Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

91–100 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#91

Post by tmpX7dMeXU »

grotorea wrote: post #36
mihaic wrote: post #14

The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.

So the email spam solution? Doesn't that come with its own list of problems? Also, stupid question from someone not that familiar with DDoS, can't you flood the target with requests even if the source address will be rejected? Or even if the IP packet has a falsified source address?

Yes.

Re: The largest DDoS attack to date, peaking above 398M rps

#92

Post by nine_k »

scrpl wrote: post #64
DanielBMarkham wrote: post #52

Earlier quoted context omitted.

Why don't we just require major providers to provide a realtime list of IPs that are attacking so that we can drop them in a block list with an expiration date of a month or so. If your computer is infected, I don't want to talk to you for a month. If it continues to be infected, I might up that to a year, or permanently ban you. It's your problem. Go fix it.

Great solution for a world without shared and dynamic ips.

Not as bad as one may think. It's proper feedback which can be acted upon.

Every reasonable connectivity provider would pay attention to this info, or face intense complaints from its users with shared and dynamic IPs. It would identify sources of attacks, and block them at higher granularity level, reporting that the range has been cleared. (If a provider lied, everyone would stop believing it, and the disgruntled customers would leave it.)

For shared hosting providers it would mean blocking specific user accounts using a firewall, notifying users, and maybe even selling cleanup services.

For home internet users, it also would mean blocking specific users, contacting them, helping them identify the infected machine at home.

It would massively drive patching of old router firmware which is often cracked and infected. Same for IoT stuff, infected PCs, malicious apps on phones, etc. There would be an incentive to stay clean.

Re: The largest DDoS attack to date, peaking above 398M rps

#93

Post by londons_explore »

tootie wrote: post #56
ricardobeat wrote: post #9

No word on the origin of these attacks? This must require massive amounts of hardware, you’d imagine it to be easily traceable unless some kind of botnet.

The immediate assumption is that Iran is doing it. They have done it many times before and they are allied with Hamas. I haven't seen any proof but it's a safe bet.

A novel attack like this done at small scale like this is probably just a script kiddie experimenting.

An actual nation state would have tested it fully internally and started on the public internet at a scale bigger than 20,000 machines.

Re: The largest DDoS attack to date, peaking above 398M rps

#94

Post by HumblyTossed »

codedokode wrote: post #80
gchamonlive wrote: post #69

Earlier quoted context omitted.

What? Let's go back to username and password. 2FA forces scammers to up their game. What about password managers? Having separate passwords to every account makes hacking into your accounts much harder and might hurt everyone in the long run. And don't get me started on end to end encryption. Privacy, long term, will mean the fall of civilization. Sarcasm aside. I think I understand your point in which we shouldn't j…

There should be a protocol to block traffic on the upstream provider. So if someone from 1.2.3.4 sends lots of traffic at you, you send a special packet to 1.2.3.4 and all upstream providers (including the provider that serves 1.2.0.0/16), that see this packet block traffic from that IP address directed at you. Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.…

I am pretty sure that protocol would be just as abused.

Re: The largest DDoS attack to date, peaking above 398M rps

#95

Post by AnimalMuppet »

judge2020 wrote: post #72
dmm wrote: post #65

Earlier quoted context omitted.

Block the whole subnet and make it the ISP's problem?

How does the ISP solve it? Send a mass mail/email telling people to reset their devices because someone has a device with botnet malware?

Egress filtering? A botnet DDOS stream should not look like normal network traffic...

Re: The largest DDoS attack to date, peaking above 398M rps

#96

Post by ilyt »

codedokode wrote: post #80
gchamonlive wrote: post #69

Earlier quoted context omitted.

What? Let's go back to username and password. 2FA forces scammers to up their game. What about password managers? Having separate passwords to every account makes hacking into your accounts much harder and might hurt everyone in the long run. And don't get me started on end to end encryption. Privacy, long term, will mean the fall of civilization. Sarcasm aside. I think I understand your point in which we shouldn't j…

There should be a protocol to block traffic on the upstream provider. So if someone from 1.2.3.4 sends lots of traffic at you, you send a special packet to 1.2.3.4 and all upstream providers (including the provider that serves 1.2.0.0/16), that see this packet block traffic from that IP address directed at you. Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.…

What you say already exists, hell, you can use BGP to distribute ACLs

But it costs space in the routing tables and that means replacing routers earlier. It's no wonder, especially if you multiply it by thousand customers.

"block all traffic from outside from this IP" is significantly easier than "block all traffic from outside from this IP to this client". And you need to do it per ISP client, else it is ripe for abuse.

And don't forget a lot of the traffic will come from "cloud" itself.

Re: The largest DDoS attack to date, peaking above 398M rps

#97

Post by fragmede »

DanielBMarkham wrote: post #52
mihaic wrote: post #14

The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.

Why don't we just require major providers to provide a realtime list of IPs that are attacking so that we can drop them in a block list with an expiration date of a month or so. If your computer is infected, I don't want to talk to you for a month. If it continues to be infected, I might up that to a year, or permanently ban you. It's your problem. Go fix it.

You're assuming that identification of attack traffic is 100% correct which is unfortunately not the reality.

Re: The largest DDoS attack to date, peaking above 398M rps

#98

Post by Grazester »

_23sd wrote: post #54
dudeinjapan wrote: post #33

Earlier quoted context omitted.

Was at Tokyo Disneyland today and taught my girlfriend the word “enshittification”. (i.e. making your customers pay via your stupid app to do literally anything in your park, and not even providing wi-fi.)

That's not enshittification, squeezing money out of you is just how theme parks operate. The term can't really apply to Disney parks at all because there's no two sided market.

You missed the no WiFi part. At least enable customers to send their money!

Re: The largest DDoS attack to date, peaking above 398M rps

#99

Post by tmpX7dMeXU »

tpetry wrote: post #57
vmfunction wrote: post #47

Earlier quoted context omitted.

> pay Google, Amazon or Cloudflare a protection tax. Just FYI: hetzner has free DDoS https://www.hetzner.com/unternehmen/ddos-schutz I'm sure other hosting companies also offers it.

Only for mini DDoS attacks - for larger ones they disable routing for your ip address. I guess they don‘t have the capacity to handle the big DDoS attacks nowadays.

Yep, and null-routing your IP is exactly what providers did in the days GP is longing for, and still do do, especially outside of big cloud providers.

Re: The largest DDoS attack to date, peaking above 398M rps

#100

Post by codedokode »

HumblyTossed wrote: post #94
codedokode wrote: post #80

Earlier quoted context omitted.

There should be a protocol to block traffic on the upstream provider. So if someone from 1.2.3.4 sends lots of traffic at you, you send a special packet to 1.2.3.4 and all upstream providers (including the provider that serves 1.2.0.0/16), that see this packet block traffic from that IP address directed at you. Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.…

I am pretty sure that protocol would be just as abused.

How exactly? You can authenticate sender by sending a special confirmation token back.
Post reply on HN