Dyn estimates size of recent DDoS attack on 100,000 devices

DNS provider Dyn estimates that about 100,000 devices that are part of the Mirai botnet were involved in last Friday’s DDO attack. The attack would have amounted to 1.2 Tbit/s. Dyn can’t confirm this number yet.

Earlier estimates of the size of the attack came in at 50,000 to 100,000 devices, Internet provider Level 3 reported after the attack. In its own analysis, Dyn now comes up with comparable numbers. According to the company, the numbers appeared larger during the attack because some of the internet traffic was the result of servers trying to refresh their cache. Dyn also states that the attack appears to be coming from “at least one botnet” and that most of the traffic is attributable to the Mirai botnet.

The company also speaks of a large number of udp and tcp packets, which targeted port 53. A first attack lasted about two hours and a second a little longer than an hour, both aimed at Dyn’s ‘managed dns platform’. . TCP traffic showed packet bursts of 40 to 50 times higher than normal traffic, early observations showed.

On Wednesday, security firm Flashpoint released an analysis of the attack, saying it was likely carried out by members of a hacker forum. Then James Clapper, head of US intelligence, said the attack was probably not carried out by a state, but by “bored children or criminals.”