Brazilian DDoS Protection Firm's Infrastructure Hijacked to Attack Local ISPs

Introduction

For years, security researchers have observed a sustained wave of massive distributed denial-of-service (DDoS) attacks originating from Brazil and targeting Brazilian internet service providers (ISPs). The source of these digital sieges remained murky until a recent discovery shed light on an unexpected culprit: a company that claims to protect networks from DDoS attacks.

Brazilian DDoS Protection Firm's Infrastructure Hijacked to Attack Local ISPs — Source: krebsonsecurity.com

The Discovery

Earlier this month, a confidential source provided KrebsOnSecurity with a revealing archive exposed in an open directory online. The archive contained several Portuguese-language malicious Python scripts, along with private SSH authentication keys belonging to the CEO of Huge Networks—a Brazilian ISP that specializes in DDoS mitigation for other network operators.

Profile of Huge Networks

Founded in Miami, Florida in 2014, Huge Networks primarily operates in Brazil. The company started by protecting game servers from DDoS attacks and evolved into an ISP-focused DDoS mitigation provider. Notably, Huge Networks has no record of public abuse complaints and is not linked to any known DDoS-for-hire services.

The Botnet Infrastructure

The exposed archive reveals that a threat actor based in Brazil maintained root access to Huge Networks' infrastructure. Using this access, the attacker built a powerful DDoS botnet by mass-scanning the internet for insecure routers and misconfigured domain name system (DNS) servers. These compromised devices could then be enlisted to amplify attacks.

DNS Amplification Attacks

DNS servers translate human-friendly domain names into IP addresses. Ideally, they only respond to queries from trusted domains. However, some servers are misconfigured to accept queries from anywhere. Attackers can send spoofed DNS queries, making the requests appear to come from the target's network. The responses then flood the victim. By leveraging the DNS protocol's extension for large messages, attackers can amplify the attack: a 100-byte query can trigger a response 60–70 times larger.

CEO's Response

Huge Networks' CEO stated that the malicious activity resulted from a security breach and suggested a competitor might be behind the incident, aiming to damage the company's reputation. The breach reportedly allowed the attacker to commandeer Huge Networks' own resources for the attacks.

This case underscores the vulnerability of even security-oriented organizations to sophisticated intrusions and the potential for their own tools to be weaponized against others.