Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP Spoofing

idea.popcount.org

Post reply on HN
Print view View original

51–60 of 136 posts

Re: IP Spoofing

#51

Post by marcosdumay »

hueving wrote: post #38
criddell wrote: post #10

Earlier quoted context omitted.

I agree 100%. I've also wondered why ISPs don't do more to shut down customers that are participating in a DDOS (at least for DDOS attacks where the source IP isn't spoofed)? I would be very happy if my ISP were to let me know that something on my network is involved in an attack.

When it comes to ip spoofing based ddos attacks, the ISPs capable of tracking spoofed traffic on their network don't allow spoofed traffic. If they don't allow the spoofed traffic, you aren't participating in the DDoS.

It's about blocking non-spoofed attacks.

Re: IP Spoofing

#52

Post by w8rbt »

erichocean wrote: post #40
hueving wrote: post #31

Earlier quoted context omitted.

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…

> the crusade to end useful UDP protocols is successful What? What crusade? I love UDP, use it every chance I get. Who is "crusading" to end UDP on the Internet?

All the orgs suffering from amplification attacks from services using UDP. DNS, NTP, chargen, etc.

Re: IP Spoofing

#53

Post by tuxidomasx »

Since IP spoofing could be done by a few malicious hosts, is it really accurate to consider a DoS via ip spoofing 'distributed'? Sure the source IPs may appear to come from all over, but that's just an illusion.

When I think DDos, I envision thousands of compromised hosts all over the internet making requests to a target to consume resources.

Re: IP Spoofing

#54

Post by majke »

tuxidomasx wrote: post #53

Since IP spoofing could be done by a few malicious hosts, is it really accurate to consider a DoS via ip spoofing 'distributed'? Sure the source IPs may appear to come from all over, but that's just an illusion. When I think DDos, I envision thousands of compromised hosts all over the internet making requests to a target to consume resources.

It's impossible to say if the attacker owns one beefy server or a thousand of bots.

Re: IP Spoofing

#55

Post by silverwind »

majke wrote: post #34
hueving wrote: post #31

Earlier quoted context omitted.

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…

This is precisely the point of this article. The only real long term solution to stop large DDoS is to stop spoofing. The only way to stop IP spoofing is to shame misconfigured networks. For that you need attribution.

Recent HTTP DDoS attacks have shown that there is no dependency on spoofing. The problem will be there as long as there's insecure hardware out there.

Re: IP Spoofing

#56

Post by MOARDONGZPLZ »

Can someone explain the consequences of DDoS attacks to me? My understanding is that the worst case is that the target server goes offline for the duration of the attack.

If that's indeed the endgame, it seems like a lot of work on the attacker's part to disable a company's servers for a bit, but maybe I"m missing something? The article did mention servers boiling, but that was likely hyperbole unless there's a way to physically damage servers with DDoS.

Re: IP Spoofing

#57

Post by Z1nfandel »

MOARDONGZPLZ wrote: post #56

Can someone explain the consequences of DDoS attacks to me? My understanding is that the worst case is that the target server goes offline for the duration of the attack. If that's indeed the endgame, it seems like a lot of work on the attacker's part to disable a company's servers for a bit, but maybe I"m missing something? The article did mention servers boiling, but that was likely hyperbole unless there's a way t…

Imagine you are a news outlet. You make money by creating articles that entice people to view your website. You make money to pay your expenses by having advertisements on your website.

DDoS = No Website. No Website = no users viewing ads. No users viewing ads = No income.

Yes, that typically resolves quickly. Depending on your hosting agreement, you may have to pay for all the excess bandwidth that the DDoS bots used.

Now imagine if you are a bank, users want to be able to access their accounts/funds/etc. How long would you remain with your bank if you frequently couldn't access your information because they were being DDoS'd.

Re: IP Spoofing

#58

Post by alex- »

MOARDONGZPLZ wrote: post #56

Can someone explain the consequences of DDoS attacks to me? My understanding is that the worst case is that the target server goes offline for the duration of the attack. If that's indeed the endgame, it seems like a lot of work on the attacker's part to disable a company's servers for a bit, but maybe I"m missing something? The article did mention servers boiling, but that was likely hyperbole unless there's a way t…

You are correct a DDoS (Distributed Denial Of Service) is intended to take a target off line or simply slow down the target significantly (ideally making the service useless)

While it is very unlikely to cause hardware damage it can be extremely damaging to a company or service.

Service outages undermine customer trust and could drive users to your competitors. A company might also have a service level agreement with large financial costs associated with a service being down.

If you don't mind the service being down, then why have it? It going down will probably have some very negative effect.

Re: IP Spoofing

#59

Post by mschuster91 »

marcosdumay wrote: post #46
AndyMcConachie wrote: post #43

A couple things: 1) There is no evidence that the recent giant DDOS attacks on Brian Krebs used IP Spoofing. In fact, there is every reason to believe that they did not since the generators of the packets were low powered IoT devices. There is increasingly little reason for attackers to even bother with IP spoofing given how easy it is becoming to capture giant herds of low power IoT devices. The attackers don't care…

You answered your question there. Without spoofing, only the largest botnets can launch a successful DDoS attack. That's a big barrier to entry, and if the police were effective on this area, would be a huge boom to fighting those attacks.

> Without spoofing, only the largest botnets can launch a successful DDoS attack. That's a big barrier to entry

In the days of Shodan, NO. Absolute no. 100/10 or 50/5 MBit/s household networking is becoming the norm in Germany, and other countries are way ahead of us Germans. Add in the fact that people with lots of (crappy) IoT devices are people who also have the money for high-speed internet connection...

Then throw in a couple of stro's at DCs with good interconnections, and you got yourself a niiiiiiiice huge botnet. You can do LOTS of damage if you get maybe ten or twenty servers with 10 GBit/s links under your control! (10 servers = 100 GBit/s, 10% of the Krebs attack IIRC)

Re: IP Spoofing

#60

Post by mjevans »

majke wrote: post #34
hueving wrote: post #31

Earlier quoted context omitted.

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…

This is precisely the point of this article. The only real long term solution to stop large DDoS is to stop spoofing. The only way to stop IP spoofing is to shame misconfigured networks. For that you need attribution.

You need to go one step beyond attribution. You need to make BCP 38 and other 'behave nicely' protocols /requirements/; and to block any ISP that isn't following them.
Post reply on HN