I don't wonder that Runbox and Posteo are vulnerable, but I would have thought that Fastmail is too big for such an attack...
Fastmail is working just fine for me. At least the web interface was briefly offline yesterday, though.
Fastmail, Runbox, and Posteo under DDoS extortion attack
61–70 of 130 posts
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#62Is the attack on its webmail/website or on their smtp servers? I’ve been wondering about this, but how does one protect smtp servers from distributed attacks? Let’s assume smaller attackers, do you just need good firewalls in front of your servers to prevent congestion to the smtp servers? Are there off the shelf tools that can be configured to help here (pf maybe)? Do tools like fail2ban help? For context, I’ve pick…
> Is the attack on its webmail/website or on their smtp servers? It is an attack on the httpd and smtpd daemons. imap has been unaffected as far as I can tell. > how does one protect smtp servers from distributed attacks? By design, MX can be as distributed and in large number as you can afford or as willing to spend. This can be a combination of load balancer virtual IP's distributing load to many MX servers behind…
I agree that you do need some form of first stage that can take the traffic volume (usually a third party service, but could also be 100+ Gbps of bandwidth you get somewhere and an appliance that can do IP filtering), no good way around that.
But once you have that, you should be able to tell them "forward me all traffic except " and then list the IPs that are sending you the most (remaining) traffic, or even cost (e.g. if the IP is sending little traffic, but performing many TLS handshakes). That's where a fail2ban like tool would come in, no?
The benefit of this approach is that it works completely independently of the protocol you're running. TCP, UDP, doesn't matter, as long as the attacker cannot spoof IP addresses at scale.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#63Earlier quoted context omitted.
> Is the attack on its webmail/website or on their smtp servers? It is an attack on the httpd and smtpd daemons. imap has been unaffected as far as I can tell. > how does one protect smtp servers from distributed attacks? By design, MX can be as distributed and in large number as you can afford or as willing to spend. This can be a combination of load balancer virtual IP's distributing load to many MX servers behind…
I agree that you do need some form of first stage that can take the traffic volume (usually a third party service, but could also be 100+ Gbps of bandwidth you get somewhere and an appliance that can do IP filtering), no good way around that. But once you have that, you should be able to tell them "forward me all traffic except " and then list the IPs that are sending you the most (remaining) traffic, or even cost (e…
Agreed adding bandwidth can help against some attacks.
as long as the attacker cannot spoof IP addresses at scale
That is kindof the rub. Until a majority of tier-1 backbone providers implement bcp38 [1] or some derivative of it, spoofing from the ddos farms is trivial. There has been talk of implementing this for many years but very little action. Perhaps when DDoS attacks cost enough tax revenue or impact investors, perhaps there may be push for legislation in some countries to implement but in an ideal world most of the providers would work through this as one big team. I just make some network engineers laugh, or smirk, or other
[1] - https://en.wikipedia.org/wiki/Ingress_filtering#Networks
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#64The sooner these kids realize that DDoS extortion attacks do nothing except waste resources (and monetary resource to CloudFlare, basically), the sooner they'll give up.
They hit a number of VoIP providers recently, too.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#65We still hear about DDoS attacks like this once in a while but it seems it's not anywhere near as common as it used to be. What happened? It looks like the bad guys are really having more and more trouble mounting succesful DDoS: how comes? It also looks like, in despair, they're targetting smaller fishes. Why? Smaller botnets? Cloudflare and OVH and the likes just being too good at absorbing everything and anything…
More protection at the OS and ISP level. ISPs can isolate nodes that become part of botnets, and operating systems increasingly remove the avenues malicious actors use to cause trouble. Microsoft's push for hardware security is justly controversial, but the move to TPM by default in Windows 11 is the latest in a long line of changes that's made it harder to take over an ordinary person's computer. Android has had an…
> TPM by default in Windows 11 is the latest in a long line of changes that's made it harder to take over an ordinary person's computer
Interesting, I think of TPM as being for holding keys for bitlocker encryption or personal certificates. Can you clarify how TPM makes it harder for to remotely take over a computer?
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#66We still hear about DDoS attacks like this once in a while but it seems it's not anywhere near as common as it used to be. What happened? It looks like the bad guys are really having more and more trouble mounting succesful DDoS: how comes? It also looks like, in despair, they're targetting smaller fishes. Why? Smaller botnets? Cloudflare and OVH and the likes just being too good at absorbing everything and anything…
Botnets aren't smaller (IoT has been quite a boon to them) & according to https://www.comparitech.com/blog/information-security/ddos-s... their frequency isn't declining But yes, the larger sites have gotten their shit together so that the cost to DDoS has gone up Also if you have a botnet you now have to ask: do you want rent out DDoS or do you want to mine crypto?
How that's a good point: especially that if you DDoS while asking for a ransom, you take the risk that your botnets gets taken down. While if you "discretly" mine CPU (and/or GPU?) mineable cryptocurrencies, you kinda fly under the radar.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#67The sooner these kids realize that DDoS extortion attacks do nothing except waste resources (and monetary resource to CloudFlare, basically), the sooner they'll give up. They hit a number of VoIP providers recently, too.
The latest attacks on VoIP providers resulted in a SIP/VoIP specific solution from Cloudflare.
I expect we will see Cloudflare mail protection soon enough...
Makes you wonder.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#68If you didn’t want to depend on a big provider like AWS or Cloudflare, what is the approach to fending off a DDoS attack? What type of hardware would you need to acquire? What type of software? Are there guides on this type of thing?
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#69Yet another reason to host your email at your own domain which you can move at will.
Is it really worth the hassle to move to another provider/self-hosted server for such a temporary problem?
Moving to another provider would mean to set up a new account, and usually the free tiers won't allow to use your own domain. So you would be locked to a new provider where you could face the same problems.
Temporarily moving to a self-hosted server would be an option, but probably just to receive emails during this time. You'd have to set up your certificate, and optionally DKIM, DMARC, SPF or whatever is required to ensure that your sent emails arrive properly. I can't imagine self-hosting email being something which won't give you a hard time every now and then.
Generally yes, I am in favor of owning your email-domain, but then using it with a professional provider like mailbox.org unless you really know enough about the topic.
But in this case, where the issue is a DDoS attack, I wouldn't do anything, since all undelivered email will be re-sent at a later time.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#70mailbox.org was also attacked https://twitter.com/mailbox_org/status/1451237052855595012?s...
I kept having errors in sending emails and logging into the web interface and the mailbox.org status page indicated nothing was wrong. Why have the page if that’s not where I’m supposed to find out something like this?