On December 5th at 13:28 UTC, Gate website was hit by a large scale DDOS attack (DDOS attack is a traffic flow attack which uses zombie computers to send large amounts of spam requests to clog the target’s service channels and deny legitimate access to the target server), which congested the front-end access channels and resulted in front-end service inaccessibility by our users. During this attack, our servers worked properly and API users were not affected. Withdrawal and deposits were not affected as well. We spent 1 hour to identify the attacker’s traffic flow model, and then restored the normal access to our website by splitting the attacker’s traffic flow using our firewall rules.
In the below chart you can find how the attacker’s request traffic changed over time. (The time on the chart was 5 hours later than UTC time.) From this chart, you can see that the attacker started increasing the malicious traffic flow (line in orange) targeting our website from 13:00 UTC, and increased to a scale large enough to affect our users’ normal access at 13:28 UTC. In response to this wave of attack, we took some protective measures and closed some access channels so as to restore users’ access to our main services. At 14:15 UTC, the attacker quickly enhanced the attack strength, which completely prevented our users’ legitimate access to our website from the front-end. After 15:00 UTC, our analysis about the attacker’s request model proved to be correct and we successfully split up the attacker’s traffic flow (line in blue) using firewall rules. Though the attacker made another powerful wave of attack later, that didn’t work. Until then, we successfully restored all the services.


Поділитися повідомленнями


Статті на тему