Can someone please explain-like-I'm-not-versed-in-botnets?
What's different about this attack is that it appears to not be PCs but network devices (routers) that are being taken over and used to launch attacks.
People are much less likely to catch that this is occurring and as a result there's concerns that this botnet is going to persist as a threat for a much longer time than is typical. Additionally, network devices may have access to a greater amount of bandwidth than a PC increasing the threat.
One more thing: when the botnet makes a request (attack) against a site it's using a modern performance optimization technique of "pipelining" where instead of a GET to "/index.html" just interacting with the index.html file it's holding a connection open to also then request all the other assets from the site. In normal usage this is great as it makes a site feel more responsive and reduces network overhead. However, in the context of this botnet it also increases the number of requests that each bot can make (which is bad).
I wonder what should happen to that fine company to make them stop running all the potentially vulnerable system configuration services on all interfaces by default. IP > Services is one of the locations anyone should check ASAP to make sure unneeded ones are disabled, but it's actually misleading. These are just preconfigured wrappers for some components, and others, like DNS or bandwidth test server mentioned in the article, are not shown even if they are running. There isn't even a netstat-like command to check which ports are open.
1. While reaching a record number, the attack against something on the scale of Yandex and Cloudflare is more of a maximum capacity test not limited by target's connectivity, and/or an advertisement for someone's DDoS services.
2. Still, it's an application-level DDoS, so you have to have a swift application-level detection in place if you don't want to just ban IP addresses (and potentially cut legal users from HTTP(S) APIs and other services that might be shared on the server or network).
3. Some skill was demonstrated in finding no-trivial weak points to amplify the server load.
HTTP Pipelining: instead of simplistic one-request-one-resource requests to a server the botnet supports HTTP 1.1 pipelined requests. A single request can ask for multiple files meaning even more demand on target servers. Request resources not cached in memory can see the server eat up its IOPS trying to read files.
Otherwise the bullet points are about the functionality in place in the infected clients. The port is likely a detection metric for infected clients.