Surely bringing down Google is a bigger technical achievement than some random government website maintained by someone who stumbled into their job after 20 years doing mid level government organizational work.

Heck, I'd imagine that making headlines and having Google benchmark your attack would bring some amazing street cred.

Darknet guerilla marketing. Definitely seems to have worked.

Now we need the SEO content side: "How we hit Google with 398M RPS".

"... you can do this manually, but our product makes it as easy as a sign up and API call. Talk to us about pricing. [Python API example].

Yes, but they are clearly going to fail to bring down Google.

It doesn't matter if you fail. The cred comes from how much bandwidth and resources you can soak up.

Right, so clearly the ability to bring down Google is not the point.

Well - they clearly were successful enough to get a thread on hacker news……

Aim high and go out with a bang choom

Nah it's even better because they're considered capable defenders so it's harder.

What I'm not sure of is why Google published this. I can't figure out what their strategy is here. We never published about the attacks we absorbed because we didn't want them to know our capabilities.

Unless this is marketing for Google Cloud?

This is certainly marketing. If they sell DDOS protection, then announcing that they stopped the largest attack ever is an ad.

Maybe Google is responsible for the attack, to be able to publish this blog post! <\tinfoil-hat>

If Google truly went rouge, they could turn all those Chrome installs and Android devices into one gargantuan botnet.

Google is already partly rouge, at least in their logo.

Sounds like a symbiotic relationship to me. The attackers get to advertise their capability for pulling off attacks, and Google gets to advertise their ability to stop them.

Almost all (but not all) of these attacks are based on some kind of problem that leads to amplification. Advertizing that people should fix these points of exploit help everyone on the internet.

False flag? :)

> Unless this is marketing for Google Cloud?

If you read the article, there are plenty of marketing remarks in there to get you to use Google Cloud

CDN is the ultimate solution for DDoS, so any report about DDoS finally become an ad for CDN

> Unless this is marketing for Google Cloud?

That seems likely here if they're claiming this is the largest DDOS ever.

> why Google published this

Besides publicity, there is also link to a list of advisories that may be of interest to other cloud operators and users.

https://nvd.nist.gov/vuln/detail/CVE-2023-44487

> We never published...

We? Netflix or Reddit? I know for a fact that Amazon doesn't.

Nowhere that I've ever worked published about attacks. We didn't want to validate the attackers.

At eBay/PayPal we filed patents on our DDOS shield, since it was as far as we knew the first one to exist, but that was about the only public information on it.

At reddit and Netflix we didn't actually have to deal with it because AWS just absorbed (or mitigated) it before it ever hit us. We only had to deal with L7 attacks, which we had shields in place for.

What capabilities did this post reveal the existence of? Not many, beyond it having been mitigated somehow and that it didn't cause an outage. The attackers knew that already, because they'd obviously be able to observe the system during the attack.

As for why to write about it, it's a new type of attack that resulted in almost an order of magnitude increase in attack size. That's interesting and newsworthy by itself, and publishing a concrete number gives people an idea of the size of the problem and the trendlines.

This is also something that needed a CVE, so it was going to be very public anyway. If nothing is written about it, at a minimum Cloud customers will be flooding their support reps with questions about whether the vulnerability applies to them.

They're not attacking Google, per se. Just the Google Cloud platform that hosts govt sites, Discord channels, gaming servers, etc.