US college hit by 54-hour Mirai DDoS attack

New Mirai variant unleashed a 30,000 RPS storm higher education institution

A university in the US was hit by a 54-hour, non-stop DDoS attack at the end of last month, apparently caused by a Mirai-powered botnet.

News of the attack comes from data and application security firm Imperva, which counts the targeted college as a customer. According to a blog post by Dima Bekerman, a security researcher at Imperva, the attack started in the early hours of the morning on 28 February, with the average traffic flow clocking in at over 30,000 requests per second (RPS), although a peak of about 37,000 RPS was seen. Over the course of the attack, more than 2.8 billion requests were generated.

"Based on a number of signature factors, including header order, header values and traffic sources, our client classification system immediately identified that the attack emerged from a Mirai-powered botnet," said Bekerman.

"Our research showed that the pool of attacking devices included those commonly used by Mirai, including CCTV cameras, DVRs and routers. While we don't know for sure, open telnet (23) ports and TR-069 (7547) ports on these devices might indicate that they were exploited by known vulnerabilities."

Upon further investigation, Bekerman and his colleagues found 56% of the IPs used in the attack belonged to DVRs manufactured by a single vendor, which has now been contacted by Imperva.

Neither the name of the college involved, nor the DVR maker have been revealed.

Bekerman said there are several things that set this attack apart from others using Mirai.

The first is that the DDoS bots used in the attack "were hiding behind different user-agents than the five hardcoded in the default Mirai version".

"This and the size of the attack itself led us to believe that we might be dealing with a new variant, which was modified to launch more elaborate application layer attacks," said Bekerman.

The second is the sheer length of the onslaught.

"With over 90% of all application layer assaults lasting under six hours, an attack of this duration stands in a league of its own," he said.

Featured Resources

Edge-enabled mobility of the future

Turning vehicle data into value

Download now

Modern networking for the borderless enterprise

Five ways top organisations are optimising networking at the edge

Download now

Address multi-cloud configuration risks

Cloud security challenges and how to overcome them

Watch now

The total economic impact of IBM Security Verify

Cost savings and business benefits enabled by IBM Security Verify

Download now

Recommended

How to enable private browsing on any device
privacy

How to enable private browsing on any device

8 Mar 2021
IT security awareness and training firm KnowBe4 acquires MediaPRO
Acquisition

IT security awareness and training firm KnowBe4 acquires MediaPRO

3 Mar 2021
High-risk email security threats increased by 32% last year
phishing

High-risk email security threats increased by 32% last year

3 Mar 2021
The top 12 password-cracking techniques used by hackers
Security

The top 12 password-cracking techniques used by hackers

3 Mar 2021

Most Popular

UK gov flip-flops on remote work, wants it a standard for all jobs
flexible working

UK gov flip-flops on remote work, wants it a standard for all jobs

5 Mar 2021
Star Alliance passenger data stolen in SITA data breach
data breaches

Star Alliance passenger data stolen in SITA data breach

5 Mar 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

26 Feb 2021