Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mēris botnet, climbing to the record

blog.qrator.net

Post reply on HN
Print view View original

51–60 of 61 posts

Re: Mēris botnet, climbing to the record

#51

Post by toast0 »

potamic wrote: post #36
jtchang wrote: post #19

To block something like this you need to determine what is botnet traffic vs legit traffic. It's hard. Source IP doesn't work since it is random and changes. You need to look at things such as HTTP headers, TCP window and any odd flags that might be set. If you're lucky the botnet isn't capable of running a copy of Chrome or Safari or using a random sample template from legit traffic. Lots of botnets are made up of l…

I think in future servers will ask clients to solve a small computation. It can be theoretically incorporated into the handshake and if it takes something like 100ms, human users would not notice but botfarms will feel the pinch. An additional benefit is that servers can monetise the computation offsetting some of their costs.

How much server resources are used before asking the client to do work? If they've got 100k clients, and each opens 100 TCP connections to your server, is your TCP stack or your load balancer going to fall over before you even start to do a TLS handshake?

Can you manage as many TLS handshakes as they can throw at you?

Re: Mēris botnet, climbing to the record

#52

Post by encryptluks2 »

PragmaticPulp wrote: post #16

20 million requests per second from a single beefy AWS server is easy to detect and block. 20 million requests per second coming from a rotating list of hosts from generic IP addresses is a nightmare: > However, we suppose the number to be higher – probably more than 200 000 devices, due to the rotation and absence of will to show the "full force" attacking at once. If your site normally has 10,000 users per day and…

I think a lot of services would be happy to silently allow bots on their service to help inflate user numbers.

Re: Mēris botnet, climbing to the record

#53

Post by tg180 »

EvanAnderson wrote: post #41
potamic wrote: post #36

Earlier quoted context omitted.

I think in future servers will ask clients to solve a small computation. It can be theoretically incorporated into the handshake and if it takes something like 100ms, human users would not notice but botfarms will feel the pinch. An additional benefit is that servers can monetise the computation offsetting some of their costs.

Wouldn't bot farms just incorporate that as a "cost of doing business" and expand to absorb the computational load? After all, it's not like the bot farmers are paying to add more hardware.

Bot farms exist because they are cheap. You don't need to be perfect, ultimately one needs to adjust the cost of the handshake to ensure that it's higher than the average earning of the farmer.

E.g.: the handshake can be made more expensive choosing a "harder" function for the handshake and giving clients that behaves "good" the possibility to reuse the connections. Bots are penalised because they constantly have to make new handshakes.

But the economic incentives of a botnet are very different from those of a bot farm.

Re: Mēris botnet, climbing to the record

#54

Post by remram »

potamic wrote: post #36
jtchang wrote: post #19

To block something like this you need to determine what is botnet traffic vs legit traffic. It's hard. Source IP doesn't work since it is random and changes. You need to look at things such as HTTP headers, TCP window and any odd flags that might be set. If you're lucky the botnet isn't capable of running a copy of Chrome or Safari or using a random sample template from legit traffic. Lots of botnets are made up of l…

I think in future servers will ask clients to solve a small computation. It can be theoretically incorporated into the handshake and if it takes something like 100ms, human users would not notice but botfarms will feel the pinch. An additional benefit is that servers can monetise the computation offsetting some of their costs.

This does not help one bit with botnets. The problem of defending against botnets is not blocking many requests coming from each IP address, it's blocking requests coming all those compromised devices. Those devices are perfectly capable of doing that computation.

Re: Mēris botnet, climbing to the record

#55

Post by WarOnPrivacy »

From the article:

What to do in such a situation?

Blacklists are still a thing. Since those attacks are not spoofed, every victim sees the attack origin as it is. Blocking it for a while should be enough to thwart the attack and not disturb the possible end-user.

Missing from the article: Links to lists of IPs that they recommend to be blacklisted. It's the same thing that's missing from pretty much every NetSec vendor.

We really need a recovery clinic for compulsive threat-data hoarders.

Re: Mēris botnet, climbing to the record

#56

Post by achillean »

jtchang wrote: post #50
achillean wrote: post #48

Earlier quoted context omitted.

In cases like this it's actually not that difficult as they're using devices that can be fingerprinted from the Internet. We at Shodan provide a local, embedded database (SQLite or RocksDB) so you can see which open ports connecting IPs have. If an IP is connecting from a device that's running weird ports, is compromised or has other unusual characteristics then you can either flag the connection as high risk or outr…

How does fingerprinting them help? You can fingerprint them but they are just desktops/mobile phones/laptops that have been compromised to be part of the botnet. The compromised hosts that are part of the botnet look exactly like normal traffic.

That's not what the article said though. They say that the compromised devices had these characteristics among others:

* Port 2000 open

* Port 5678 open

* SOCKS proxy on port 80 (maybe)

Most likely most of the visitors to your website won't have those ports open and exposed to the Internet. That is a really easy way to filter traffic based on the network fingerprint. Especially when you're under attack it's a great way to reduce a majority of the impact without requiring any AI/ ML - just filter traffic from IPs that have TCP port 5678 open. That same technique was also used to identify Mirai bots and it worked well.

Re: Mēris botnet, climbing to the record

#57

Post by creeble »

jtchang wrote: post #50
achillean wrote: post #48

Earlier quoted context omitted.

In cases like this it's actually not that difficult as they're using devices that can be fingerprinted from the Internet. We at Shodan provide a local, embedded database (SQLite or RocksDB) so you can see which open ports connecting IPs have. If an IP is connecting from a device that's running weird ports, is compromised or has other unusual characteristics then you can either flag the connection as high risk or outr…

How does fingerprinting them help? You can fingerprint them but they are just desktops/mobile phones/laptops that have been compromised to be part of the botnet. The compromised hosts that are part of the botnet look exactly like normal traffic.

If you have a database of known-compromised hosts (because a fingerprint scan of them shows something clearly identifiable as part of a botnet, which I think is usually rare [but possibly not for Mēris]), it can mitigate an attack if you've already blocked them.

But the problem that still exists is the initialization traffic -- there are still up to 200k hosts that may hit your site (essentially, a syn flood). Depending on your infrastructure, that can still hurt your firewall or single server. But it is unlikely to hurt as much as having to actually respond (through a request stack) to those requests.

Post reply on HN