51–58 of 58 posts
BGP Flowspec is commonly used ISPs. Sadly, they won’t extend that to their customers. They’d rather sell yet another service rather than supporting open protocols.
No Scrubs: The Architecture That Made Unmetered Mitigation Possible - https://blog.cloudflare.com/no-scrubs-architecture-unmetered...
Meet Gatebot - a bot that allows us to sleep - https://blog.cloudflare.com/meet-gatebot-a-bot-that-allows-u...
How Cloudflare's Architecture Allows Us to Scale to Stop the Largest Attacks - https://blog.cloudflare.com/how-cloudflares-architecture-all...
Kernel bypass - https://blog.cloudflare.com/kernel-bypass/
SYN packet handling in the wild - https://blog.cloudflare.com/syn-packet-handling-in-the-wild/
How to achieve low latency with 10Gbps Ethernet - https://blog.cloudflare.com/how-to-achieve-low-latency/
How to receive a million packets per second - https://blog.cloudflare.com/how-to-receive-a-million-packets...
Introducing the BPF Tools - https://blog.cloudflare.com/introducing-the-bpf-tools/
BPF - The Forgotten Bytecode - https://blog.cloudflare.com/bpf-the-forgotten-bytecode/
Introducing the p0f BPF compiler - https://blog.cloudflare.com/introducing-the-p0f-bpf-compiler...
Single RX queue kernel bypass in Netmap for high packet rate networking - https://blog.cloudflare.com/single-rx-queue-kernel-bypass-wi...
I wonder if anyone has ever tried counter attack. The downside is in turn DoS the origin, which often are victims like infected host in a botnet. Double-edged sword. But it would be very interesting to see how quickly one could defeat the attack. I also wonder why attack often last only a few hours.
1. That would be just as illegal as the original attack; cybersecurity laws have no provisions for self-defense. (It's true that nations are attempting to negotiate clauses like that in international relations, but even if that pans out, it will definitely never be a privilege afforded to individuals) 2. Attack what? It's a distributed DoS, the calls are coming from all over. You mean going after every node sending t…
They are also doing a webinar (apologies for the link) so you can see exactly how it's implemented: https://www.incapsula.com/blog/want-to-see-what-a-live-ddos-...
From my personal low-end server perspective (which has stood up to simple attacks from Russian IPs), I have the following: 1. Static page caching (in RAM ideally) - dynamically generated content will kill you quicker than anything else, especially calls to a database. WordPress is very easy to kill in it's default state. 2. Kill high frequency requests from the same location as quickly as possible (make sure your res…
For #2 -- how do you "kill" high frequency requests? By ignoring them?
I find that using a combination of nginx's limit_req and fail2ban over nginx logs is an easy measure that already goes a long way in handling basic types of DoS, like clients producing an abnormally high volume of requests.
I was lead developer on Arbor Network's DDoS product in the early 2000s (I left in 2005 to start Matasano Security). My information on this is surely dated, but people seem to still be using the same terminology now as then. You can break down DDoS into roughly three categories: 1. Volumetric (brute force) 2. Application (targeting specific app endpoints) 3. Protocol (exploiting protocol vulnerabilities) DDoS mitigat…
What happens when it doesn't work? For instance why does something like Mirai happen? The first D is too D?
It's definitely not the case that all DDoS attacks can be reliably cleaned up in an ISP scrubbing center.
Earlier quoted context omitted.
1. That would be just as illegal as the original attack; cybersecurity laws have no provisions for self-defense. (It's true that nations are attempting to negotiate clauses like that in international relations, but even if that pans out, it will definitely never be a privilege afforded to individuals) 2. Attack what? It's a distributed DoS, the calls are coming from all over. You mean going after every node sending t…
I know next to nothing about botnets, but i wonder if you could divert traffic from botnets to a fake server that does nothing other than trying to keep the connection open for as long as possible (or being super slow in general) in order to increase the number of open connections from the bot's side, in order to stall it from opening new connections or make it slow in general.
The easy answer: Load balancing Anycast is the most important piece of the puzzle, allowing you to route traffic to a bunch of different locations. Let's say you can handle 10 Gbps at a single location. If the traffic is evenly split between 100 destinations then you can have a single IP that can handle 1 Tbps of traffic. Of course, the setup behind these IPs might vary a lot, and one might even use DNS load balancin…
Load balancing is in place for all but the most trivial sites, though, so what you're really saying is horizontal scaling. Which is fine but expensive compared to pattern based mitigation techniques.
If you're going to find patterns to decide what to block then you first need to make sure you receive all the traffic. If a single entry point can't handle it, well, then you need to load balance the incoming traffic.