Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mitigating a DDoS on Mastodon

coffee-and-dreams.uk

Post reply on HN
Print view View original

11–20 of 67 posts

Re: Mitigating a DDoS on Mastodon

#12

Post by koroshitekure »

ekimekim wrote: post #4

On the subject of the IP leaking: Note that IPv4 only has 2^32 addresses, and people can and do mass scan all of them (see here shodan.io). If your service is exposing any identifiable information (ie. if it's not completely blocking all non-cloudflare IPs) then it's fairly easy to find even if it's "unguessable".

yep, i had the same thought

which is what led me to block all other IPs - it's not the hardest thing to just make an openssl req and get the common names of the certificate returned

especially if you know the hosting provider, which narrows down the ip space significantly

Re: Mitigating a DDoS on Mastodon

#13

Post by Nextgrid »

tyingq wrote: post #5
ekimekim wrote: post #4

On the subject of the IP leaking: Note that IPv4 only has 2^32 addresses, and people can and do mass scan all of them (see here shodan.io). If your service is exposing any identifiable information (ie. if it's not completely blocking all non-cloudflare IPs) then it's fairly easy to find even if it's "unguessable".

That's an interesting side topic. What do services like Shodan do in an ipv6 world? Dumb brute force scanning seems unlikely.

They run NTP servers that are (were?) included in the NTP pool to fish for clients’ IPv6 addresses.

Re: Mitigating a DDoS on Mastodon

#14

Post by tyingq »

Nextgrid wrote: post #13
tyingq wrote: post #5

Earlier quoted context omitted.

That's an interesting side topic. What do services like Shodan do in an ipv6 world? Dumb brute force scanning seems unlikely.

They run NTP servers that are (were?) included in the NTP pool to fish for clients’ IPv6 addresses.

Interesting. I also found this post about using UpnP on ipv4 addresses to unmask ipv6. https://blog.talosintelligence.com/2019/03/ipv6-unmasking-vi...

Re: Mitigating a DDoS on Mastodon

#15

Post by iampims »

koroshitekure wrote: post #11

hey, i'm the author of the article really... surprised it got submitted here incidentally i'm running pleroma, not mastodon. minor detail but you know

To avoid leaking IPs, you can use cloudflared tunnel. It might get pricy if you move a lot of bytes, but it’ll isolate you from IP leaking issues.

Re: Mitigating a DDoS on Mastodon

#16

Post by koroshitekure »

iampims wrote: post #15
koroshitekure wrote: post #11

hey, i'm the author of the article really... surprised it got submitted here incidentally i'm running pleroma, not mastodon. minor detail but you know

To avoid leaking IPs, you can use cloudflared tunnel. It might get pricy if you move a lot of bytes, but it’ll isolate you from IP leaking issues.

oh, i found out where the leak was

it's right at the end of the article - the attacker was abusing the "create a preview card of any posted URL" feature - he'd post a link, wait for pleroma to go and grab the url to preview it, then narrow down which one was mine based on user agent

i added an upstream proxy and anonymised the user agent, so even if he were to do that, the most he'd find was my proxy box

Re: Mitigating a DDoS on Mastodon

#17

Post by zaarn »

ekimekim wrote: post #4

On the subject of the IP leaking: Note that IPv4 only has 2^32 addresses, and people can and do mass scan all of them (see here shodan.io). If your service is exposing any identifiable information (ie. if it's not completely blocking all non-cloudflare IPs) then it's fairly easy to find even if it's "unguessable".

Well, that would only work if the other end responds to a request to the IP address with a cert that includes the proper domain.

If you setup Cloudflare properly, then you only see a CF-based certificate, not that actual hostnames. Since you didn't send a proper hostname (unless you use PTR, which isn't reliable either) it'll use whatever default hostname it has configured (or just close the connection).

Or in a case like my setup, you'll get an empty 0-byte response if no Host: header is present. The certificate is a wildcard for the primary domain the server runs, not even related to the mastodon service.

And of course, this post contains enough information to probably nail it down but on the other hand, mass scanning the internet is a lot of trouble.

Post reply on HN