Proton

As few weeks back, we sent a notice to the Proton community regarding the DDoS attacks that we have been facing. Today we would like to provide a brief update of the situation.

  • Starting on June 27th, Proton Mail started to be hit by sustained DDoS attacks.
  • The attack campaign continues to this day, but there has been little to no user impact.
  • Thus far the attacks have included:
    • Rapidly morphing DDoS attacks with the combination of SYN floods, TCP handshake violations (first packets are not SYNs), IPv4 TCP SYN floods, TCP Zero Sequence, ACK Floods, NTP nonstandard port floods, and reflection attacks on SSDP, NTP, Chargen, LDAP and Memcache protocols.
    • Pulsed/Burst DDoS attacks, with multiple attack vectors and rapid changes within minutes.
    • Attacks up to 25Gbs in volume. This attack was largely challenging to handle because of its complexity, not the size/volume. No unknown attack vectors were used, but they were rapidly changing, and hence the complexity.

Since November 2015, Proton Mail has been protected by Radware’s Cloud DDoS Protection Services, and in this instance, Radware was able to successfully mitigate nearly all of these attacks. However, due to the nature of the ferocity and attack ingenuity, some of the attacks were only partially mitigated and briefly resulted in some service outages at the outset of the campaign.

In order to improve mitigation performance, Radware immediately upgraded their scrubbing centers and processes to provide better protection against rapidly changing attacks. As a result, attack mitigation through the upgraded Radware scrubbing center has been successful in the past couple weeks.

After the upgrade, we have found that Radware’s technology actually works well against rapidly evolving attacks, and the automatic mitigation capabilities are essential for reducing the response times when coming under attack frequently. We also deeply appreciate the support that we have received from the team at Radware, and the fact that they made defending Proton Mail a priority. Going forward, we plan to utilize a multi-layered DDoS defense strategy and will continue to partner with Radware on the first line of defense.

We appreciate your patience through these attacks and look forward continuing to provide you with secure and private email services.

Статьи по теме

A stylized icon resembling the Google Photos logo with a dark triangular warning sign containing an exclamation mark, representing Google Photos safety issues
en
  • Советы о конфиденциальности
Is Google Photos secure to share private pictures? Here's how its protections can fall short — and other options for safer photo sharing.
how to change your email address
en
  • Советы о конфиденциальности
Learn how to change your email address across email services, including Gmail, Yahoo, Outlook, and iCloud without risking your data.
Who is responsible for protecting CUI?
en
  • Советы о конфиденциальности
This article breaks down CUI, the parties responsible for marking and guarding it, and what goes into keeping it secure.
The cover image for a Proton Pass blog about how to change your Facebook password settings. The image shows the Facebook icon with a password field beneath it and a tick at the end of the password field
en
  • Советы о конфиденциальности
Here's a step-by-step guide for how to change or reset your Facebook password settings — and how to create a strong password you'll remember with Proton Pass.
A politician at a podium, a smartphone that's been unlocked, and the Reichstag building.
en
  • Новости о конфиденциальности
German regional politicians overall have good cybersecurity, but 3 regions had at least half of their regional MPs' email addresses appear on the dark web. Read more to find out which.
A Gantt chart showing progress through the product roadmaps.
en
  • Новости о продуктах
We're sharing the roadmaps for all our services so you can see what's coming and give us your feedback.