Github weathers world's largest DDoS attack

The site had just ten minutes of downtime

Github has weathered the biggest DDoS attack in history with just 10 minutes of downtime, according to new reports.

The code-sharing site was subjected to a colossal 1.35Tbits/sec surge in traffic, as unknown hackers attempted to take the platform offline. The attack was foiled by Akamai Prolexic's anti-DDoS protections, which Github automatically activated shortly after detecting the spike in traffic.

"We understand how much you rely on GitHub and we know the availability of our service is of critical importance to our users," said Github site reliability engineering manager Sam Kottler in a blog post detailing the incident. "To note, at no point was the confidentiality or integrity of your data at risk."

"Making GitHub's edge infrastructure more resilient to current and future conditions of the internet and less dependent upon human involvement requires better automated intervention. We're investigating the use of our monitoring infrastructure to automate enabling DDoS mitigation providers and will continue to measure our response times to incidents like this with a goal of reducing mean time to recovery," he said.

The attack appears to be the largest on record, surpassing the previous record-holder, a 1.2Tbits/sec onslaught launched against Dyn in 2016.

While the attack on Github was larger in volume, the Dyn DDoS was both more sustained and more effective, knocking out internet connections and major websites across large portions of the US for many hours.

The Github attack, by contrast, was called off by the perpetrators after just eight minutes, which may indicate that the incident was merely a test of the hackers' capabilities.

As opposed to the Dyn attack and other major DDoS attacks, this incident did not involve the use of a malicious botnet like Mirai or Reaper. Instead, the hackers used a relatively new form of DDoS, which involves exploiting poor authentication on memcached servers.

Memcached servers are used for database caching, and are intended to help speed up website. But if left publicly exposed online, hackers can use them to carry out DDoS attacks by spoofing a target's IP address and querying the servers with specific commands.

The servers will then respond with a data packet that can be up to fifty times larger than the size of the request, allowing attackers to swamp targets in vast amounts of traffic with ease. Experts estimate that there are around 100,000 unprotected memcached servers sitting online that can be exploited in this manner.

"This massive DDoS attack was possible because organisations operating memcached servers failed to implement some very basic security practices," said Synopsys principal scientist Sammy Migues.

"The impact was minimal because GitHub was commendably prepared to survive an attack much larger than this. Unless the unwitting operators of these memcached servers take corrective action, it is inevitable that other ill-equipped targets will fall victim to similar DDoS attacks and suffer a much longer outage."

According to Ashley Stephenson, CEO of Corero Network Security, this attack also demonstrates the speed with which the cyber criminal community will jump on any new vulnerability.

"It is just a few days since the memcached reflection/amplification vulnerability became widely known. Within a week the largest DDoS ever reported lands on our doorstep, an event that will make mainstream news," explained Stephenson. 

"Meanwhile, Corero has observed a steady ramp in the past few days of memcached based attacks on the wider community. The terabit attack will grab the 'biggest and baddest' headlines casting a shadow that will obscure the thousands of businesses worldwide that have been hit with smaller but equally disruptive DDoS attacks leveraging the memcached vector during the past week."

This isn't the first time Github has been the victim of a DDoS attack - the company was also hit by an attack in 2015, which are believed to have been orchestrated by the Chinese government.

Featured Resources

Navigating the new normal: A fast guide to remote working

A smooth transition will support operations for years to come

Download now

Leading the data race

The trends driving the future of data science

Download now

How to create 1:1 customer experiences at scale

Meet the technology capable of delivering the personalisation your customers crave

Download now

How to achieve daily SAP releases

Accelerate the pace of SAP change to support your digital strategy

Download now

Recommended

8 most secure web browsers
web browser

8 most secure web browsers

25 Sep 2020
Your essential guide to internet security
Security

Your essential guide to internet security

23 Sep 2020
How to enable private browsing on any device
privacy

How to enable private browsing on any device

22 Sep 2020
Third-party apps are tracking your WhatsApp activity
social media

Third-party apps are tracking your WhatsApp activity

21 Sep 2020

Most Popular

Windows XP source code allegedly leaked online
Microsoft Windows

Windows XP source code allegedly leaked online

25 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

16 Sep 2020