Live data from Hacker News

“We have been experiencing a catastrophic DDoS attack”

status.linode.com

61–70 of 151 posts

Re: “We have been experiencing a catastrophic DDoS attack”

#61

I wonder if this is a diversion to keep Linode's security team busy so they won't notice someone compromising the Xen nodes with XSA-185/6/7/8?

Fascinating, seems believable.

XSAs are released alarmingly frequently. I've always wondered if KVM is really more secure or if it just gets less scrutiny (certainly there's a class of qemu vulnerabilities that impact both hypervisors).

Re: “We have been experiencing a catastrophic DDoS attack”

#62
post #58

Earlier quoted context omitted.

I'd love to see a network infrastructure and transport protocol that's more resistant to many (D)DoS attacks, because it seems like things will only worsen if it never becomes more difficult for people to attack others' servers online.

Good luck. A DDoS is basically lots of traffic. Perhaps run IPX? (Joking)

If application- and transmission-protocol-level DoS vectors are fixed, then you're left with just the raw "lots of traffic" volumetric attacks, which means your attacker has to have a lot of compromised hosts (or the right compromised hosts with lots of bandwidth). I'd say that's a reality that would be easier to handle, because you raised the bar from anyone who can develop or use a script and deploy to a few low-power systems, exploiting protocol shortcomings, to only those who have a bunch of higher-powered systems.

The smaller hosting companies may still very well go out of the game if the problem worsens, even if most DoS venues do end up being mitigated. I don't know how I would respond to that as of this moment, but hopefully it doesn't have to come to that. It's already tough to find a decent hosting company in my experience.

Re: “We have been experiencing a catastrophic DDoS attack”

#63
post #51

Earlier quoted context omitted.

I'm a one man operation keeping a master-slave setup with a manual failover and it's been pretty smooth sailing once I got it setup. Don't know how much more complex master-master would be.

It's pretty much the same. You almost never want writes on both sides (now in a failover plan anyway), so as long as you have a switch for which side receives the writes, it's simple.

Site A, insure any writes use odd numbers in unique field.

Site B, insure any writes use even numbers for unique field.

This avoids conflict.

Re: “We have been experiencing a catastrophic DDoS attack”

#67

I've done some googling before asking here: Can anybody explain why Linode is so often targeted like this? We moved Cronitor off Linode in spring 2015. During the christmas holiday when they suffered a 2 week DDOS I thought of the family time I'd be missing that year as we did a crash migration to AWS had we not migrated when we did. I have to imagine this has been horrible for their business. I would use Linode if I…

We were sort of in the same boat as you last year. We were already prepping our failover and it was about 95% ready to go when the DDOS started on our Christmas break (and our senior guy who did all of our deploys was out of communication). December 23rd was a difficult 10 hour, remote day but we got things finished up and could relax afterwards.

Re: “We have been experiencing a catastrophic DDoS attack”

#68

Earlier quoted context omitted.

For our setup we just have master-master replication across two different hosting providers.

I've been wondering about this lately. Is it really feasible for a small (one man?) team to keep master-master MySQL replication over WAN running smoothly?

[deleted]

Re: “We have been experiencing a catastrophic DDoS attack”

#69
post #59

Earlier quoted context omitted.

I think they very much want to, but what can you do if all of your IPs lead to tor exit nodes? From what I've heard, the FBI will collect a whole bunch of information and then sit on their hands because of the above reason.

How can tor nodes be used for that? Tor exposes a SOCKS interface, you can't control TCP/IP with the level of detail needed to perform these attacks.

Run the attack itself from a botnet of hacked computers, with the command and control server proxied behind TOR.
Post reply on HN