In order to safeguard its customers from a series of Layer 7 Distributed Denial of Service (DDoS) attacks, Microsoft has swiftly implemented enhanced security measures. These attacks, initiated by a threat actor named Storm-1359, specifically targeted Microsoft’s services and caused temporary disruptions. However, there is no evidence of customer data compromise.
Microsoft is recommending the use of Level 7 Azure Web Application Firewall (WAF) services to its users. Through its investigation, Microsoft discovered that Storm-1359 employs various tactics, including accessing multiple virtual private servers (VPS), rented cloud infrastructure, open proxies, and DDoS tools. Unlike traditional DDoS attacks that focus on Layer 3 or 4, these recent attacks specifically targeted Layer 7, posing greater challenges for mitigation efforts.
To counter these attacks, Microsoft has reinforced its Layer 7 protections by fine-tuning the Azure Web Application Firewall (WAF). This proactive measure aims to shield customers from similar DDoS attacks. While the existing tools and techniques have proven highly effective in mitigating disruptions, Microsoft is committed to continuous improvement.
To assist customers in fortifying their own environments against similar attacks, Microsoft encourages them to review the provided technical details and recommended actions. Implementing these measures can enhance system resilience and minimize the potential impact of Layer 7 DDoS attacks.
Microsoft’s analysis of Storm-1359 revealed that the threat actor possesses a collection of botnets and tools capable of launching DDoS attacks from various cloud services and open proxy infrastructures. Storm-1359 seems to be primarily motivated by disruption and seeking publicity through its activities.
The attacks conducted by Storm-1359 encompass several types of Layer 7 DDoS attacks. These include the HTTP(S) flood attack, which overwhelms system resources with an excessive load of SSL/TLS handshakes and HTTP(S) requests. Additionally, Storm-1359 utilizes cache bypass techniques to overload origin servers by sending queries against generated URLs, effectively bypassing the CDN layer. Another attack method employed is Slowloris, where the attacker opens a connection to a web server, requests a resource, and deliberately fails to acknowledge or accept the download. This forces the server to retain the connection and requested resource in memory, causing resource depletion.
To mitigate the impact of Layer 7 DDoS attacks, Microsoft advises customers to utilize layer 7 protection services such as Azure Web Application Firewall (WAF), available with Azure Front Door and Azure Application Gateway. Customers should also block malicious IP addresses and ranges, and consider implementing rate limiting or traffic redirection from specific regions. By creating custom WAF rules to automatically block and rate limit HTTP or HTTPS attacks with known signatures, organizations can further fortify their defenses against Layer 7 DDoS attacks.
 attacks,){kind=link}