Last August, Google reported the most powerful DDoS attack in history, which was successfully repelled last August; Its density was 398 million requests per second, which was 7.5 times stronger than last year’s record anti-attacks. As part of the malicious campaign, new methods of hacking websites and services were also recorded.

The new series of DDoS attacks used the new Quick Reset technique, which is based on stream multiplexing, a key feature of the HTTP/2 protocol. The intensity of the attack reached 398 million requests per second, while last year’s record was “only” 46 million requests per second. In contrast, more queries were generated during this two-minute attack than were read on Wikipedia articles in the entire month of September 2023.

The latest wave of attacks began at the end of August and continues until today, targeting the largest providers of infrastructure resources, including Google services, the Google Cloud network, and Google customers. Businesses were able to maintain the operational efficiency of services thanks to the global load distribution infrastructure. Google coordinated efforts with industry partners to help identify attack mechanisms and collaboratively develop mitigations.

While repelling the attack, an HTTP/2 protocol vulnerability was discovered that gave CVE-2023-44487 a score of 7.5 out of 10 and helped attackers implement the Quick Reset technique. To limit the impact of this attack vector, Google recommends that server administrators that support the HTTP/2 protocol ensure that the CVE-2023-44487 patches are installed. Source