CloudFlare recently noticed a large number of HTTP requests aimed at one of its customers. The attack peaked at over 1 billion requests per hour, with a total of 4.5 billion requests reaching the content delivery network’s servers on the day of the attack.
The requests came from 650,000 unique IP addresses, 99.8 percent of them being traced to China. An analysis of the “User Agent” revealed that 80 percent of the requests came from mobile devices, in many cases from mobile apps and browsers that are popular in China.
While it’s difficult to precisely determine how such a large number of mobile devices ended up visiting the attack page, experts believe the most likely distribution vector is a mobile ad network. CloudFlare says it’s confident that the DDoS attack had not involved injection of TCP packets such as in the case of the Great Cannon.
In June, F5 Networks’ David Holmes explained in a SecurityWeek column why mobile DDoS never materialized. One of the main reasons, according to the expert, is that mobile users mostly rely on dedicated apps to connect to various online services instead of using web browser as they do on desktop computers. This makes it less likely for a mobile device to be affected by a malvertising campaign.
However, the attack described by CloudFlare seems to show that mobile users can be just as exposed to ad infections.
“Attacks like this form a new trend,” CloudFlare said in a blog post. “They present a great danger in the internet — defending against this type of flood is not easy for small website operators.”