What is known

The new series of DDoS attacks used the new Quick Reset technique, which is based on stream multiplexing, the most important function of the HTTP/2 protocol. The intensity of the attack reached the following level: 398 million requests per secondGoogle’s record last year was a relatively paltry 46 million queries per second.

In contrast, more queries were generated during this two-minute attack than were read on Wikipedia articles in the entire month of September 2023.

The latest wave of attacks began at the end of August and continues to this day, targeting the largest providers of infrastructure resources, including Google services, the Google Cloud network, and Google customers.

Companies it was possible to keep services running Thanks to the global load sharing infrastructure. Google coordinated efforts with industry partners to help identify attack mechanisms and collaboratively develop mitigations.

Google researchers discovered the CVE-2023-44487 vulnerability in the HTTP/2 protocol while fending off a DDoS attack, so anyone using this technology can become a victim of such attacks. The production of so much demand in a short time was possible thanks to this flaw in the system. Security vulnerabilities were given a score of 7.5 out of a possible 10. The company’s experts know how to counter this and have already developed a list of recommendations, but they say that these actions require “significant investments in infrastructure.”