Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

351–360 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#351

Post by codedokode »

tsimionescu wrote: post #173
codedokode wrote: post #115

Earlier quoted context omitted.

You can only block access to your IP address, so you can ban someone from sending packets to you but not to anyone else. My proposal is well-thought and doesn't require any lists like Spamhaus that have vague policies for inclusion and charge money for removing. My proposal doesn't have any potential for misuse.

It's not very hard to send packets with a fake source IP, especially if you don't care about the reply.

The routers can send back a confirmation token to confirm the origin address.

Re: The largest DDoS attack to date, peaking above 398M rps

#352

Post by wsintra2022 »

soperj wrote: post #324
superjan wrote: post #297

Earlier quoted context omitted.

How? I suppose the most effective way is to have those proxies attack each other. But don’t, it’s likely illegal.

the most efficient way would be to write a script that gains root on those open proxies and then fixes the issue.

Effective or efficient? Would seem rather inefficient to spend time researching all the possible ways to gain route on x number of servers, finding an exploit, crafting some plan to execute it, keeping your prints clean etc etc

Re: The largest DDoS attack to date, peaking above 398M rps

#353

Post by codedokode »

plagiarist wrote: post #144
codedokode wrote: post #115

Earlier quoted context omitted.

You can only block access to your IP address, so you can ban someone from sending packets to you but not to anyone else. My proposal is well-thought and doesn't require any lists like Spamhaus that have vague policies for inclusion and charge money for removing. My proposal doesn't have any potential for misuse.

Sorry, this is not well-thought and certainly has potential for abuse. This is on IP and not domain? What is the signing authority and cryptography mechanism preventing a spoofed request?

When you send a "reject" packet, the imtermediate routers send back a confirmation code. You must send this code back to them to confirm that "reject" packet comes from your IP address. No cryptography or signing required.

Re: The largest DDoS attack to date, peaking above 398M rps

#354

Post by lazide »

_ea1k wrote: post #147
gchamonlive wrote: post #69

Earlier quoted context omitted.

What? Let's go back to username and password. 2FA forces scammers to up their game. What about password managers? Having separate passwords to every account makes hacking into your accounts much harder and might hurt everyone in the long run. And don't get me started on end to end encryption. Privacy, long term, will mean the fall of civilization. Sarcasm aside. I think I understand your point in which we shouldn't j…

But that's exactly the problem, it shouldn't require a enterprise grade tool just to host a simple website on the internet. We've lost something due to our inability to stop attacks at the source and heavy overreliance on massive cloud providers to do it for us. 2FA and password managers didn't make us heavily reliant on massive companies.

It doesn’t take enterprise grade tools to host a website.

It does take enterprise grade tools to defend against the largest DDoS ever attempted.

Those are not the same thing. And those DDoS’s often are aimed at things besides a HTTPS endpoint.

Re: The largest DDoS attack to date, peaking above 398M rps

#355

Post by pizzafeelsright »

belter wrote: post #305
whimsicalism wrote: post #299

Earlier quoted context omitted.

Yes, “these attacks” referring to the sophisticated novel attacks under discussion in the article. No need to be defensive, just read it next time.

Are there DDoS attacks that are not sophisticated in form or execution? :-)

ping

Re: The largest DDoS attack to date, peaking above 398M rps

#356

Post by codedokode »

iforgotpassword wrote: post #152
codedokode wrote: post #112

Earlier quoted context omitted.

You can deny access only from your IP, not for anyone else.

How do you verify the source address of the packet is legit?

The router can send back a confirmation code and you must send it back to confirm that request comes from your IP.

Also, on a well-behaved networks that do not allow spoofing IP addresses, this check can be omitted.

Re: The largest DDoS attack to date, peaking above 398M rps

#357

Post by lazide »

not2b wrote: post #267
jrockway wrote: post #242

Earlier quoted context omitted.

You have some control over this as an ordinary citizen. Next time you're on a jury for a lemonade stand violation, nullify.

Has a lemonade stand violation ever resulted in a jury trial in the US? I'm skeptical. In places that enforce those rules, usually what happens is that the cops tell the parent it isn't allowed, the kid shuts it down and there's no fine.

Or it turns into a giant PR disaster for the cops.

Re: The largest DDoS attack to date, peaking above 398M rps

#358

Post by lazide »

dylan604 wrote: post #203
_ea1k wrote: post #147

Earlier quoted context omitted.

But that's exactly the problem, it shouldn't require a enterprise grade tool just to host a simple website on the internet. We've lost something due to our inability to stop attacks at the source and heavy overreliance on massive cloud providers to do it for us. 2FA and password managers didn't make us heavily reliant on massive companies.

you don't need enterprise grade tools just to host a simple website. however, if your simple site ever gains enough attraction to come under an attack, especially like this, you'll never survive. you can either just accept that your service will not survive the attack and just shut it down until the attackers realize mission accomplished and stops. you can then hope they don't notice when you bring it back. no simple…

It won’t survive - until a day or so later you’ve migrated to one of the large providers who provide the protection.

Re: The largest DDoS attack to date, peaking above 398M rps

#359

Post by rvba »

whimsicalism wrote: post #302
fnordpiglet wrote: post #285

Earlier quoted context omitted.

Surely bringing down Google is a bigger technical achievement than some random government website maintained by someone who stumbled into their job after 20 years doing mid level government organizational work.

Yes, but they are clearly going to fail to bring down Google.

Aim high and go out with a bang choom

Re: The largest DDoS attack to date, peaking above 398M rps

#360

Post by lazide »

rglullis wrote: post #262
gchamonlive wrote: post #235

Earlier quoted context omitted.

Honest question, because it is interesting and might change how I approach backing up my passwords. How would you go about maintaing that physical copy updated? What I think would make this approach hard is that you would have to ponder if a newly created account is important at creation time in order to know if you should update the off-site, physical copy of your most important passwords (I say this because if you…

The lesson is not to "avoid" the cloud, but to not be "dependent" on it. Doubly so if the service provided is one that keeps you locked in and can not be ported over. So yes, I feel comfortable with my strategy of having backups on bluray disks + S3. If AWS goes down or decides to jack up their prices to something unacceptable, I will take the physical copies and move then to the dozen others S3-compatible alternativ…

LastPass is an issue - but even LastPass would let you export/print the passwords. So no hard dependency there*. Google Authenticator recently did something similar with QR codes.

* though OTP seeds don’t print, and you can’t export/print attachments. I don’t recommend LastPass for these and many other reasons.

Post reply on HN