Details of the Attack
In a remarkable revelation, Global Secure Layer, a leading DDoS mitigation firm, has reported an unprecedented DDoS attack that has set a new benchmark in terms of packets per second (PPS). This attack, which targeted a Minecraft gaming customer, reached a staggering 3.15 billion PPS, originating from a botnet predominantly based in Russia, but also drawing traffic from 17 additional countries. It is important to note that this does not imply the involvement of individuals from these nations; rather, it indicates the geographical sources of the attack.
Steven Ferguson and Cameron Tickner from Global Secure Layer provided a detailed analysis of the incident, which unfolded on August 25. They stated, “Our team has cross-verified this attack size with tier one providers and internet exchange operators to confirm border packet rate capacity has matched reported device telemetry.” The report further elaborated that when compared to previously documented records, this attack’s size exceeds those benchmarks by a factor of 3.2 to 3.5 times, solidifying its status as the largest publicly reported packet rate attack to date.
The targeted server appears to be Minemen Club, as noted by Minecraft enthusiast Eli, who shared the findings on Twitter. This incident is not the first instance where security experts have linked substantial botnets to Minecraft servers, yet the reported figures are astonishingly high.
To understand the mechanics of a DDoS attack, it is essential to recognize that the objective is to overwhelm a system with excessive pings or requests, thereby impeding its ability to function effectively. While there have been larger DDoS attacks in terms of total data volume, this particular incident stands out for its peak packet rate, a crucial metric in assessing the severity of such attacks.
Phases of the Attack
The assault unfolded in two distinct phases. Initially, on August 24, the attackers launched a preliminary strike that peaked at 1.7 Gbps but ultimately had no discernible impact on end users. Following this test phase, the full-scale “carpet bombing” commenced the next day, culminating in the record-breaking 3.15 Gbps. Global Secure Layer explains that “carpet bomb attacks aim to flood traffic to all IPs within a subnet on a victim network, with the goal to bypass per destination attack detection.”
This extensive DDoS attack persisted for just over an hour, with the highest levels of botnet activity recorded in Russia, Vietnam, and South Korea. Taiwan followed closely, while Brazil, the United States, and Ukraine contributed to the overall traffic. In total, 42,209 sources were identified as participating in this packet rate campaign.
Global Secure Layer observed a notable deviation from typical attack patterns, stating, “Normally for attacks we observe, the source countries are typically well distributed with no one country being more than 7% of total attack traffic. In this case, Russia, Vietnam, and Korea comprise 42.8% of the total volume.” The majority of the traffic from these sources was scrubbed in Frankfurt and Singapore.
Earlier this year, the gaming community witnessed a similar wave of disruption when Final Fantasy 14 experienced three consecutive days of DDoS attacks, coinciding with the lead-up to the Dawntrail expansion, prompting Square Enix to take swift action to restore server stability.
