Earlier quoted context omitted.
Cloudflare at least will refund any extra costs incurred from their serverless product if you get DDOSed
Same with AWS Shield Advanced :)
What is that, $3k/mo?
Someone attacked our company
41–50 of 112 posts
Re: Someone attacked our company
#42Earlier quoted context omitted.
We are indeed. Neither of us enjoy DevOps so we pay a premium to not have to manage servers. It brings a huge mental health benefit (we are a two person company), we're profitable and our monthly Lambda cost isn't that significant. Honestly, the biggest inefficiency (in terms of cost) is our use of SQS/RDS, which we are ditching soon.
Well, it's your money... I'd be happy to help make this more efficient though (at no charge of course). Offhand I'd say "web server which accumulates data and uploads it to S3 every N requests or M seconds" would probably get you what you need at a tiny fraction of the cost of "lambda which posts to SQS". Create an AMI and toss it at an autoscaling group and you really won't need to worry about scaling issues either.
If you were charging, how much would you charge to set up a server that you literally never have to bounce to get it back up?
Re: Someone attacked our company
#43Re: Someone attacked our company
#44I'd be checking for bugs in the js -- particularly as might be triggered from a bot environment that one or more of your customers might use to test their site or observe their sites latency response ...
puppeteer with setRequestInterception configured to block responses in the right way maybe https://github.com/puppeteer/puppeteer/blob/v5.5.0/docs/api.....
I can imagine nightmares along those lines that could persuade some normally functioning js client logic that works normally when in a normal network environment to continually reissue failed requests when browser requests/responses are blocked in just the wrong way -- that could cause the same client side ip to appear in logs over and over again.
And then ip variability could be the customer spinning up browser bots in various regions around the world in order to measure their sites region specific latency response.
Just offering up an alt theory -- as I'm with some of the others -- not sure the graphs shown immediately scream dos to me.
Re: Someone attacked our company
#45I am just curious to know if any effort has been made to find out who was behind the attacks? at least more information about it?
Re: Someone attacked our company
#46I'd be checking for bugs in the js -- particularly as might be triggered from a bot environment that one or more of your customers might use to test their site or observe their sites latency response ... puppeteer with setRequestInterception configured to block responses in the right way maybe https://github.com/puppeteer/puppeteer/blob/v5.5.0/docs/api.... . I can imagine nightmares along those lines that could persu…
The data was full of spam & was targeted at high profile customers. It was also run every hour for one period then ramped up to 500,000 concurrents. It was a DDoS :(
Re: Someone attacked our company
#47I am just curious to know if any effort has been made to find out who was behind the attacks? at least more information about it?
Can’t talk about this publicly, sorry :(
Re: Someone attacked our company
#48Earlier quoted context omitted.
Awesome, I'd love some advice if you're willing. So here's our situation. * We're getting hit with a huge DDoS attack, repeatedly over 3 weeks, with no sign of stopping * With zero access logs, there was no way to find patterns in the attack, and we had no way to block it * Our service was going offline during these attacks * We introduced access logs that are auto-deleted after 24 hours. We redacted all information…
> * We're getting hit with a huge DDoS attack, repeatedly over 3 weeks, with no sign of stopping I've read the full blog post, I am not convinced it's a DDoS attack. Traffic patterns for web analytics will come from over the place and will look like a DDoS when it's not. For example, a customer misplacing their analytics in a JS loop and having a moderate traffic blog will generate billions of requests from all over…
> You can one-way hash the IP. So you can still look for pattern but you've lost the actual IP. And same one-way hash IP can block whichever IP seems devious in your firewall.
The plaintext space (amount of possible IPs, even more so for IP blocks) is so small that that you can try all the possible plaintexts within seconds, essentially reversing the hash.
Re: Someone attacked our company
#49Re: Someone attacked our company
#50PHP Laravel on Amazon Lambda to count pageviews? Are you sure it's not just a regular customer and not a DDOS? > privacy-first analytics solution [...] The only downside of this is that we need to keep access logs (IP & User-Agent, no browsing history) for 24 hours Keeping IPs don't make you super privacy friendly.
> Are you sure it's not just a regular customer and not a DDOS?
Please be respectful of OP, he put a few weeks working on the issue, it is not fair to tell him that you think everything he tells is shit, only because you don't believe what he says