Threat Bulletin 0443: UDP reflection (NTP) against a gaming community platform in the Nordics

On Thursday 3 November 2022 at 10:34 UTC, a UDP reflection (NTP) targeted a gaming community customer in the Nordics. The attack peaked at 175.4 Gbps and lasted 189 minutes. Traffic originated from 3123 autonomous systems in 64 countries, predominantly a rented booter service.

Vector UDP reflection (NTP)
Peak 175.4 Gbps
Duration 189 min
Time to mitigation 0.396 s
Attack traffic reaching origin 0.079%
Legitimate traffic challenged 0.66%

Timeline

The attack was preceded by a competitor’s product launch. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 22 points of presence.

What the customer saw

A brief increase in p99 latency of 136 ms during the first minute, then normal service.

Recommendations

  • Enable authenticated origin pulls.
  • Lower challenge thresholds on authentication endpoints during high-risk events.
  • Keep origin IPs out of public DNS history.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top