HTTP/2 Protocol Exploited in Largest DDoS Attack Ever

By

The attack relies on a novel HTTP/2 “Rapid Reset” technique.

Google, Cloudflare, and Amazon Web Services have revealed a new zero-day vulnerability known as “HTTP/2 Rapid Reset.”

Attacks exploiting the vulnerability targeted cloud and Internet infrastructure providers and peaked in August. “These attacks were significantly larger than any previously reported Layer 7 attacks, with the largest attack surpassing 398 million requests per second,” Google says.

The attack used a novel “Rapid Reset” technique leveraging the stream multiplexing feature of the widely implemented HTTP/2 protocol.

See further analysis at Google Cloud.

 
 
 

 
 
 

10/12/2023
attack , cloud , DDoS , Security , vulnerability

Related content

  • Lead Image © leksustuss, 123RF.com
    Distributed denial of service attacks from and against the cloud
    In some particularly sophisticated DDoS attacks, the attackers rely on and target the cloud, allowing attackers to work around conventional defense mechanisms. We explain how a DDoS attack in the cloud works, and how you can defend against it.
    more »
  • News for Admins
    In the news: Red Hat Announces Ansible Lightspeed with IBM watsonx Code Assistant; Dell APEX Cloud Platform for Red Hat OpenShift Announced; NSA Offers Best Practices for OSS in Operational Technology Environments; Civil Infrastructure Platform Adds New Super-Long-Term Linux Kernel; HTTP/2 Protocol Exploited in Largest DDoS Attack Ever; Docker Announces Three New Products for Secure App Delivery; CloudBees Updates Jenkins and Offers New DevSecOps Platform; Linkerd 2.14 Released with Improved Multi-Cluster Support; NIST Releases Draft of Cybersecurity Framework v2.0; CISA and MITRE Announce Open Source Caldera for OT
    more »
  • Denial of Service in the Cloud

    In some particularly sophisticated DDoS attacks, the attackers rely on and target the cloud, which allows them to work around conventional defense mechanisms. We explain how a DDoS attack in the cloud works, and how you can defend against it.

    more »
  • Lead Image © Russell Shively, 123RF.com
    Denial of service defense
    Slowloris can help you harden your web servers against denial-of-service attacks that restrict the availability of web services.
    more »
  • News for Admins
    News for system administrators around the world.
    more »
comments powered by Disqus