Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Jerks on the Internet: what my first DDoS taught me

sergiomattei.com

Post reply on HN
Print view View original

81–90 of 95 posts

Re: Jerks on the Internet: what my first DDoS taught me

#81

Post by dangerface »

fxfan wrote: post #29

Does anybody have experience in getting DDOS'd? All i see are 3 ip addresses (offending) in the screenshot and it makes me wonder how many is typical? I have never been ddos's and all I ever receive are failed ssh attempts with simple passwords. Pretty much the easiest thing to tackle. But I'd love to know from DDOS'd people how their attacks looked? From cloudflare logs all I see is a single IP address being blocked…

I have had this before similar situation to op they found a heavy page that hammered the database until it went down. Banning their ip at the firewall stopped them, they came back a few days latter using a bunch of proxies about 1000. I wrote a script like Fail2Ban that detected the ip and blocked it worked a treat.

I was also attacked by a single ip that sent 10gbit of nonsense to apache, I had to contact my isp to get them to block the ip down stream from me, if they had used a bot net I don't think I would have been able to stop it.

Re: Jerks on the Internet: what my first DDoS taught me

#82

Post by DaniloDias »

veryworried wrote: post #45
Animats wrote: post #44

If you have some kind of expensive request, use fair queuing by IP address. If someone has a request pending, more requests from the same source go behind IP addresses with fewer requests. So each IP address competes with itself, not others. For some reason, this isn't done much. I have it on a site of mine. I didn't notice for a week that someone was making a huge number of requests and not even waiting for the task…

It’s not used because any serious attack is going to come from multiple unrelated sources, think a botnet full of compromised IoT devices hitting your server with 20TB a second worth of requests. So you might as well plan for that scenario instead.

Has anyone seen a 20TB attack?

Re: Jerks on the Internet: what my first DDoS taught me

#83

Post by Topgamer7 »

rlue wrote: post #53

Can anyone shed some light on why someone would go out of their way to conduct an attack like this? Is DoSing production web applications just a hobby for black hat jackasses with nothing better to do?

Everyone has mentioned the destructive nature of some people. However I would also point out that some use a DoS as a means to cover up trails in logs and distract the admin from another type of attack. If you're paying attention to the DoS, you might not notice any logs or alerts about someone downloading 6GB of data from your database.

Re: Jerks on the Internet: what my first DDoS taught me

#84

Post by Topgamer7 »

kristiandupont wrote: post #42
jmchuster wrote: post #40

Hope 10% of this might be useful to you. 1) the three most important metrics for any endpoint are error rate, lantency, throughput. So i hope you've learned to not be surprised that abnormal throughput (either via ddos attacks or friendly n+1 queries) is a common error condition. 2) banning ip addresses is useless and often counter productive. If possible, short-circuit requests from an ip so you can isolate them and…

>short-circuit requests from an ip What does that mean?

In an electrical circuit you have the defined path a current is supposed to take. A short circuit is when the current takes a shorter path to the ground. So A->B is the normal route a request would make. Short circuiting in this regard means A->C for that one ip. The goal is to reduce load on your server (IE you return a page that the attacker think is still valid, but has reduced load on your infra).

Re: Jerks on the Internet: what my first DDoS taught me

#85

Post by RHSeeger »

sergiomattei wrote: post #24
RHSeeger wrote: post #19

Why is the text for this article 2.5" wide in a normal browser? It makes it annoying to read :(

Thanks for the feedback! Will modify and enlarge the font a little bit.

Looks much better now, thanks for the update.

Re: Jerks on the Internet: what my first DDoS taught me

#86

Post by Animats »

hombre_fatal wrote: post #55
Animats wrote: post #46

Earlier quoted context omitted.

Those requests seldom get far enough to start significant server activity. It's the ones that look like legit requests that are the problem.

Only a small percentage of a volumetric attack has to get through to take you down. Also, depending on the attack, they probably all are "legit requests."

If the source IP is fake, the request can't get beyond the first packet. Those get filtered out easily. That's Cloudflare's main offering.

Re: Jerks on the Internet: what my first DDoS taught me

#87

Post by milesvp »

DaniloDias wrote: post #82
veryworried wrote: post #45

Earlier quoted context omitted.

It’s not used because any serious attack is going to come from multiple unrelated sources, think a botnet full of compromised IoT devices hitting your server with 20TB a second worth of requests. So you might as well plan for that scenario instead.

Has anyone seen a 20TB attack?

Never mind that the units would probably 20tb/s, it wouldn’t be impossible. We saturated our gig ethernet with 8 image upload workers from a flask app. We could have saturated a 20tb line (if such a thing existed) with 160000 workers. I’ve seen bot nets for rent with something like 30k bots. Which means you might be able rent enough machines with enough bandwidth to saturate 20tb/s for maybe $1k/hr. multiply by 8 if you really care about 20TB/s. I do think 20TB starts getting to be big players though, especially since anyone with that much bandwidth is going to have teams dedicated to mitigating these kinds of problems.

Re: Jerks on the Internet: what my first DDoS taught me

#88

Post by jrace »

DaniloDias wrote: post #82
veryworried wrote: post #45

Earlier quoted context omitted.

It’s not used because any serious attack is going to come from multiple unrelated sources, think a botnet full of compromised IoT devices hitting your server with 20TB a second worth of requests. So you might as well plan for that scenario instead.

Has anyone seen a 20TB attack?

The biggest DDoS attack to date took place in February of 2018. This attack targeted GitHub, a popular online code management service used by millions of developers. At its peak, this attack saw incoming traffic at a rate of 1.3 terabytes per second (Tbps), sending packets at a rate of 126.9 million per second.

https://www.cloudflare.com/learning/ddos/famous-ddos-attacks...

Re: Jerks on the Internet: what my first DDoS taught me

#89

Post by jessaustin »

jacobolus wrote: post #37
sergiomattei wrote: post #24

Earlier quoted context omitted.

Thanks for the feedback! Will modify and enlarge the font a little bit.

The font size is fine. The width of the text block is absolutely ridiculous. http://webtypography.net/2.1.2 https://practicaltypography.com/line-length.html

I opened the print dialog, and discovered that this short piece would take 65 pages to print. Yes, that is a sign that the width of the text block is absolutely ridiculous.

I couldn't figure out what's going on with my laptop, because the inspector short-circuited this goofy behavior. On a larger screen, I notice that the ".card-content" div has a ridiculous 150px of padding. It is nested in a ".card.blog-content-card" div, which has an atrocious 200px of margin. That in turn is nested in a ".blog-post-container.container" div, which has a merely unseemly 93px margin.

After 886px is used for white space, there's not much screen left for text. Might want to fix that?

Re: Jerks on the Internet: what my first DDoS taught me

#90

Post by chias »

cheschire wrote: post #64
joosters wrote: post #54

Earlier quoted context omitted.

That's an entirely different kind of attack. If your server is being flooded with 20TB/s of traffic, there's nothing you can do on the box itself to fix things. Whatever you do, the legitimate requests won't be able to get through. If however your DOS attack is an attacker making lower-volume CPU-expensive requests on your site, there's plenty of things to help mitigate the assault.

That's the key difference between a DOS and a DDOS, yes. Since I can't load the OP article on this machine for some reason, I can't review the symptoms described. The title of the article does say DDOS, however, which is focused more on saturating bandwidth, not CPU.

The headline and article itself do indeed (incorrectly) call it a DDOS attack. The attack itself was very much non-distributed, and involved a single malicious actor `curl`ing an expensive API endpoint in a loop.
Post reply on HN