Can CloudFlare be DDoS-ed and issn't the actual DDoS mitigation limit, financial resources?

Question

CloudFlare (known for fighting DDoS-attacks) is explaining quite a lot about DDoS on their website cloudflare.com/ddos. In an article named The DDoS That Almost Broke the Internet they write about a DDoS attack of 300Gbps that they mitigated. Also the following is written on the CloudFlare page on Wikipedia:

CloudFlare reported a new record for the largest ever recorded DDoS attack with independent media sites being targeted at 500 Gbit/s.

Since it's all about who has the most resources, CloudFlare has to be able to have more resources in order to "win" (read: mitigate the attack). I assume they can upscale their infrastructure flexibly and they pay for those resources from the collective money (earned by their payed contracts) to mitigate (big) attacks, like some kind of collective insurance. "All-for-one".

I'm wondering about the following unlikely and so theoretical scenario. What if CloudFlare has to deal with multiple DDoS attacks of 500Gbps at the same time or with multiple DDoS attacks of 1Tbps. In this example I used CloudFlare but I assume that the answer applies to other DDoS protection solutions also, right?

Also, isn't the only actual limit, financial resources? What if one or multiple DDoS attacks of 500Gpbs or more, continue for more than months. Will this bankrupt them?

Answer 1

I work for CloudFlare so maybe I can shed some light on how we do things.

Fundamentally, CloudFlare uses an Anycast network design; this means that network traffic has no control to where it is routed and it is automatically routed to the closest available host. Computers compromised by botnets are typically distributed throughout the world in different geographical regions. Because of using an Anycast network we increase the surface area of our network such that it is harder for a distributed attack to take us down. The traffic cannot merely overwhelm a single datacenter, in order to grow out this protection we now have 86 data centers around the world and we plan to add more.

We also operate an open peering policy where we are willing to directly interconnect with ISPs (PeeringDB). By removing the middle-men we are able to have the shortest path from the source of the attack to where we can filter the attack. Today, we have the single highest participation in Internet Exchanges globally, of any network. By having a direct path form attacker to destination we can prevent collateral congestion on our network.

Yes, we need a large network to come with attacks, we need big pipes so people can't congest them - to that end our network is 96% bigger than the largest DDoS attack ever recorded.

This is despite the fact we have seen a whopping increase in attacks. There are some interesting characteristics about these attacks; they predominantly happen on weekends (attackers busy with something else on the weekday?), they happen against largely benign websites indicating that anyone can become the target of an attack and also these attacks are massive in capacity.

Almost all of our Layer 3 attack handling is now autonomous, we use a range of strategies to protect against attacks. When attacks come to our Edge we have worked out strategies in order to ensure we are able to reduce the impact of such malicious traffic; we then seek only to pass on safe traffic to the origin.

In many ways CloudFlare has become the DDOS filtering method of last resort; for Business and Enterprise we have advanced protections against DDOS attacks backed by a full SLA, we offer this at a flat rate to ensure that DDOS attacks aren't successful in bankrupting their victims. For at risk public interest sites we have Project Galileo offering this technology for free to those public interest websites who need it.

Currently one of the largest risks to the internet lies in open DNS resolvers, which can be used for DNS amplification attacks by hijacking insecure DNS resolvers; I would highly recommend looking at the Open Resolver Project to learn more. Finally, an article from about 3 years ago on our blog goes into detail about how the DDOS attack against Spamhaus almost broke the internet.

Answer 2

Large scale DDoS attacks usually aggregate at a target's access router where their impact is strongest. Whether multiple DDoS attacks of 500Gbps or multiple DDoS attacks of 1Tbps should be handled by network providers' DDoS defenses ideally.Here's an interesting article on the professionalisation of attacks and service providers/managed service providers mitigation efforts automated DDOS IDS systems.

In addition, SDN technology can also be used to guard againstlarge DDoS attacks by automating their network routing and scaling procedures.

Answer 3

You are right in saying the ability to stop ddos attacks are a function of finance. Cloudflare's use of anycast DNS returns DNS answers based on geography. You can quench attacks by nxdomaining clients that exhibit high bursty connection or DNS queries.

There are a few ways to return DNS queries based on geographic fencing. One way is to incorporate geoip data into bind and reply based on where incoming queries are from. The other way is to use anycast to offload route processing to the routing layer to determine geo boundaries. With this in place, you can partition large ddos streams according to regions and sinkhole them before they hit the site. Assuming you wish to ddos cloud flare, you would have to saturate their links, from everywhere, but as they have shown, they have the capacity to withstand it.