On Saturday 27 April 2024 at 15:41 UTC, a ACK flood targeted a retail banking customer in North America. The attack peaked at 137.6 Gbps and lasted 53 minutes. Traffic originated from 77 autonomous systems in 41 countries, predominantly misconfigured open reflectors.
| Vector | ACK flood |
| Peak | 137.6 Gbps |
| Duration | 53 min |
| Time to mitigation | 0.141 s |
| Attack traffic reaching origin | 0.047% |
| Legitimate traffic challenged | 0.74% |
Timeline
The attack was preceded by a breaking political story. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 12 points of presence.
What the customer saw
No customer-visible impact. The on-call engineer was notified and acknowledged the incident from the dashboard.
Recommendations
- Review allow-listed partner ranges quarterly.
- Add a dedicated rate limit for the targeted route.
- Enable authenticated origin pulls.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
Great write-up. We saw almost the same pattern on our login endpoint last month.
Carpet bombing is nasty. Good to see a clear explanation of it.
The point about origin IPs leaking through certificate transparency logs is underrated.
Clear and practical, thanks.
Good question. We will cover that in a follow-up post.
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.
The point about origin IPs leaking through certificate transparency logs is underrated.
Could you share the dataset behind the percentages?