Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Wikileaks moves to Amazon's cloud to evade massive DDoS

arstechnica.com

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#61

Post by stcredzero »

ceejayoz wrote: post #55
netmau5 wrote: post #10

I know DDOS is a difficult problem to solve, but I think using the cloud to out-scale your attacker doesn't solve the problem, it just increases the cost of it. The obvious solution for the bad guys (not gonna call them hackers, can't call them crackers can I?) is to use the cloud too. Generating an HTTP request is even cheaper than serving static content on a CDN.

> The obvious solution for the bad guys (not gonna call them hackers, can't call them crackers can I?) is to use the cloud too. I'd say a botnet already qualifies as "the cloud". Why pay Amazon when you can get a million desktop machines doing it for free?

At college, we were already talking about "the cloud" in 1990. That's a long time before AWS was even a twinkle in anyone's eye.

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#62

Post by metageek »

chaostheory wrote: post #59
metageek wrote: post #57

Earlier quoted context omitted.

Ironically, Clinton expressed similar concerns about Wikileaks exposing people who speak privately to diplomats.

They asked the US gov to redact any sensitive sources. They didn't get any help. http://www.salon.com/news/opinion/glenn_greenwald/2010/08/20...

Possibly because that would tell Wikileaks what they thought was sensitive.

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#64

Post by jjoe »

trotsky wrote: post #53
jjoe wrote: post #50

Earlier quoted context omitted.

Most likely, the initial Netcraft attempt to connect is met with a RST. Subsequent attempts are also met with the same RST. This is because the attempts are spaced out in time enough for the original ACL, permitting access, to be flushed. According to the RFC, the RST does not get an ACK if the initiating node is "legitimate." So the "silence" or non-ACK is a good sign, which results in the initiating node being adde…

Thank you for your insight. A bogus IP - one that no one is listening on - would also not ACK a RST, right? Doing a little googling this process seems to detect an attack (from a valid ip) that has been programmed to ignore RST - presumably because some intermediate ISPs (like tier1 borders) will detect a DDOS and forge a RST to attempt to mitigate them. Much like the firewall configs that circulated to defeat sandvi…

A bogus host will obviously not respond to the RST but the last router-hop that receives the RST will (per RFC/protocol specs). The response is destination unreachable via ICMP. The ICMP unreachable packet is cheap (non-persistent) and requires no up-keep from the last hop to the bogus host. Most importantly, the ICMP unreachable packet requires no upkeep from the filtering node in EC2.

Regards

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#65

Post by jjoe »

Aaronontheweb wrote: post #58
tibbon wrote: post #39

Earlier quoted context omitted.

I wonder how well their Cloudfront CDN holds up for delivering static content in the face of a DDoS vs just using heavy static cachine with ngnix or apache on EC2.

If everything is edge-cached a local hubs (typically how a CDN works) then it should be pretty sturdy against a DDoS attack - after the first few waves of attacks the DDoS will just be hitting static content served up by the closest end-point to each individual ping to the server - the aggregate of the attack won't impact any of the dynamic servers if done right. That being said, I wouldn't want to pay the bandwidth…

Check out the anti-DDoS article we wrote up a few months ago. It uses a constellation of Nginx nodes to absorb the DDoS. The constellation acts the same way as a CDN without the geoIP awareness.

The advantage of this approach is that instead of relying on one ISV's backbone, you can build the constellation across several ISVs to aggregate the bandwidth and packet processing power.

Regards

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#66

Post by mwg66 »

nano81 wrote: post #17
mwg66 wrote: post #16

Shouldn't we really be trying to get to the bottom of who is behind this DDoS attack? If Wikileaks is said to be a terrorist organisation, isn't this an act of war?

I don't understand the logic - why would attacking a terrorist organization be an act of war?

Is it not?

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#68

Post by JoachimSchipper »

jules wrote: post #60
JoachimSchipper wrote: post #49

Earlier quoted context omitted.

The US has a massive commercial advantage because its laws, while not better per se, are at least uniform. Also, European national states are mostly too weak to have any influence in the global problems of the 21st century. A smaller share of a larger (power) pie would still be an improvement.

Economically, it would be an improvement. But look at laws like the data retention law that forces ISPs to keep access logs on all their users. The EU is also highly undemocratic, or at least very indirectly democratic. First install a working democratic process, then get more power. Not the other way around "lets give them insane power and then they will surely be nice to us and give us a good democratic process" as…

Meh, the Netherlands went further than the EU requirements on data retention. Yes, that's stupid, but...

And yes, creating a "EU government" is almost certainly even harder than it appears. The current system seems to combine the speed of a multi-country democracy with the legitimacy of a multi-country oligarchy (of elected ministers, but still).

Re: Wikileaks moves to Amazon's cloud to evade massive DDoS

#69

Post by trotsky »

jjoe wrote: post #64
trotsky wrote: post #53

Earlier quoted context omitted.

Thank you for your insight. A bogus IP - one that no one is listening on - would also not ACK a RST, right? Doing a little googling this process seems to detect an attack (from a valid ip) that has been programmed to ignore RST - presumably because some intermediate ISPs (like tier1 borders) will detect a DDOS and forge a RST to attempt to mitigate them. Much like the firewall configs that circulated to defeat sandvi…

A bogus host will obviously not respond to the RST but the last router-hop that receives the RST will (per RFC/protocol specs). The response is destination unreachable via ICMP. The ICMP unreachable packet is cheap (non-persistent) and requires no up-keep from the last hop to the bogus host. Most importantly, the ICMP unreachable packet requires no upkeep from the filtering node in EC2. Regards

thanks much!
Post reply on HN