European ISPs Report Mysterious Wave of DDoS Attacks

More than a dozen internet service providers (ISPs) across Europe have reported DDoS attacks that targeted their DNS infrastructure. From a report: The list of ISPs that suffered attacks over the past week includes Belgium's EDP, France's Bouygues Telecom, FDN, K-net, SFR, and the Netherlands' Caiway, Delta, FreedomNet, Online.nl, Signet, and Tweak.nl. Attacks lasted no longer than a day and were all eventually mitigated, but ISP services were down while the DDoS was active. NBIP, a non-profit founded by Dutch ISPs to collectively fight DDoS attacks and government wiretapping attempts, provided ZDNet with additional insights into the past week's incidents. "Multiple attacks were aimed towards routers and DNS infrastructure of Benelux based ISPs," a spokesperson said. "Most of [the attacks] were DNS amplification and LDAP-type of attacks." "Some of the attacks took longer than 4 hours and hit close to 300Gbit/s in volume," NBIB said. The DDoS attacks against European ISPs all took place starting with August 28, a day after ZDNet exposed a criminal gang engaging in DDoS extortion against financial institutions across the world, with victims like MoneyGram, YesBank India, Worldpay, PayPal, Braintree, and Venmo.

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[spun]

Me three. I work in state government, Sunday we had a DDOS attack targeting DNS at the state level. None of our infrastructure is in Europe.

Re:

[arglebargle_xiv]

DNS and LDAP are great attack amplifiers. Things like DNSSEC and DANE are incredible attack amplifiers. It's not surprising that they're now being used to, well, amplify attacks. Not sure why Europe is being hit, my guess is either script kiddies or someone testing an attack tools. But in any case the specific protocols being used aren't surprising.

Is this a practice run ?

[Alain Williams]

If so when will this be for real and what is the purpose ?

Re:

[DontBeAMoran]

Prevent access to porn websites to incite civil revolution during a pandemic?

Protection.

[spacemky]

2 words: Akamai Prolexic

Itâ(TM)s expensive, but will save an ISP a lot of hassle if they have critical infrastructure prone to DDoS. Attacks on DNS was one of the main reasons to cease self-hosting my own external DNS services.

Other

[coastwalker]

I note that the Independent Newspaper in the UK has been intermittently available over the last few day and has disabled its comment function for nearly a week. I wonder if this is related.

Re:

[account_deleted]

Comment removed based on user account deletion