particular attack. The diverse nature of IP addresses used by the attackers from various countries made it difficult to impose effective rate limits. As the attack traffic originated from numerous IP addresses, each with a relatively low request rate, traditional rate limiting rules proved less impactful in mitigating the assault. Nonetheless, CloudSEK's security team continuously monitored the traffic and adapted their defense strategies to address emerging patterns and ensure optimal protection.

From Vulnerability to Vigilance : CloudSEK's SVigil Empowers DDoS Attack Mitigation

A key thing to note is that the DDoS attack was conducted on CloudSEK’s publicly known infrastructure - namely, the website. Due to our robust security posture, the attackers could not target our services hosted elsewhere, and hence, our client-facing services continued uninterrupted.

However, many organizations face crippling DDoS attacks which bring their internal infrastructure down due to their private infrastructure details being accessed by attackers. SVigil, CloudSEK’s Digital Supply Chain Monitoring solution, is one way of ensuring this does not happen. By comprehensively fingerprinting and monitoring an organization’s infrastructure, SVigil ensures private infrastructure details remain private and that a DDoS attack cannot be mounted on these critical networks and infrastructure.  

Let’s get a sneak peek into how SVigil aids organizations in mitigating the risk of DDoS attacks through its comprehensive vulnerability detection and proactive security measures.

Diagnosing High Load Pages

‍
Firstly, SVigil is capable of identifying and listing down pages that have high response times and sizes. Consider a typical e-commerce website with a complex product search feature. This function may pull a large amount of data and return a considerable payload, causing significant server load. If this high-load endpoint is attacked with a flood of requests, it could lead to a DDoS scenario. SVigil's comprehensive scans can detect such resource-intensive endpoints, enabling organizations to optimize their services and put protective measures in place.

Detecting Unauthenticated Upload Panels

‍
SVigil can also identify potential choke points like unauthenticated upload panels. For instance, an open-source project hosting site might allow users to upload large files without any authentication. This, in turn, can be exploited by malicious actors to upload excessively large files repeatedly, thereby consuming significant bandwidth and processing power and leading to a DDoS attack. SVigil's continuous scanning and assessment can proactively detect such vulnerabilities, allowing for timely remediation.

Uncovering Exposed Debug and Statistics Pages

‍
A commonly overlooked aspect is the exposure of statistics and debug pages. These pages, such as those used by HAProxy, Nginx, Grafana, and Prometheus, often contain detailed information about the system's network and processing capacities. If left exposed, attackers can leverage this information to tailor a DDoS attack that exploits the system's specific weaknesses. For instance, a tech company might leave their Grafana monitoring dashboard unprotected. SVigil can detect such misconfigurations and alert the organization, enabling them to secure these pages.

Identifying Outdated Technologies

‍
Running outdated technologies is a security risk that can lead to DDoS vulnerabilities. Take, for example, a business running an old version of WordPress with known vulnerabilities that could be exploited in a DDoS attack (such as CVE-2018-6389). SVigil can identify these vulnerabilities and prompt the organization to update their systems, thereby mitigating the risk of such attacks.

Exposing Vulnerable APIs

‍
In addition, SVigil can detect exposed APIs that allow for intensive database queries. An API that permits complex queries without adequate rate-limiting or access controls can be a prime target for DDoS attacks. For instance, a public-facing API that allows users to pull extensive user data could be repeatedly queried, causing significant strain on the database and potentially leading to a DDoS scenario. SVigil's robust scanning capabilities can identify these exposed APIs and alert the organization to the potential risk.

Conclusion 

In conclusion, the DDoS assault on CloudSEK highlighted the relentless nature of such attacks and the critical need for organizations to remain vigilant and fortified against evolving threats. The combination of a massive number of requests, the involvement of numerous IP addresses, and the international distribution of attack traffic posed a significant challenge for CloudSEK. We are actively mitigating the DDoS attack through a combination of intelligent pattern matching with WAF, URI path blocking, query matching, and continuous monitoring. Rest assured, we will provide regular updates on the status of the attack and our ongoing efforts to combat it. Our priority remains to safeguard our systems and ensure uninterrupted services for our valued clients.

‍