Untitled attachment

Notices where this attachment appears

1. BrianKrebs (briankrebs@infosec.exchange)'s status on Tuesday, 10-Oct-2023 15:14:19 UTC BrianKrebs

   There's an important vulnerability being disclosed today that allows attackers to massively increase the size of DDoS attacks.

   The flaw is being tracked as CVE-2023-44487, a.k.a. "HTTP/2 Rapid Reset Attack." According to Damian Menscher at Google, the attack "works by sending a request and then immediately cancelling it (a feature of HTTP/2). This lets attackers skip waiting for responses, resulting in a more efficient attack."

   More info:

   https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack

   https://aws.amazon.com/blogs/security/how-aws-protects-customers-from-ddos-events/

   https://aws.amazon.com/security/security-bulletins/AWS-2023-011/

   https://www.cloudflare.com/press-releases/2023/cloudflare-helps-discover-new-online-threat-that-led-to-largest-attack-in/