Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP Spoofing

idea.popcount.org

Post reply on HN
Print view View original

41–50 of 136 posts

Re: IP Spoofing

#41

Post by packetized »

dsp1234 wrote: post #35
packetized wrote: post #32

Earlier quoted context omitted.

Flatly incorrect. The latest and largest attacks are generally UDP reflection attacks, with a smattering of TCP SYN flood & pure L7 attacks thrown in.

latest and largest attacks Except for the latest and largest attacks: OVH @ near 1Tb/s in combined tcp_ack traffic on 2016/09/20 [0] When attackers have 150k+ comprimised hosts, with 1-30Mb/s each, there is no need for reflection/stealth/source spoofing/etc. At those levels, the attackers can just point them to an IP with 'normal' traffic and it's enough to be devastating. [0] - https://twitter.com/olesovhcom/status/…

Apologies, I stand corrected.

Re: IP Spoofing

#42

Post by complaint »

That was an excellent presentation, very informative.

Except, why put that ridiculous meme in the middle of it? It's cringeworthy seeing an excellent technical presentation littered with such childish imagery.

(Not that I agree with this bastardization of "meme" to mean "silly image with text overlaid in capital letters", but unfortunately that is what everyone is calling these things.)

Re: IP Spoofing

#43

Post by AndyMcConachie »

A couple things:

1) There is no evidence that the recent giant DDOS attacks on Brian Krebs used IP Spoofing. In fact, there is every reason to believe that they did not since the generators of the packets were low powered IoT devices. There is increasingly little reason for attackers to even bother with IP spoofing given how easy it is becoming to capture giant herds of low power IoT devices. The attackers don't care if some of their herd gets taken offline due to effective attribution.

Amplification/reflection attacks which will still require IP spoofing. What I'm curious about, and only time will tell, is how much IP spoofing will continue to play a part in lsrge DDOS attacks? Why bother spoofing IPs if your botnet herd is already large enough to bring someone offline?

2) Go and download CAIDA's Spoofer application. Test it and give them bug reports. I gave them one a few weeks ago. https://www.caida.org/projects/spoofer/

Re: IP Spoofing

#44

Post by xxdesmus »

dom0 wrote: post #15
mordocai wrote: post #11

Earlier quoted context omitted.

Of course, I'm not sure if cloudflare could care any less about tor users. They see a lot of attack traffic from tor so this probably isn't something they are concerned about. I can't really blame them from a business perspective, but I avoid cloudflare due to it.

> They see a lot of attack traffic from tor This was debunked.

"This was debunked."

Where exactly?

No one claimed Tor was sending DDoS attacks -- plenty of other malicious traffic comes out of Tor however.

Re: IP Spoofing

#45

Post by majke »

complaint wrote: post #42

That was an excellent presentation, very informative. Except, why put that ridiculous meme in the middle of it? It's cringeworthy seeing an excellent technical presentation littered with such childish imagery. (Not that I agree with this bastardization of "meme" to mean "silly image with text overlaid in capital letters", but unfortunately that is what everyone is calling these things.)

To wake up the audience and emphasize the message :) Also, to divide the presentation sharply between: problem statement and the solution.

Re: IP Spoofing

#46

Post by marcosdumay »

AndyMcConachie wrote: post #43

A couple things: 1) There is no evidence that the recent giant DDOS attacks on Brian Krebs used IP Spoofing. In fact, there is every reason to believe that they did not since the generators of the packets were low powered IoT devices. There is increasingly little reason for attackers to even bother with IP spoofing given how easy it is becoming to capture giant herds of low power IoT devices. The attackers don't care…

You answered your question there. Without spoofing, only the largest botnets can launch a successful DDoS attack. That's a big barrier to entry, and if the police were effective on this area, would be a huge boom to fighting those attacks.

Re: IP Spoofing

#47

Post by majke »

AndyMcConachie wrote: post #43

A couple things: 1) There is no evidence that the recent giant DDOS attacks on Brian Krebs used IP Spoofing. In fact, there is every reason to believe that they did not since the generators of the packets were low powered IoT devices. There is increasingly little reason for attackers to even bother with IP spoofing given how easy it is becoming to capture giant herds of low power IoT devices. The attackers don't care…

There is evidence that IP spoofing was _not_ used in the Krebs attacks:

https://twitter.com/briankrebs/status/780139030939828224

This does not invalidate this presentation though. The recent IoT attacks are a new wave, but the point is:

- if it's not IP spoofing - you can track the botnet and eventually destroy it. I'm not saying it's easy or hard, but that it's technically possible.

- if the attack is IP spoofing, it's very hard to track it down and destroy the source.

Re: IP Spoofing

#48

Post by aidenn0 »

AndyMcConachie wrote: post #43

A couple things: 1) There is no evidence that the recent giant DDOS attacks on Brian Krebs used IP Spoofing. In fact, there is every reason to believe that they did not since the generators of the packets were low powered IoT devices. There is increasingly little reason for attackers to even bother with IP spoofing given how easy it is becoming to capture giant herds of low power IoT devices. The attackers don't care…

Footnote at bottom of article specifically mentioning #1

Re: IP Spoofing

#49

Post by zAy0LfpBZLC8mAC »

hueving wrote: post #31
mrb wrote: post #22

I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers ( http://blog.zorinaq.com/nginx-resolver-vulns/ ) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can't be done on the Internet…

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…

> It's a form of victim blaming.

1. Victim blaming is when you excuse someone's bad behaviour with the justification that the person(s) negatively affected by it could have protected/tried to protect themselves against it. That doesn't have anything to do with the question whether you should try to protect yourself, or whether you might have some obligation to try and protect others.

2. Based on your logic, what you are doing would be victim blaming: Incompetent ISPs don't perform DDoS attacks, and yet you seem to see some sort of obligation on their part to implement BCP 38 to protect others from that bad behavior of others. The ISP is just as much a victim in a position where they can help and protect others as people running UDP services.

Re: IP Spoofing

#50

Post by criddell »

hueving wrote: post #38
criddell wrote: post #10

Earlier quoted context omitted.

I agree 100%. I've also wondered why ISPs don't do more to shut down customers that are participating in a DDOS (at least for DDOS attacks where the source IP isn't spoofed)? I would be very happy if my ISP were to let me know that something on my network is involved in an attack.

When it comes to ip spoofing based ddos attacks, the ISPs capable of tracking spoofed traffic on their network don't allow spoofed traffic. If they don't allow the spoofed traffic, you aren't participating in the DDoS.

Absolutely. No ISP should allow a packet with a spoofed IP leave it's network.
Post reply on HN