Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

331–340 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#331

Post by frozenport »

jedberg wrote: post #249
pythonguython wrote: post #219

Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it w…

I've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these big attacks for street cred amongst the botting community. They then use their street cred to get paid by less scrupulous actors to attack their rivals. Sometimes the people paying are governments, sometimes just shady companies. For example last year there wa…

>> Most of the people who do this have a lot of technical skill but not a lot of opportunity to get paid for it based on where they live or the circumstances of their upbringing.

LOL. No there are plenty of legitimate enterprises as well as opportunity to immigrate. Especially in tech. These guys are just criminals.

Re: The largest DDoS attack to date, peaking above 398M rps

#332

Post by [deleted] »

jedberg wrote: post #291
whimsicalism wrote: post #276

Earlier quoted context omitted.

Seems like attacking Google would be a bad target for street cred as compared to govt websites.

Nah it's even better because they're considered capable defenders so it's harder. What I'm not sure of is why Google published this. I can't figure out what their strategy is here. We never published about the attacks we absorbed because we didn't want them to know our capabilities. Unless this is marketing for Google Cloud?

[deleted]

Re: The largest DDoS attack to date, peaking above 398M rps

#333

Post by AtNightWeCode »

H8crilA wrote: post #196
Aissen wrote: post #18

Earlier quoted context omitted.

The technical article (linked in the post) has more interesting details: https://blog.cloudflare.com/technical-breakdown-http2-rapid-...

This should be the top comment. TL;DR: HTTP/2 is internally concurrent, can handle multiple streams. It is possible in HTTP/2 to send a nasty request that looks like so: - GET x1 - GET x2 - GET x3 - ... - GET x100 - Actually, cancel all of the above (uses multiple RST_STREAM frames) - GET x101 - GET x102 - (...) - GET x200 - Actually, cancel all of the above (uses multiple RST_STREAM frames) - (...) This can be repea…

If this is true than the design is problematic. What makes it even worse is that cancellation of requests typically does not work in cloud environments. It is a bit laughable that Azure for instance recommend the use of cancellation tokens but in reality you never get them for web requests.

Re: The largest DDoS attack to date, peaking above 398M rps

#334

Post by brazzledazzle »

jedberg wrote: post #290
jessriedel wrote: post #280

Earlier quoted context omitted.

Very useful, thanks. Do you know roughly what sort of resources, in time, money, and compromised machines, it takes to do something like this? (Order of magnitude.)

They compromise home internet users and/or their IOT devices mostly with scripts and malware. So the investment for the scammer is mostly in researching exploits and seeding their malware. Most of them just use exploits created by others, but the best ones with the biggest networks are actually very capable security researchers. Given different circumstances they could probably be highly paid engineers.

Some of their effort goes toward maintaining an exclusive hold on their botnet too. Patching them while maintaining control or blocking the vulnerability they used from being utilized by others.

Re: The largest DDoS attack to date, peaking above 398M rps

#335

Post by xnickb »

frozenport wrote: post #331
jedberg wrote: post #249

Earlier quoted context omitted.

I've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these big attacks for street cred amongst the botting community. They then use their street cred to get paid by less scrupulous actors to attack their rivals. Sometimes the people paying are governments, sometimes just shady companies. For example last year there wa…

>> Most of the people who do this have a lot of technical skill but not a lot of opportunity to get paid for it based on where they live or the circumstances of their upbringing. LOL. No there are plenty of legitimate enterprises as well as opportunity to immigrate. Especially in tech. These guys are just criminals.

Have you tried that yourself? Especially as someone who has the skills but doesn't speak the language.

I know people who can't relocate because of communication issues and/or cultural differences.

No they aren't criminals, but they are definitely underpaid compared to those who managed to relocate.

Re: The largest DDoS attack to date, peaking above 398M rps

#336

Post by MuffinFlavored »

lapcat wrote: post #87
MuffinFlavored wrote: post #81

How large of a “botnet” did it take to cause 398M rps?

Apparently only 20K: https://blog.cloudflare.com/technical-breakdown-http2-rapid-...

19.9k requests per second per machine

That seems high/impressive

I guess we don't have a good understanding if somebody had control of a blend of 10k VMs in the cloud, 10k infected PCs, etc.

Re: The largest DDoS attack to date, peaking above 398M rps

#337

Post by danwee »

pythonguython wrote: post #219

Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it w…

Google?

If you analyze the situation from the perspective of "Who benefits from it?", then the answer is clearly: Google benefits from it (they are so good, they can mitigate gigantic DDoS attacks). So, I don't think it's that crazy to think this is all a publicity stunt .

Re: The largest DDoS attack to date, peaking above 398M rps

#338

Post by KomoD »

xnx wrote: post #307
ada1981 wrote: post #296

Earlier quoted context omitted.

So a single machine can do ~ 20,000 rps?

Depends, but there seems to be a multiplier effect at play with this attack. A single client request may result in 100x the work for the server. More details here: https://cloud.google.com/blog/products/identity-security/how...

Yep: "a client can send a RST_STREAM frame for a single stream. This instructs the server to stop processing the request and to abort the response, which frees up server resources and avoids wasting bandwidth."

Pretty clever

Re: The largest DDoS attack to date, peaking above 398M rps

#339

Post by DaveSchmindel »

mihaic wrote: post #14

The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.

I smell what you're stepping in here, but I grow more comfortable with the idea of big conglomerates continuing to improve their attack mitigation efforts on behalf of their locales when I compare this to the concept to vaccines.

Vaccines inevitably lead to stronger viruses, but would you argue we should go back and not have began to use them?

Cloudflare and Google may be some sites' only hope to staying alive in the event of network-driven attacks. I suppose this landscape is a double-edged sword.

Re: The largest DDoS attack to date, peaking above 398M rps

#340

Post by pixl97 »

frostiness wrote: post #320
vineyardmike wrote: post #292

Earlier quoted context omitted.

This is certainly marketing. If they sell DDOS protection, then announcing that they stopped the largest attack ever is an ad.

Sounds like a symbiotic relationship to me. The attackers get to advertise their capability for pulling off attacks, and Google gets to advertise their ability to stop them.

Almost all (but not all) of these attacks are based on some kind of problem that leads to amplification. Advertizing that people should fix these points of exploit help everyone on the internet.
Post reply on HN