DDoS Protection Provider Huge Networks Unmasked as Origin of Attacks on Brazilian ISPs

Introduction

For years, security researchers have tracked a relentless barrage of massive distributed denial-of-service (DDoS) attacks originating from Brazil, specifically targeting internet service providers (ISPs) in the country. The true source remained elusive until a recent discovery by KrebsOnSecurity shed light on the matter. A Brazilian tech firm specializing in DDoS mitigation, Huge Networks, appears to have been the launchpad for these attacks, potentially due to a security breach.

The Breached Archive: A Digital Smoking Gun

Earlier this month, an anonymous source shared a suspicious archive found exposed in an open online directory. The archive contained Portuguese-language malicious Python scripts, along with private SSH authentication keys belonging to the CEO of Huge Networks. Huge Networks, founded in Miami in 2014 but operating primarily in Brazil, originally protected game servers from DDoS attacks before evolving into an ISP-focused DDoS mitigation provider. The company had no prior public record of abuse or involvement in DDoS-for-hire services.

What the Archive Contained

The exposed files included tools for building a potent botnet. The threat actor behind it maintained root access to Huge Networks' infrastructure and used automated scanning to locate insecure internet routers and misconfigured DNS servers worldwide. These vulnerable devices were then enlisted to amplify attacks.

How the Botnet Worked: DNS Reflection and Amplification

At the heart of these attacks was a technique called DNS reflection. Normally, DNS servers respond only to queries from trusted domains. However, some servers are configured to accept queries from anywhere. Attackers spoof queries to make them appear as though they originate from the target, causing the server to respond to the victim's IP address. By using the EDNS extension, which allows larger DNS messages, attackers can drastically amplify the attack. A small query of under 100 bytes can trigger a response 60 to 70 times larger. Combining thousands of compromised routers and open DNS servers, the botnet could launch devastating attacks against Brazilian ISPs.

Company Response: A Breach or Sabotage?

In a statement, Huge Networks' CEO claimed the malicious activity stemmed from a security breach, possibly orchestrated by a competitor seeking to damage the company's reputation. The CEO emphasized that Huge Networks itself had not initiated any attacks and that the exposed archive indicated unauthorized access. However, the incident raises questions about the security of DDoS protection providers and the potential for their infrastructure to be weaponized.

Implications for Cybersecurity and Trust

This case highlights the critical importance of securing network infrastructure, especially for companies that offer DDoS mitigation. A compromised DDoS protection provider can become a devastating weapon. The incident also underscores the ongoing vulnerability of misconfigured DNS servers and insecure routers, which remain prime targets for botnet builders. As investigations continue, Brazilian ISPs face heightened risks, and the broader cybersecurity community is reminded that even defenders can be turned into attackers.

Back to top