Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

311–320 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#311

Post by WelcomeShorty »

jxramos wrote: post #282
pythonguython wrote: post #219

Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it w…

I've never contemplated the cost of a DDos attack, I guess there's the upfront setup costs to secure the software and hardware that will execute the attack but are you speaking more about the costs on the day of the attack? Are those costs trivial, like the marginal costs I suppose it would be?

To be effective, you need to either be prepared to hide behind google, Cloudflare or AWS, OR you need some pretty expensive deal with you (large) ISP who can (quickly) filter on their edge.

Sitting at the end of whatever network, you will not be able to do anything against a sufficient volume attack.

Re: The largest DDoS attack to date, peaking above 398M rps

#312

Post by zelon88 »

mrweasel wrote: post #237
acedTrex wrote: post #225

Earlier quoted context omitted.

It is not an ISPs job to analyze traffic patterns and attempt to stop the bad ones. Thats like saying its the job of the road crews to stop speeders

So who else? My proposal would be to have companies like Google, Microsoft, Amazon and hosting providers be able to report sources of DDoS attack to the ISPs who can then identify the customer and let the customer know that they have a week to fix the issue or lose connectivity.

That is terrifying.

Let Google, Amazon, and Apple decide who gets to use the internet and who gets put into a list.

That is way worse than giving Google the W3C. That is literally just handing them the internet and making everybody else on it subservient to Google.

Re: The largest DDoS attack to date, peaking above 398M rps

#313

Post by mensetmanusman »

mrweasel wrote: post #240
endergen wrote: post #234

Earlier quoted context omitted.

Doesn't using your botnet expose your botnet IP addresses/devices?

Yes, but currently that has zero consequences. Say you infect 500.000 Windows XP machines or consumer routers, the owners of those devices isn't going to be informed, nor is their ISPs. In many cases the manufacturer of those devices also aren't going to provide security update, but those probably wasn't going to be applied anyway.

Google should start using their ad network to silently update people’s security!

Re: The largest DDoS attack to date, peaking above 398M rps

#314

Post by _23sd »

Grazester wrote: post #98
_23sd wrote: post #54

Earlier quoted context omitted.

That's not enshittification, squeezing money out of you is just how theme parks operate. The term can't really apply to Disney parks at all because there's no two sided market.

You missed the no WiFi part. At least enable customers to send their money!

That’s shitty, but if that’s all enshittification means then it’s ten extra letters for nothing. Disneyland is not a “platform”, it doesn’t go through the enshittification process.

Re: The largest DDoS attack to date, peaking above 398M rps

#315

Post by ryanisnan »

tristan9 wrote: post #187
gchamonlive wrote: post #69

Earlier quoted context omitted.

What? Let's go back to username and password. 2FA forces scammers to up their game. What about password managers? Having separate passwords to every account makes hacking into your accounts much harder and might hurt everyone in the long run. And don't get me started on end to end encryption. Privacy, long term, will mean the fall of civilization. Sarcasm aside. I think I understand your point in which we shouldn't j…

> just with everything production-grade, the average enterprise just isn't ready to deal with all the upfront cost to run your entire computing solution That’s not a fair point. We’re not even trying to make the internet safe. There is zero (0) actions being taken to stop this madness. If you run a large website, you still regularly see attacks from routers compromised 3, 4, 5 years ago. Or how a mere few days of pok…

I like the irony of saying there are zero actions being taken in response to a blog post documenting actions taken to specific CVEs.

Re: The largest DDoS attack to date, peaking above 398M rps

#316

Post by omoikane »

jedberg wrote: post #291
whimsicalism wrote: post #276

Earlier quoted context omitted.

Seems like attacking Google would be a bad target for street cred as compared to govt websites.

Nah it's even better because they're considered capable defenders so it's harder. What I'm not sure of is why Google published this. I can't figure out what their strategy is here. We never published about the attacks we absorbed because we didn't want them to know our capabilities. Unless this is marketing for Google Cloud?

> why Google published this

Besides publicity, there is also link to a list of advisories that may be of interest to other cloud operators and users.

https://nvd.nist.gov/vuln/detail/CVE-2023-44487

Re: The largest DDoS attack to date, peaking above 398M rps

#317

Post by ryanisnan »

H8crilA wrote: post #196
Aissen wrote: post #18

Earlier quoted context omitted.

The technical article (linked in the post) has more interesting details: https://blog.cloudflare.com/technical-breakdown-http2-rapid-...

This should be the top comment. TL;DR: HTTP/2 is internally concurrent, can handle multiple streams. It is possible in HTTP/2 to send a nasty request that looks like so: - GET x1 - GET x2 - GET x3 - ... - GET x100 - Actually, cancel all of the above (uses multiple RST_STREAM frames) - GET x101 - GET x102 - (...) - GET x200 - Actually, cancel all of the above (uses multiple RST_STREAM frames) - (...) This can be repea…

That’s pretty fascinating. This is a naive solution, but couldn’t the protocol have supported limits of requests per packet? I get that it is antithetical, but for most sites, this type of request pattern seems highly unusual.

Re: The largest DDoS attack to date, peaking above 398M rps

#318

Post by epalm »

vineyardmike wrote: post #292
jedberg wrote: post #291

Earlier quoted context omitted.

Nah it's even better because they're considered capable defenders so it's harder. What I'm not sure of is why Google published this. I can't figure out what their strategy is here. We never published about the attacks we absorbed because we didn't want them to know our capabilities. Unless this is marketing for Google Cloud?

This is certainly marketing. If they sell DDOS protection, then announcing that they stopped the largest attack ever is an ad.

Maybe Google is responsible for the attack, to be able to publish this blog post!

Re: The largest DDoS attack to date, peaking above 398M rps

#319

Post by gwright »

542458 wrote: post #59
AdamN wrote: post #38

Earlier quoted context omitted.

The only answer is publicly-resourced protection and it's not that weird when you think about it. My apartment has a basic lock that any locksmith can undo and I'm safe because of my community and government protection (police, mental healthcare, justice system, etc...). Seems like the same logic should apply to my website or other digital property.

Where this breaks down is that because of the nature of the internet and DDoS attacks it’s not something that can easily be solved with better policing - even identifying a perp might be near-impossible, and they might be in another country anyways. The government does try to prosecute botnets and DDoS attacks today, but it’s of limited success. Is there a practical solution here I’m missing?

I don't know about a "practical solution", but there are research efforts to think about new ways to build internets that mitigate some of these problems.

Here is one that I'm aware of: https://named-data.net

Re: The largest DDoS attack to date, peaking above 398M rps

#320

Post by frostiness »

vineyardmike wrote: post #292
jedberg wrote: post #291

Earlier quoted context omitted.

Nah it's even better because they're considered capable defenders so it's harder. What I'm not sure of is why Google published this. I can't figure out what their strategy is here. We never published about the attacks we absorbed because we didn't want them to know our capabilities. Unless this is marketing for Google Cloud?

This is certainly marketing. If they sell DDOS protection, then announcing that they stopped the largest attack ever is an ad.

Sounds like a symbiotic relationship to me. The attackers get to advertise their capability for pulling off attacks, and Google gets to advertise their ability to stop them.
Post reply on HN