Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The real reason for large DDoS attacks? It's IP Spoofing, not memcached

blog.cloudflare.com

Post reply on HN
Print view View original

31–38 of 38 posts

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#31

Post by blackflame7000 »

dpark wrote: post #24
r00fus wrote: post #23

Earlier quoted context omitted.

Does it profit the ISPs to avoid/neglect egress filtering? Who stands to gain from this and how much are they willing to kickback for "looking the other way"?

Bad/undesired decisions don’t require blatant corruption. This seems a simple case of poor incentives. If an ISP does egress filtering well, essentially no one notices. If they screw it up, customers lose connectivity and some portion of those customers will likely leave for a competitor. There’s risk with no reward.

Couldn't there perhaps be a financial incentive by reducing the amount of superfluous data on their networks?

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#32

Post by grahamburger »

betaby wrote: post #16

Your incumbent won't do filtering. Your incumbent won't maintain proper 'route' objects https://www.ripe.net/manage-ips-and-asns/db/support/managing... Your shoestring independent ISP won't to that either. Who is left? Tier1 ISP and some of them do BCP38 filtering sometimes on some ports.

As someone who has been doing 'shoestring independent ISPs' for almost 15 years my impression is that nearly all upstream providers (the ones we buy service from - not always but sometimes tier 1 providers) do outgoing IP filtering. Whenever I get a new IPv4 allocation from ARIN (at least when we used to be able to do that - they're all gone now) we had to go through a process with our upstream provider so that they would allow our BGP advertisements for that block as well as allow those source addresses to route through their network.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#33

Post by makomk »

hueving wrote: post #19

This is a refreshing change from cloudflare. Back when recursive DNS was the amplification de jour they complained about DNS instead of IP spoofing. https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-o...

This is an odd change from Cloudflare. Were it not for the DDoS amplification problem it'd be perfectly reasonable to make recursive DNS servers publicly accessible, but memcached servers should never be exposed to the public internet - they're not designed to be and doing so allows everyone to exfiltrate, modify or delete the cached data which you almost certainly don't want to be possible.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#34

Post by dpark »

blackflame7000 wrote: post #31
dpark wrote: post #24

Earlier quoted context omitted.

Bad/undesired decisions don’t require blatant corruption. This seems a simple case of poor incentives. If an ISP does egress filtering well, essentially no one notices. If they screw it up, customers lose connectivity and some portion of those customers will likely leave for a competitor. There’s risk with no reward.

Couldn't there perhaps be a financial incentive by reducing the amount of superfluous data on their networks?

Apparently not given the lack of action.

I’m not sure DDOS traffic is really significant from an egress standpoint.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#35

Post by tinus_hn »

chatmasta wrote: post #4

Are there any valid technical use-cases for IP spoofing? i.e. setting the source address of a UDP packet as one outside the originating network? For example, on the server side, BGP hijacking and anycast routing are enabled by the same bug or feature, depending how you look at it.

Bgp hijacking is possible because bgp isn’t really authenticated. It would be difficult to authenticate but if that were done it would not prevent anycast routing.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#36

Post by sathackr »

grahamburger wrote: post #32
betaby wrote: post #16

Your incumbent won't do filtering. Your incumbent won't maintain proper 'route' objects https://www.ripe.net/manage-ips-and-asns/db/support/managing... Your shoestring independent ISP won't to that either. Who is left? Tier1 ISP and some of them do BCP38 filtering sometimes on some ports.

As someone who has been doing 'shoestring independent ISPs' for almost 15 years my impression is that nearly all upstream providers (the ones we buy service from - not always but sometimes tier 1 providers) do outgoing IP filtering. Whenever I get a new IPv4 allocation from ARIN (at least when we used to be able to do that - they're all gone now) we had to go through a process with our upstream provider so that they…

They may filter what routes you can advertise via BGP, but nearly every Tier 1(And most Tier 2) providers will accept traffic sourced from any IP address. I handle about 10 different connections and can source traffic from any IP on all of them.

Re: The real reason for large DDoS attacks? It's IP Spoofing, not memcached

#37

Post by hueving »

makomk wrote: post #33
hueving wrote: post #19

This is a refreshing change from cloudflare. Back when recursive DNS was the amplification de jour they complained about DNS instead of IP spoofing. https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-o...

This is an odd change from Cloudflare. Were it not for the DDoS amplification problem it'd be perfectly reasonable to make recursive DNS servers publicly accessible, but memcached servers should never be exposed to the public internet - they're not designed to be and doing so allows everyone to exfiltrate, modify or delete the cached data which you almost certainly don't want to be possible.

Right, exposing a memcached server is bad because memcached isn't meant to be public. However, in the context of DRDoS discussions it doesn't matter if the UDP service is good for public exposure. That's completely a distraction from the underlying IP spoofing disease that enables attacks on all connectionless protocols.
Post reply on HN