Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

371–380 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#371

Post by metalrain »

So given that minimum size of HTTP request is something under 32 bytes, some sources say 18 bytes but let's be generous here HTTP can be complex. In theory I could send 4M requests in second with 1 Gbps connection. 1 Tbps total connection capacity could do close to 4.3B rps given perfect distribution.

I imagine distributing the load becomes harder/more expensive the bigger the scale. In real network you probably have to find the paths that don't slow you down and then strike for short time before you are banned.

Cloudflare has made post about mitigating 2 Tbps DDOS in 2021, so in real attacks request sizes aren't quite that optimal.

Re: The largest DDoS attack to date, peaking above 398M rps

#372

Post by sharkoz »

xnickb wrote: post #335
frozenport wrote: post #331

Earlier quoted context omitted.

>> Most of the people who do this have a lot of technical skill but not a lot of opportunity to get paid for it based on where they live or the circumstances of their upbringing. LOL. No there are plenty of legitimate enterprises as well as opportunity to immigrate. Especially in tech. These guys are just criminals.

Have you tried that yourself? Especially as someone who has the skills but doesn't speak the language. I know people who can't relocate because of communication issues and/or cultural differences. No they aren't criminals, but they are definitely underpaid compared to those who managed to relocate.

If they operate botnets, I think it's fair to call them criminals

Re: The largest DDoS attack to date, peaking above 398M rps

#373

Post by codedokode »

Egrodo wrote: post #162
codedokode wrote: post #75

Such attacks are possible because ISPs do not want to adopt a protocol that would allow any host to send a special packet to block malicious traffic on the upstream provider or even at the source network. In this case networks like Cloudflare would become unnecessary.

If it becomes this easy to block traffic couldn't malicious applications really mess up a user by spamming out reject packets for common IP?

The intermediate routers can send back a confirmation code, and you must send a new reject packet with this code to confirm the ban.

Re: The largest DDoS attack to date, peaking above 398M rps

#374

Post by chuckSu »

xnickb wrote: post #335
frozenport wrote: post #331

Earlier quoted context omitted.

>> Most of the people who do this have a lot of technical skill but not a lot of opportunity to get paid for it based on where they live or the circumstances of their upbringing. LOL. No there are plenty of legitimate enterprises as well as opportunity to immigrate. Especially in tech. These guys are just criminals.

Have you tried that yourself? Especially as someone who has the skills but doesn't speak the language. I know people who can't relocate because of communication issues and/or cultural differences. No they aren't criminals, but they are definitely underpaid compared to those who managed to relocate.

[dead]

Re: The largest DDoS attack to date, peaking above 398M rps

#375

Post by ExoticPearTree »

pythonguython wrote: post #219

Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it w…

If I had the technical prowess to do this, I would do it just for the fun of it. I mean, why not? Anarchy is fun.

I'm pretty sure someone will find a way to take down GOOG/AWS/Azure/etc through a DDoS so large nothing will work for anyone.

Re: The largest DDoS attack to date, peaking above 398M rps

#376

Post by imheretolearn »

xnx wrote: post #307
ada1981 wrote: post #296

Earlier quoted context omitted.

So a single machine can do ~ 20,000 rps?

Depends, but there seems to be a multiplier effect at play with this attack. A single client request may result in 100x the work for the server. More details here: https://cloud.google.com/blog/products/identity-security/how...

> Another advantage the attacker gains is that the explicit cancellation of requests immediately after creation means that a reverse proxy server won't send a response to any of the requests. Canceling the requests before a response is written reduces downlink (server/proxy to attacker) bandwidth.

How is this an advantage? Can someone explain please?

Re: The largest DDoS attack to date, peaking above 398M rps

#377

Post by ExoticPearTree »

xnickb wrote: post #335
frozenport wrote: post #331

Earlier quoted context omitted.

>> Most of the people who do this have a lot of technical skill but not a lot of opportunity to get paid for it based on where they live or the circumstances of their upbringing. LOL. No there are plenty of legitimate enterprises as well as opportunity to immigrate. Especially in tech. These guys are just criminals.

Have you tried that yourself? Especially as someone who has the skills but doesn't speak the language. I know people who can't relocate because of communication issues and/or cultural differences. No they aren't criminals, but they are definitely underpaid compared to those who managed to relocate.

It is only criminal if the botnets are used to steal something. DDoS-in just for fun is at most an annoyance.

Re: The largest DDoS attack to date, peaking above 398M rps

#378

Post by mattigames »

londons_explore wrote: post #88
grotorea wrote: post #39

Earlier quoted context omitted.

20000 being modest really says a lot about the state of security on the Internet.

Distribute just one warez game with your malware embedded and you'll have well over 20,000 hosts under your control.

Is there any major popular account that distributes cracked games that has been found to do such thing? I have seen some popular accounts that create their own installers ("repacks") and the installation takes a suspiciously long time and a huge amount of RAM while is installing.

Re: The largest DDoS attack to date, peaking above 398M rps

#380

Post by codedokode »

sophacles wrote: post #270
codedokode wrote: post #100

Earlier quoted context omitted.

How exactly? You can authenticate sender by sending a special confirmation token back.

How does one get removed from the block list? Say some IoT device that half of households own gets compromised and turned into a giant botnet. The news gets out and everyone throws away that device. Now they are still blocked over a threat that doesn't exist anymore... doesn't seem like a good situation for anyone. I'd imagine that the website owners that want the attack stopped will soon want to figure out how to ge…

> How does one get removed from the block list?

We can add an "accept" packet that lifts the ban.

Also, how do you remove yourself from blacklist when banned by Google or Cloudflare? I guess here you use the same method.

> Say some IoT device that half of households own gets compromised and turned into a giant botnet. The news gets out and everyone throws away that device. Now they are still blocked over a threat that doesn't exist anymore... doesn't seem like a good situation for anyone.

Not my problem. Should have thought twice before buying a vulnerable device and helping criminals. As a solution they can buy a new IP address from their ISP.

Post reply on HN