DDoS attacks have become increasingly powerful in recent years, and consequently, they are reaching records faster.
Google confirmed that it was the target of one of the largest DDoS attacks recorded during the month of August. The attack peaked at 398 million requests per second (RPS), one of the highest values ever.
For comparison, this value corresponds, in the two minutes it lasted, to all requests that were made to Wikipedia during the entire month of September 2023.
The attack, recorded and mitigated against a Google Cloud client, was around 7 times greater than the previous record. In 2022, the record stood at “only” 46 million RPS.
However, Google was not the only company targeted during this period. Cloudflare, an internet services and website protection company, also recorded a 201 million RPS attack, and even Amazon AWS recorded a 155 million RPS attack.
Google claims that attacks of this magnitude began in August, and have continued to this day – although on a smaller scale than the peaks reached. In the case of Google, the company states that, despite the attack and its intensity, the company's systems managed to successfully mitigate it.
In light of the attacks, the three main target companies shared various information and details during the month to help mitigate them.
These attacks exploited a new technique dubbed “Rapid Reset”, which exploits the HTTP/2 protocol to make multiple requests to a system. HTTP/2 has a functionality that allows you to integrate several requests from an origin as just one – that is, the origin only makes one request, but the servers receive several – with the idea of improving content loading and speed.
However, this also means that the functionality can quickly fulfill millions of requests, with a relatively small volume of systems sending them. Virtually any system that supports HTTP/2 can be affected by this attack
