Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikileaks moves to Amazon's cloud to evade massive DDoS

arstechnica.com

Post reply on HN
Print view View original

41–50 of 70 posts

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#41

Post by wpeterson »

jjoe wrote: post #15

It looks like it's hosted in the US (ec2-184-72-37-90.us-west-1.compute.amazonaws.com). Also, the front end proxy is doing some heavy filtering to weed out the cheap hit-and-run nodes participating in the DDoS but still accepts legitimate browser-based requests (persistent). Notice how a Reset (R) is sent right away on the first try: 08:57:41.211436 IP managed.unixy.net.49467 > ec2-184-72-37-90.us-west-1.compute.amaz…

I would think this is interesting enough as a scale/anti-DDOS exercise to merit support from Amazon and other folks regardless of your political stance on wikileaks.

EC2 and Cloudfront are powerful technologies, here's hoping they're transparent and publish their solutions/tools.

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#42

Post by trotsky »

jjoe wrote: post #15

It looks like it's hosted in the US (ec2-184-72-37-90.us-west-1.compute.amazonaws.com). Also, the front end proxy is doing some heavy filtering to weed out the cheap hit-and-run nodes participating in the DDoS but still accepts legitimate browser-based requests (persistent). Notice how a Reset (R) is sent right away on the first try: 08:57:41.211436 IP managed.unixy.net.49467 > ec2-184-72-37-90.us-west-1.compute.amaz…

I guess this explains why netcraft keeps showing their website as mostly down worldwide for the last day or so when it's actually performing extremely well.

Question: why does the RST packet identify non-existent nodes? Doesn't TCP sequence prevent a blind continuation of a http request? Is this just one type of syn flood protection?

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#43

Post by sigzero »

ars wrote: post #38

Doesn't hosting with Amazon create a money trail? If the US were to prosecute them, they could subpoena Amazon, and find more members of the organization. Assange is knowingly putting himself in the line of fire, but isn't there a goal to make sure other members of wikileaks stay anonymous?

Why should other members be anonymous? Isn't that hypocritical since Wikileaks is all about transparency?

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#44

Post by sigzero »

jonhendry wrote: post #33
brianr wrote: post #4

This is very interesting. If Wikileaks does in fact become designated a terrorist organization by the US, then it seems Amazon will have to shut them down or run the risk of providing them "material aid". The same would be true of any other cloud provider... are there any sizable cloud providers outside the US?

If Wikileaks is a terrorist, then so too is the New York Times, and any other media outlet that has conveyed the same information Wikileaks released.

That is a logical fallacy.

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#45

Post by TallGuyShort »

sigzero wrote: post #43
ars wrote: post #38

Doesn't hosting with Amazon create a money trail? If the US were to prosecute them, they could subpoena Amazon, and find more members of the organization. Assange is knowingly putting himself in the line of fire, but isn't there a goal to make sure other members of wikileaks stay anonymous?

Why should other members be anonymous? Isn't that hypocritical since Wikileaks is all about transparency?

It's also all about protecting whistle blowers. They've put a lot of thought into ways of covering the tracks of people who come to them to keep them safe - I don't think it's hypocritical. They're concerned for their safety, not their politics.

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#47

Post by JoachimSchipper »

tibbon wrote: post #39
JoachimSchipper wrote: post #20

Earlier quoted context omitted.

Surviving DoS attacks is not a new problem; I'm sure that Amazon has quite a bit of experience in that area. But thanks for the trace, quite interesting!

I wonder how well their Cloudfront CDN holds up for delivering static content in the face of a DDoS vs just using heavy static cachine with ngnix or apache on EC2.

Probably better, the CDN should be able to absorb much more traffic. (At 10Gbps, you need to worry about the attackers saturating your upstream pipe. Forget responding, just receiving that much traffic is nontrivial. EC2 nodes are probably networked using gigabit ethernet, so no matter how clever you get you can't solve this with everyone's favorite "single load balancer plus nginx web servers".)

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#48

Post by JoachimSchipper »

ars wrote: post #38

Doesn't hosting with Amazon create a money trail? If the US were to prosecute them, they could subpoena Amazon, and find more members of the organization. Assange is knowingly putting himself in the line of fire, but isn't there a goal to make sure other members of wikileaks stay anonymous?

I'm sure there are ways around that. Give Assange a boatload of prepaid credit cards, have him pay Amazon, something like that.

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#49

Post by JoachimSchipper »

jules wrote: post #28
JoachimSchipper wrote: post #21

Earlier quoted context omitted.

> the laws of the EU We are, sadly, not quite that far along yet.

Sadly? The things that come out of the EU are at least as stupid as local laws, especially wrt technology.

The US has a massive commercial advantage because its laws, while not better per se, are at least uniform.

Also, European national states are mostly too weak to have any influence in the global problems of the 21st century. A smaller share of a larger (power) pie would still be an improvement.

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#50

Post by jjoe »

trotsky wrote: post #42
jjoe wrote: post #15

It looks like it's hosted in the US (ec2-184-72-37-90.us-west-1.compute.amazonaws.com). Also, the front end proxy is doing some heavy filtering to weed out the cheap hit-and-run nodes participating in the DDoS but still accepts legitimate browser-based requests (persistent). Notice how a Reset (R) is sent right away on the first try: 08:57:41.211436 IP managed.unixy.net.49467 > ec2-184-72-37-90.us-west-1.compute.amaz…

I guess this explains why netcraft keeps showing their website as mostly down worldwide for the last day or so when it's actually performing extremely well. Question: why does the RST packet identify non-existent nodes? Doesn't TCP sequence prevent a blind continuation of a http request? Is this just one type of syn flood protection?

Most likely, the initial Netcraft attempt to connect is met with a RST. Subsequent attempts are also met with the same RST. This is because the attempts are spaced out in time enough for the original ACL, permitting access, to be flushed.

According to the RFC, the RST does not get an ACK if the initiating node is "legitimate." So the "silence" or non-ACK is a good sign, which results in the initiating node being added to the ACL. You don't want plain TCP handling this because of half-open TCP handshakes which can exhaust kernel data structures (memory) and CPU (from having the kernel sift through a large data set).

Regards

Post reply on HN