Threat Bulletin 0527: HTTP POST flood against a airline booking platform in North America

On Wednesday 1 March 2023 at 14:14 UTC, a HTTP POST flood targeted a airline booking customer in North America. The attack peaked at 565.6 million requests per second and lasted 50 minutes. Traffic originated from 1293 autonomous systems in 113 countries, predominantly a Mirai-derived IoT botnet.

Vector HTTP POST flood
Peak 565.6 million requests per second
Duration 50 min
Time to mitigation 0.829 s
Attack traffic reaching origin 0.030%
Legitimate traffic challenged 0.32%

Timeline

The attack was preceded by no stated motive. Request rates on the targeted routes exceeded their hourly baseline by a factor of 730 within 17 seconds. The risk score of participating clients crossed the challenge threshold automatically and proof-of-work difficulty rose with origin load.

What the customer saw

A brief increase in p99 latency of 219 ms during the first minute, then normal service.

Recommendations

  • Add a dedicated rate limit for the targeted route.
  • Keep origin IPs out of public DNS history.
  • Lower challenge thresholds on authentication endpoints during high-risk events.

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top