Cloudflare has revealed that a historic distributed denial-of-service (DDoS) attack reaching up to 3.8 terabits per second (Tbps) was successfully thwarted, lasting for 65 seconds.
The cybersecurity and web safeguarding organization stated that it repelled “over a hundred hyper-voluminous L3/4 DDoS attacks in the same month, some surpassing 2 billion packets per second (Bpps) and 3 terabits per second (Tbps).”
These high-volume L3/4 DDoS attacks have been persistent since the beginning of September 2024, focusing on various clients in the finance, Internet, and telecommunications sectors. The culprits behind the attacks remain unidentified.
The earlier record for the most extensive volumetric DDoS assault peaked at 3.47 Tbps in November 2021, targeting an undisclosed Microsoft Azure customer based in Asia.
Recently exposed vulnerabilities in the Common UNIX Printing System (CUPS) for Linux might serve as a potential channel for launching DDoS assaults with a 600x magnification ratio within seconds.
Analysis conducted by the firm has revealed that out of approximately 198,000 devices accessible on the public web, more than 58,000 (about 34%) could be utilized to execute DDoS attacks.
“The issue arises when a malicious actor dispatches a carefully crafted packet indicating the target’s address as if it were a printer to be added,” as stated by Larry Cashdollar, Kyle Lefton, and Chad Seaman, the researchers mentioned.
“Upon sending each packet, the vulnerable CUPS server will create a larger IPP/HTTP request, partially controlled by the attacker, directed at the specified target. Consequently, not only the target is impacted, but also the host of the CUPS server falls prey, as the attack drains its network bandwidth and CPU resources,” the researchers added.
It has been approximated that there are around 7,171 systems with exposed CUPS services via TCP that are susceptible to CVE-2024-47176, according to Censys clarified. This is considered a conservative estimate as “more CUPS services appear to be reachable via UDP than TCP.”
Businesses are urged to contemplate uninstalling CUPS if printing functionality is unnecessary and to restrict the service ports (UDP/631) with a firewall, especially if they are open to the wider internet.
About Author
