Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

361–370 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#361

Post by codedokode »

rootlocus wrote: post #156
codedokode wrote: post #80

Earlier quoted context omitted.

There should be a protocol to block traffic on the upstream provider. So if someone from 1.2.3.4 sends lots of traffic at you, you send a special packet to 1.2.3.4 and all upstream providers (including the provider that serves 1.2.0.0/16), that see this packet block traffic from that IP address directed at you. Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.…

> Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.2.3.4/16. So, if my neighbour is infected and one of his devices is part of a botnet, I get blocked as well?

Yes. Because blocking several extra users on a bad network that has several infected hosts and does nothing about it is better than being under attack.

Re: The largest DDoS attack to date, peaking above 398M rps

#362

Post by codedokode »

CountSessine wrote: post #146
codedokode wrote: post #111

Earlier quoted context omitted.

> What you say already exists, hell, you can use BGP to distribute ACLs But you should own an AS for that? > But it costs space in the routing tables Not implementing my proposal leaves critical infrastructure unprotected from foreign attacks. Make larger routing tables. Also, instead of blocking single IPs one can block /8 or /16 subnets.

Make larger routing tables. Brilliant! Why didn’t we think of that?!? MOARE TCAMS!!!

if Cloudflare can do this on commodity hardware (stop attacks and block thousands of IPs), then router manufacturers who have custom hardware can do much more.

Also, in Russia for example, there is DPI inspection and recording of all Internet traffic and if it is possible in Russia, then West can probably do 10x more. Simply adding a blacklist on routers seems like an easy task compared to DPI inspection.

Re: The largest DDoS attack to date, peaking above 398M rps

#363

Post by lazide »

mrweasel wrote: post #231
tristan9 wrote: post #202

Earlier quoted context omitted.

> What happens when you log an attack from a device that is attacking you from a school or business WiFi network? Block the whole IP forever? No, but for a day perhaps. > What if the user is on a CGNAT. Are you going to block the edge proxy for that entire ISP? Maybe. If the ISP doesn’t bother doing anything about it (which is THEIR job, not mine as a website operator). If the ISP can’t be arsed to do their job, why…

ISP needs to start taking much more responsibility, currently they do not care or choose not to care to avoid having to deal with upset customers. The fact that millions, if no more, devices can continue to access the internet regardless of how long they are compromised, is just crazy. I get that it put more responsibility upon end users to secure their devices, if they otherwise run the risk of get thrown of the int…

Either the ISPs are common carriers that follow some sort of basic rules, or they try to make people happy and end up stepping all over people randomly.

Currently there are zero rules (outside of a ISP ToS maybe) that forbids what you’re talking about. Pretty much anywhere I think? Unless you know of a law against having a infected or out of date computer connected to the internet?

There really is no way to have both. The current situation, they generally only deal with problem cases that get reported to them. And I doubt anyone is going to bother doing so for the 20k machines in this attack.

Re: The largest DDoS attack to date, peaking above 398M rps

#364

Post by elwell »

mihaic wrote: post #14

The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.

Leave it to HN to find the fly in the ointment when Google is mentioned.

Re: The largest DDoS attack to date, peaking above 398M rps

#365

Post by soperj »

wsintra2022 wrote: post #352
soperj wrote: post #324

Earlier quoted context omitted.

the most efficient way would be to write a script that gains root on those open proxies and then fixes the issue.

Effective or efficient? Would seem rather inefficient to spend time researching all the possible ways to gain route on x number of servers, finding an exploit, crafting some plan to execute it, keeping your prints clean etc etc

What way would be more efficient?

Re: The largest DDoS attack to date, peaking above 398M rps

#366

Post by codedokode »

CountSessine wrote: post #146
codedokode wrote: post #111

Earlier quoted context omitted.

> What you say already exists, hell, you can use BGP to distribute ACLs But you should own an AS for that? > But it costs space in the routing tables Not implementing my proposal leaves critical infrastructure unprotected from foreign attacks. Make larger routing tables. Also, instead of blocking single IPs one can block /8 or /16 subnets.

Make larger routing tables. Brilliant! Why didn’t we think of that?!? MOARE TCAMS!!!

This can be made on a paid basis. For example, for $1/month a customer gets a right to insert 1000 records (block up to 1000 networks or IPs) into blacklist on all Tier-1 ISPs. For $100/mo you can withstand an attack from 100 000 IPs which is more than enough and Cloudflare goes bankrupt.

Re: The largest DDoS attack to date, peaking above 398M rps

#367

Post by ignoramous »

epalm wrote: post #318
vineyardmike wrote: post #292

Earlier quoted context omitted.

This is certainly marketing. If they sell DDOS protection, then announcing that they stopped the largest attack ever is an ad.

Maybe Google is responsible for the attack, to be able to publish this blog post!

If Google truly went rouge, they could turn all those Chrome installs and Android devices into one gargantuan botnet.

Re: The largest DDoS attack to date, peaking above 398M rps

#368

Post by wly_cdgr »

jedberg wrote: post #249
pythonguython wrote: post #219

Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it w…

I've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these big attacks for street cred amongst the botting community. They then use their street cred to get paid by less scrupulous actors to attack their rivals. Sometimes the people paying are governments, sometimes just shady companies. For example last year there wa…

Wow, I guess sometimes the real world is as cool as the movies

Re: The largest DDoS attack to date, peaking above 398M rps

#369

Post by ignoramous »

jedberg wrote: post #291
whimsicalism wrote: post #276

Earlier quoted context omitted.

Seems like attacking Google would be a bad target for street cred as compared to govt websites.

Nah it's even better because they're considered capable defenders so it's harder. What I'm not sure of is why Google published this. I can't figure out what their strategy is here. We never published about the attacks we absorbed because we didn't want them to know our capabilities. Unless this is marketing for Google Cloud?

> We never published...

We? Netflix or Reddit? I know for a fact that Amazon doesn't.

Re: The largest DDoS attack to date, peaking above 398M rps

#370

Post by codedokode »

DanAtC wrote: post #286
codedokode wrote: post #75

Such attacks are possible because ISPs do not want to adopt a protocol that would allow any host to send a special packet to block malicious traffic on the upstream provider or even at the source network. In this case networks like Cloudflare would become unnecessary.

The tier 1 & 2 ISPs I've worked with have a blackhole BGP community. https://www.rfc-editor.org/rfc/rfc7999.html

As I understand, "blackholing" is basically siding with criminals: attackers want the victim to get off the network, and by "blackholing" the network operator complies with their demand, which allows attackers to save resources. Everybody wins except for the victim.
Post reply on HN