Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The real reason for large DDoS attacks? It's IP Spoofing, not memcached

blog.cloudflare.com

Post reply on HN
Print view View original

21–30 of 38 posts

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#21

Post by mindslight »

chatmasta wrote: post #4

Are there any valid technical use-cases for IP spoofing? i.e. setting the source address of a UDP packet as one outside the originating network? For example, on the server side, BGP hijacking and anycast routing are enabled by the same bug or feature, depending how you look at it.

Of course there are, just like there are many valid reasons for leaving a return address off of postal mail.

Imagine the anonymity of the type of P2P networks that could be built if end users could still rely on ip->saddr not being required. Broadcast a request for a specific file, and then willing/able peers could anonymously stream fountain-coded bulk data, and nobody would be able to tell who actually supplied the file.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#22

Post by walterkobayashi »

betaby wrote: post #16

Your incumbent won't do filtering. Your incumbent won't maintain proper 'route' objects https://www.ripe.net/manage-ips-and-asns/db/support/managing... Your shoestring independent ISP won't to that either. Who is left? Tier1 ISP and some of them do BCP38 filtering sometimes on some ports.

75% ISP's in Europe don't do IP Filtering.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#23

Post by r00fus »

mehrdadn wrote: post #5
superkuh wrote: post #2

>Let's take a deep breath and discuss why such large DDoS attacks are even possible on the modern internet. Because all traffic is treated at face value and not deep filtered and throttled according to some company's whims. Cloudflare wants to change this. Cloudflare wants centralization. Cloudflare wants blacklists.

Is egress filtering really that egregious?

Does it profit the ISPs to avoid/neglect egress filtering?

Who stands to gain from this and how much are they willing to kickback for "looking the other way"?

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#24

Post by dpark »

r00fus wrote: post #23
mehrdadn wrote: post #5

Earlier quoted context omitted.

Is egress filtering really that egregious?

Does it profit the ISPs to avoid/neglect egress filtering? Who stands to gain from this and how much are they willing to kickback for "looking the other way"?

Bad/undesired decisions don’t require blatant corruption. This seems a simple case of poor incentives. If an ISP does egress filtering well, essentially no one notices. If they screw it up, customers lose connectivity and some portion of those customers will likely leave for a competitor. There’s risk with no reward.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#25

Post by sinnet3000 »

omribahumi wrote: post #18
chatmasta wrote: post #4

Are there any valid technical use-cases for IP spoofing? i.e. setting the source address of a UDP packet as one outside the originating network? For example, on the server side, BGP hijacking and anycast routing are enabled by the same bug or feature, depending how you look at it.

There’s one reason I could think of. Combining two Internet lines together to get a faster connection. I blogged about this a few years back https://omri.org.il/2014/08/08/hacking-asymmetric-and-symmet...

Pretty cool! Are you still doing that??

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#26

Post by zaarn »

chatmasta wrote: post #4

Are there any valid technical use-cases for IP spoofing? i.e. setting the source address of a UDP packet as one outside the originating network? For example, on the server side, BGP hijacking and anycast routing are enabled by the same bug or feature, depending how you look at it.

There are some legit uses to faking the source of an UDP address. Usually clustering or failover. Can also be useful when you have multiple gateways to the internet.

There is also, always, penetration testing where you legit want to do it to see if the network holds up to it.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#27

Post by lmb »

r00fus wrote: post #23
mehrdadn wrote: post #5

Earlier quoted context omitted.

Is egress filtering really that egregious?

Does it profit the ISPs to avoid/neglect egress filtering? Who stands to gain from this and how much are they willing to kickback for "looking the other way"?

There is so called "bulletproof" hosting which usually includes being able to spoof IP. So yes, there are economic incentives.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#28

Post by omribahumi »

sinnet3000 wrote: post #25
omribahumi wrote: post #18

Earlier quoted context omitted.

There’s one reason I could think of. Combining two Internet lines together to get a faster connection. I blogged about this a few years back https://omri.org.il/2014/08/08/hacking-asymmetric-and-symmet...

Pretty cool! Are you still doing that??

Nope. The company was shut down

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#29

Post by citrin_ru »

walterkobayashi wrote: post #22
betaby wrote: post #16

Your incumbent won't do filtering. Your incumbent won't maintain proper 'route' objects https://www.ripe.net/manage-ips-and-asns/db/support/managing... Your shoestring independent ISP won't to that either. Who is left? Tier1 ISP and some of them do BCP38 filtering sometimes on some ports.

75% ISP's in Europe don't do IP Filtering.

According to CAIDA statistics much less that 75% don't filter. See map: https://spoofer.caida.org/summary.php
Post reply on HN