Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fastmail, Runbox, and Posteo under DDoS extortion attack

therecord.media

Post reply on HN
Print view View original

31–40 of 130 posts

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#31

Post by brownbat »

TacticalCoder wrote: post #24

We still hear about DDoS attacks like this once in a while but it seems it's not anywhere near as common as it used to be. What happened? It looks like the bad guys are really having more and more trouble mounting succesful DDoS: how comes? It also looks like, in despair, they're targetting smaller fishes. Why? Smaller botnets? Cloudflare and OVH and the likes just being too good at absorbing everything and anything…

Maybe ransomware.

A bit speculative, but my hunch is --

IOT and some other advancements still create opportunities for new DDoS attacks, but attackers herd. And the "X as a service" support infrastructure is mostly supporting ransomware right now, likely because its safer and more lucrative. You can walk away from a ransomware target, fire and forget, so you can do it at scale. DDoS you have to pick your victims, and monitor and maintain the pressure, choose how to allocate your resources to targets while they're investigating or waiting you out.

Cloudflare might be part of the story, maybe that was enough of a headwind to stop the trolls, but for the professional criminals, I suspect this is about lucrative alternative attacks.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#32

Post by __s »

TacticalCoder wrote: post #24

We still hear about DDoS attacks like this once in a while but it seems it's not anywhere near as common as it used to be. What happened? It looks like the bad guys are really having more and more trouble mounting succesful DDoS: how comes? It also looks like, in despair, they're targetting smaller fishes. Why? Smaller botnets? Cloudflare and OVH and the likes just being too good at absorbing everything and anything…

Botnets aren't smaller (IoT has been quite a boon to them)

& according to https://www.comparitech.com/blog/information-security/ddos-s... their frequency isn't declining

But yes, the larger sites have gotten their shit together so that the cost to DDoS has gone up

Also if you have a botnet you now have to ask: do you want rent out DDoS or do you want to mine crypto?

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#33

Post by LinuxBender »

rgrmrts wrote: post #29
LinuxBender wrote: post #25

Earlier quoted context omitted.

In regards to fail2ban, assuming the attack was purely SMTP specific which it won't be even then blocking IP's would be futile. The DDoS-as-a-service farms have hundreds of thousands to millions of IP's under their control. Block one IP and ten more show up. One IP is not one attacker. Those farms have probes that can tell how effective their attack is. Some of them even have "proven work" that is reported back to th…

Word, thanks for all the details! Yeah, I don't have any actual business use-cases outside of a personal interest in making my dedicated server reasonably protected.

You're welcome! For your personal MX servers, the most cost effective solution I know of would be to have multiple domains and each domain have their own MX records and corresponding VM/server on its own unique provider to isolate them. Then ensure that people/businesses that are important to you know to contact you at 2+ email addresses/domains. If someone attacks one of your domains or MX servers, you can safely ignore the attack. These separate MX servers should be on different server/VPS providers in the event that the attack causes one of them to suspend your account. Your imap client can poll each of the servers/domains so that you get your emails.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#34

Post by bombcar »

0des wrote: post #5
sysadm1n wrote: post #2

> Since these DDoS attacks started we have worked with our system administrators and Internet Service Provider to mitigate the attacks How do you mitigate such an attack though? I know Cloudflare can stop this, but how do you create your own bespoke 'DDOS mitigation' tool, and what does that look like?

You simply need bigger pipes to ingest more traffic than the attack can provide. It is presumed these days that packet analysis in some cases can require too much power costwise rather than scaling up the connection to swallow it.

And the "further up the chain" you can move the mitigation, the easier that is. Mitigating on your box requires a huge pipe to your box, but if your provider can mitigate at their border router, well those are bigger and already have huge traffic to and through them.

And it's in their interest to talk to their providers and mitigate even further back if possible. And some mitigations are relatively easy (block all DNS traffic to this subnet, etc).

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#36

Post by bombcar »

dubcanada wrote: post #6

On another note, the amount they are asking for seems really reasonable, like how are they making money? A DDoS attack must cost more then like 0.06BTC (like $3500 USD) to run all weekend?

A DDoS can be rented for less than $100/mo depending on how much bandwidth you want to flood. Remember, they're compromised machines; you're not paying for egress bandwidth.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#37

Post by lrae »

spinax wrote: post #18
NabiDev wrote: post #15

Own the whole email provider, use protonmail? Ironic.

The name on that email is not one of the Runbox folks listed on their About page, so one can only guess who that actually is or how the email was sent; it could have been a BCC for all we know. https://runbox.com/about/runbox-team/

I don't think they'd publish some random e-mail address of a random person.

Are we sure that isn't the address the extortion mail came from? Would make more sense?

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#38

Post by jlund-molfese »

NabiDev wrote: post #15

Own the whole email provider, use protonmail? Ironic.

It doesn't look like that email actually belongs to Fastmail staff, but if it did, having a backup on another email service is a good idea in case there's a DNS issue with Fastmail or something.

It's the same idea behind a VPS provider serving their status page on another company's infrastructure.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#39

Post by rawoke083600 »

LinuxBender wrote: post #25
rgrmrts wrote: post #16

Earlier quoted context omitted.

Thanks for your response! So using specific examples here for smtp, I get a 1gbps guaranteed network from Hetzner so in theory I’d need to distribute over 50 servers to withstand this attack? It’s not clear to me why fail2ban wouldn’t at least help, if the botnet is a thousand machines wouldn’t I (eventually) have them all blocked? And therefore reduce the overall duration of the attack? Or is the problem that it’s h…

In regards to fail2ban, assuming the attack was purely SMTP specific which it won't be even then blocking IP's would be futile. The DDoS-as-a-service farms have hundreds of thousands to millions of IP's under their control. Block one IP and ten more show up. One IP is not one attacker. Those farms have probes that can tell how effective their attack is. Some of them even have "proven work" that is reported back to th…

Would a decenterlized service architecture work better than an server-client arch ?

Im thinking like a lambda/faas platform where the computing endpoint is massively distributed ?

I guess there are (currently) no 'one final solution' but like traditional security a good solution consists of many many layers/rings of defences ? Can one(in theory) decenterlized all 7 of the osi model ?

Trying hard not to use the word (crypto/blockchain) here .

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#40

Post by 300bps »

TacticalCoder wrote: post #24

We still hear about DDoS attacks like this once in a while but it seems it's not anywhere near as common as it used to be. What happened? It looks like the bad guys are really having more and more trouble mounting succesful DDoS: how comes? It also looks like, in despair, they're targetting smaller fishes. Why? Smaller botnets? Cloudflare and OVH and the likes just being too good at absorbing everything and anything…

A lot of the old DDoS attacks rely on the ability to spoof your IP address. Many networks are now configured to drop packets exiting their network that don’t have an address from their network.

For example, in a Smurf attack the attacker finds broadcast IP addresses by sending an ICMP request to an address and counts the number of ICMP replies that come back. A broadcast IP address is one that sends a packet to every host on a network (often with 255 as the last octet like 207.103.0.255 for a Class C network of 207.103.0.0/24).

After finding suitably large networks with an open broadcast IP address they then send the broadcast IP address packets with a spoof IP address of the victim. The attack is then multiplied by however many hosts are on the broadcast IP address network.

DNS reflection is another type of DDoS attack that also relies on the ability to spoof an IP address of the victim.

Post reply on HN