Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FCC says its cybersecurity measures to prevent DDoS attacks must remain secret

techcrunch.com

Post reply on HN
Print view View original

21–30 of 35 posts

Re: FCC says its cybersecurity measures to prevent DDoS attacks must remain secret

#21

Post by andrewstuart2 »

tdeck wrote: post #16
oneplane wrote: post #2

Because obscurity is the best security!... right? FCC knows what's best for everyone.

Isn't DDOS mitigation an area where obscurity is the standard? I am no expert on this but it seems like most providers keep the info about how they filter traffic pretty close to the chest.

I'm by no means a networking professional, so maybe take this with a grain of salt, but no, your only two options are to handle the traffic or not. At low DDOS level you can offload certain traffic like dropping packets from certain IPs before your web layer gets to deeper inspection, but if there is enough traffic to overwhelm your layer 3 devices, you'll drop packets on the floor.

Alternatively you can usually let Akamai or similar advertise your IPs, and let them help with the load, but ultimately that's just distributing traffic to more devices so you can still check IPs against a blacklist.

Since we're talking about the availability aspect of security, there is hopefully no obscurity involved (confidentiality on the other hand is nothing but obscurity). And really, an obscurity technique like using alternate ports won't even help you much because that still hits your firewall and requires processing on each packet.

Re: FCC says its cybersecurity measures to prevent DDoS attacks must remain secret

#22

Post by 0xcde4c3db »

tdeck wrote: post #16
oneplane wrote: post #2

Because obscurity is the best security!... right? FCC knows what's best for everyone.

Isn't DDOS mitigation an area where obscurity is the standard? I am no expert on this but it seems like most providers keep the info about how they filter traffic pretty close to the chest.

As far as I can tell (as someone in the networking field but not a DDoS or HA expert), the standard for DDoS mitigation is basically "be bigger": too many POPs/routes, too much capacity to eat packets and establish TCP connections, capacity to serve cached responses, etc. such that even a huge attack simply can't exhaust your resources. To even think about classification and filtering means that you're somehow ingesting and processing this stuff; DDoS becomes threatening exactly when you lack the capacity to do that.

Re: FCC says its cybersecurity measures to prevent DDoS attacks must remain secret

#24

Post by honestoHeminway »

kakarot wrote: post #23

Security by obfuscation... That's not a good sign.

Secret in the public eyes translates to glamorous, dangerous, expensive and execlusive.

Secret in the eyes of developers translates to lousy, stolen, uncredited work, security by obfuscation and shady buisness practices.

Re: FCC says its cybersecurity measures to prevent DDoS attacks must remain secret

#25

Post by mattmanser »

hilyen wrote: post #6
MikeKusold wrote: post #5

Earlier quoted context omitted.

While I suspect the DDOS was fabricated, the linked reddit comment is flawed. They claim that because the FCC uses Akamai as a CDN, that the FCC is immune from DDOS attacks. The FCC comment section is heavily reliant on a database, and you could simply overwhelm the database to DDOS that site. I would bet it is unlikely that the FCC utilized a cache for the queries.

It really depends, the calls to their database wouldn't be direct, it'd be through a REST API which then communicates with a DB. That REST API likely has some sort of DDOS protection, like for example how cloudflare protects ALL requests to the domain. But anyway, their excuse that it needs to be secret is BS, DDOS protection methods are widespread and not very secret as it is. They probably just want to keep it secr…

You have to set up protection on an API, it doesn't come magically installed by default.

Re: FCC says its cybersecurity measures to prevent DDoS attacks must remain secret

#26

Post by codedokode »

hilyen wrote: post #6
MikeKusold wrote: post #5

Earlier quoted context omitted.

While I suspect the DDOS was fabricated, the linked reddit comment is flawed. They claim that because the FCC uses Akamai as a CDN, that the FCC is immune from DDOS attacks. The FCC comment section is heavily reliant on a database, and you could simply overwhelm the database to DDOS that site. I would bet it is unlikely that the FCC utilized a cache for the queries.

It really depends, the calls to their database wouldn't be direct, it'd be through a REST API which then communicates with a DB. That REST API likely has some sort of DDOS protection, like for example how cloudflare protects ALL requests to the domain. But anyway, their excuse that it needs to be secret is BS, DDOS protection methods are widespread and not very secret as it is. They probably just want to keep it secr…

> like for example how cloudflare protects ALL requests to the domain.

The primary purpose of cloudflare is to hide the IP address of the server and filter packets on IP level. It does not magically protects from any attack, especially on application level.

It is wrong to assume that there is a universal automatic solution against DDOS. Neither CDN nor Cloudflare nor REST API (how?) can help with this.

Re: FCC says its cybersecurity measures to prevent DDoS attacks must remain secret

#27

Post by yebyen »

stock_toaster wrote: post #20
saagarjha wrote: post #4

Translation: their protection is bad and they don't want to reveal its mediocrity publicly, or there was no attack.

My guess is both. The actual volume of semi-automated (there were a few canned form submission tools) negative feedback may have resulted in a DOS (due to unexpected volume), and the mitigation was probably just to write it to /dev/null.

There was most definitely an automated (fraudulent) effort, if you doubt it go and see [1] if submissions were made in members of your family's name. I have no idea if it's Comcast doing it, my impression is that's just a catchy name for the site.

There is a complex regex search that the site uses to find copies of "the comment" – I was shocked how many of my family members (not with their actual addresses, but names of actual members of my family) filed brief comments that start out "The unprecedented regulatory power the Obama Administration imposed on the internet is smothering innovation, damaging the American economy and obstructing job creation."

Presumably the text is varied in order to hamper the efforts of people like Comcastroturf that are trying to help quantify the number of these fraudulent comments that were filed.

I have no idea if the volume of these type of comments are enough to constitute a "DoS" attack, let alone DDOS, but the scale is quite grand.

I was shocked how few names I had to try before I found copies of "the comment" in filings in the names of many members of my family. Maybe about 50% hit rate. Higher with a common name.

[1]: http://www.comcastroturf.com

Re: FCC says its cybersecurity measures to prevent DDoS attacks must remain secret

#29

Post by arca_vorago »

lilott8 wrote: post #17
featherverse wrote: post #9

Earlier quoted context omitted.

> But anyway, their excuse that it needs to be secret is BS, DDOS protection methods are widespread and not very secret as it is. They probably just want to keep it secret, because they don't actually have proper DDOS protection. This. At what point did the government become a special interest group which does not exist to protect the nation it serves? Providing good security advice is their job. Even if they do have…

Not only that, in what way does an independent agency having zero ties to national security or the IC have any right to hold just about* anything secret? This is asinine!

I think you underestimate just how far we've allowed natsec expansion to taint even the most benign agencies.

As a constitutionalist, the real problem as I have condensed it is that the balance between providing for the common defense has completely overshadowed things like securing the blessings of liberty. Our gov is increasingly leaning authoritarian, and the populace has allowed it.

Re: FCC says its cybersecurity measures to prevent DDoS attacks must remain secret

#30

Post by zamalek »

yebyen wrote: post #27
stock_toaster wrote: post #20

Earlier quoted context omitted.

My guess is both. The actual volume of semi-automated (there were a few canned form submission tools) negative feedback may have resulted in a DOS (due to unexpected volume), and the mitigation was probably just to write it to /dev/null.

There was most definitely an automated (fraudulent) effort, if you doubt it go and see [1] if submissions were made in members of your family's name. I have no idea if it's Comcast doing it, my impression is that's just a catchy name for the site. There is a complex regex search that the site uses to find copies of "the comment" – I was shocked how many of my family members (not with their actual addresses, but names…

So the reason FCC won't release these records is that they don't want to implicate their boss?
Post reply on HN