How did a DDoS Attack Cripple Kaveri 2.0?

Discover how a massive DDoS attack crippled Kaveri 2.0, disrupting services and exposing vulnerabilities. This article explores the attack's impact, methods used, and cybersecurity measures needed to prevent future incidents.

Table of Contents

Context: Recently Karnataka’s web-based portal Kaveri 2.0, which is used for property registrations, faced crippling server outages due to a Distributed Denial of Service (DDoS) attack.

About Distributed Denial-of-Service (DDoS) Attack

DDoS attack is a malicious attempt to disrupt a targeted server, service, or network by flooding it with internet traffic.
Unlike a DoS (Denial of Service) attack, which comes from a single source, a DDoS attack uses multiple compromised systems (botnets).
While DDoS attacks do not steal data, they can be used as a distraction while other cyberattacks (such as data breaches) take place.

How Can DDoS Attacks Be Prevented?

Traffic Filtering Mechanisms: To differentiate between legitimate and malicious traffic.
Monitoring Tools: To identify unusual traffic patterns in real-time.
Rate Limiting: Restricts the number of requests per user within a given time.
Bot Detection: Using CAPTCHA challenges and behavioural analysis to block automated bots.
Regular Security Audits: Strengthening system security against vulnerabilities.
Collaboration with Cybersecurity Agencies: Sharing threat intelligence to prevent future attacks.
Cyber Awareness Training: Educating users to avoid phishing and social engineering attacks that may lead to compromised accounts.

Nature of the Attack

Fake Accounts and Automated Bots: Attackers created numerous fake user accounts and employed automated bots to flood the portal with spurious database entries. This surge in activity strained the system’s resources, leading to significant slowdowns and outages.
Massive Traffic Surge: During a particularly intense phase in January, the portal received approximately 620,000 requests within a two-hour window, far exceeding its capacity. This deluge was primarily directed at the Encumbrance Certificate (EC) search function, a critical feature for property transactions.

Impact on Services

Operational Disruption: The overwhelming traffic caused the portal to crash, bringing property registration services across Karnataka to a near standstill. This interruption affected numerous stakeholders, including citizens and businesses relying on timely property registrations.
Decline in Registrations: The attack led to a sharp decline in property registrations on specific dates, notably February 1 and 4, 2025. Services were eventually restored by February 5, but the incident highlighted vulnerabilities in the system’s cybersecurity measures.