Fastmail, Runbox, and Posteo under DDoS extortion attack
therecord.media
Fastmail, Runbox, and Posteo under DDoS extortion attack
1–10 of 130 posts
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#2> Since these DDoS attacks started we have worked with our system administrators and Internet Service Provider to mitigate the attacks
How do you mitigate such an attack though? I know Cloudflare can stop this, but how do you create your own bespoke 'DDOS mitigation' tool, and what does that look like?
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#3> Since these DDoS attacks started we have worked with our system administrators and Internet Service Provider to mitigate the attacks How do you mitigate such an attack though? I know Cloudflare can stop this, but how do you create your own bespoke 'DDOS mitigation' tool, and what does that look like?
One way is to build your software on top of distributed/content-addressed P2P software (not Blockchain, but pure P2P). The angle of attack disappears completely then.
Otherwise, with centralized infrastructure, you identify the bad traffic and send it elsewhere, an instance that keeps connections open but delivers nothing and have a small amount of resource usage. Problem is that you still need to be able to handle the traffic, but at least you avoid hitting your main infrastructure.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#4> Since these DDoS attacks started we have worked with our system administrators and Internet Service Provider to mitigate the attacks How do you mitigate such an attack though? I know Cloudflare can stop this, but how do you create your own bespoke 'DDOS mitigation' tool, and what does that look like?
Adding capacity, dropping suspect traffic.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#5> Since these DDoS attacks started we have worked with our system administrators and Internet Service Provider to mitigate the attacks How do you mitigate such an attack though? I know Cloudflare can stop this, but how do you create your own bespoke 'DDOS mitigation' tool, and what does that look like?
You simply need bigger pipes to ingest more traffic than the attack can provide. It is presumed these days that packet analysis in some cases can require too much power costwise rather than scaling up the connection to swallow it.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#6On another note, the amount they are asking for seems really reasonable, like how are they making money? A DDoS attack must cost more then like 0.06BTC (like $3500 USD) to run all weekend?
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#7Is the attack on its webmail/website or on their smtp servers? I’ve been wondering about this, but how does one protect smtp servers from distributed attacks? Let’s assume smaller attackers, do you just need good firewalls in front of your servers to prevent congestion to the smtp servers? Are there off the shelf tools that can be configured to help here (pf maybe)? Do tools like fail2ban help?
For context, I’ve picked up self-hosting again after many years and though I don’t anticipate being a target for large attacks I have been curious what tools individuals have at their disposal or if it’s a fools errand to even try.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#8On another note, the amount they are asking for seems really reasonable, like how are they making money? A DDoS attack must cost more then like 0.06BTC (like $3500 USD) to run all weekend?
I’d assume they’re not actually paying for these attacks and have access to a large botnet, which would imply no cost (outside of hours spent constructing the attack) to the adversary, right?
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#9On another note, the amount they are asking for seems really reasonable, like how are they making money? A DDoS attack must cost more then like 0.06BTC (like $3500 USD) to run all weekend?
If they're using a botnet of compromised servers then I suspect the marginal cost is negligible.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#10> Since these DDoS attacks started we have worked with our system administrators and Internet Service Provider to mitigate the attacks How do you mitigate such an attack though? I know Cloudflare can stop this, but how do you create your own bespoke 'DDOS mitigation' tool, and what does that look like?
One way is to build your software on top of distributed/content-addressed P2P software (not Blockchain, but pure P2P). The angle of attack disappears completely then. Otherwise, with centralized infrastructure, you identify the bad traffic and send it elsewhere, an instance that keeps connections open but delivers nothing and have a small amount of resource usage. Problem is that you still need to be able to handle t…
> One way is to build your software on top of distributed/content-addressed P2P software (not Blockchain, but pure P2P). The angle of attack disappears completely then.
I can see how this works for some applications, but how would this work for SMTP and IMAP/JMAP?