While it’s difficult to precisely determine how such a large number of mobile devices ended up visiting the attack page, experts believe the most likely distribution vector is a mobile ad network. CloudFlare says it’s confident that the DDoS attack had not involved injection of TCP packets such as in the case of the Great Cannon.
In June, F5 Networks’ David Holmes explained why mobile DDoS never materialized. One of the main reasons, according to the security expert, is that mobile users mostly rely on dedicated apps to connect to various online services instead of using web browser as they do on desktop computers. This makes it less likely for a mobile device to be affected by a malvertising campaign.
However, the attack described by CloudFlare seems to show that mobile users can be just as exposed to ad infections. “Attacks like this form a new trend,” CloudFlare said in a blog post. “They present a great danger in the internet — defending against this type of flood is not easy for small website operators.”