Massive botnet that appeared overnight is delivering record-size DDoSes

[Kaz]

  Quote

A newly discovered network botnet comprising an estimated 30,000 webcams and video recorders—with the largest concentration in the US—has been delivering what is likely to be the biggest denial-of-service attack ever seen, a security researcher inside Nokia said.

...

Besides a 30,000-node botnet seeming to appear overnight, another salient feature of Eleven11bot is the record-size volume of data it sends its targets. The largest one Nokia has seen from Eleven11bot so far occurred on February 27 and peaked at about 6.5 terabits per second. The previous record for a volumetric attack was reported in January at 5.6 Tbps.

Expand  

Massive botnet that appeared overnight is delivering record-size DDoSes

ARSTECHNICA.COM

---

Eleven11bot infects video recorders, with the largest concentration of them in the US.

 

DDOS has always been an arms race, and it's just not feasible for targeted websites/services to compete with 5.6 Terrabytes a second.  This is why cloudflare exists!  It's also why people should keep their devices up to date.  Sadly a lot of IOT things don't get updates from their manufactures. 

[schuck6566]

  On 13/03/2025 at 05:11, Kaz said:

Massive botnet that appeared overnight is delivering record-size DDoSes

ARSTECHNICA.COM

---

Eleven11bot infects video recorders, with the largest concentration of them in the US.

 

DDOS has always been an arms race, and it's just not feasible for targeted websites/services to compete with 5.6 Terrabytes a second.  This is why cloudflare exists!  It's also why people should keep their devices up to date.  Sadly a lot of IOT things don't get updates from their manufactures. 

Expand  

In 2018 sixty percent of us security cameras used the effected chipset. We may have blocked Huawei from imports, but people still purchase the cheapest they can get away with. HiSilicon is owned entirely by them and helped them top AMD's profits in 2018.3rd party and used sales will get around the issue of never being able to find any more. smh

[Kaz]

This is where a greyhat would be useful.  A botnet that used common exploits to gain access and then harden them would be the best fix, but the law is heavily stacked against grey hats in this area.  There's no reward for the massive risk they would take.  Normally this is where the government would step in and do it, but without a warrant it's a 4th amendment lawsuit waiting to happen.  I've heard NSA hackers are often frustrated with politics and how much they are held back.

 

[schuck6566]

  On 13/03/2025 at 22:14, Kaz said:

This is where a greyhat would be useful.  A botnet that used common exploits to gain access and then harden them would be the best fix, but the law is heavily stacked against grey hats in this area.  There's no reward for the massive risk they would take.  Normally this is where the government would step in and do it, but without a warrant it's a 4th amendment lawsuit waiting to happen.  I've heard NSA hackers are often frustrated with politics and how much they are held back.

 

Expand  

We don't need to worry about that much longer if this keeps up.

"As of February 14, more than 130 positions had been cut from the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency, according to CISA. Copyright 2025 Thomson Reuters."