Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

381–390 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#381

Post by ExoticPearTree »

jrockway wrote: post #241
mrweasel wrote: post #240

Earlier quoted context omitted.

Yes, but currently that has zero consequences. Say you infect 500.000 Windows XP machines or consumer routers, the owners of those devices isn't going to be informed, nor is their ISPs. In many cases the manufacturer of those devices also aren't going to provide security update, but those probably wasn't going to be applied anyway.

Are you positive that "tell nobody" is the mitigation strategy that Google used here? They could have easily asked router vendors to patch their devices, asked ISPs to blackhole those customers until they're patched, etc.

So you're saying Google and Cloudflare, just as an example, should block consumers of other ISPs because they run "unpatched" software or they have malware running on their devices? Lol, this is a very absurd and narrow minded view how the internet works. You deal with the traffic, you don't randomly block eyeball networks because they're attacking you.

Re: The largest DDoS attack to date, peaking above 398M rps

#382

Post by jsnell »

jedberg wrote: post #291
whimsicalism wrote: post #276

Earlier quoted context omitted.

Seems like attacking Google would be a bad target for street cred as compared to govt websites.

Nah it's even better because they're considered capable defenders so it's harder. What I'm not sure of is why Google published this. I can't figure out what their strategy is here. We never published about the attacks we absorbed because we didn't want them to know our capabilities. Unless this is marketing for Google Cloud?

What capabilities did this post reveal the existence of? Not many, beyond it having been mitigated somehow and that it didn't cause an outage. The attackers knew that already, because they'd obviously be able to observe the system during the attack.

As for why to write about it, it's a new type of attack that resulted in almost an order of magnitude increase in attack size. That's interesting and newsworthy by itself, and publishing a concrete number gives people an idea of the size of the problem and the trendlines.

This is also something that needed a CVE, so it was going to be very public anyway. If nothing is written about it, at a minimum Cloud customers will be flooding their support reps with questions about whether the vulnerability applies to them.

Re: The largest DDoS attack to date, peaking above 398M rps

#383

Post by gffrd »

jedberg wrote: post #249
pythonguython wrote: post #219

Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it w…

I've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these big attacks for street cred amongst the botting community. They then use their street cred to get paid by less scrupulous actors to attack their rivals. Sometimes the people paying are governments, sometimes just shady companies. For example last year there wa…

Crypto companies attacking eachothers' websites?! Color me surprised …

Re: The largest DDoS attack to date, peaking above 398M rps

#384

Post by xnx »

imheretolearn wrote: post #376
xnx wrote: post #307

Earlier quoted context omitted.

Depends, but there seems to be a multiplier effect at play with this attack. A single client request may result in 100x the work for the server. More details here: https://cloud.google.com/blog/products/identity-security/how...

> Another advantage the attacker gains is that the explicit cancellation of requests immediately after creation means that a reverse proxy server won't send a response to any of the requests. Canceling the requests before a response is written reduces downlink (server/proxy to attacker) bandwidth. How is this an advantage? Can someone explain please?

The attacking system is shooting a firehose of requests at the target system, but doesn't have to deal with handling any responses being sent back to the requesting systems.

Re: The largest DDoS attack to date, peaking above 398M rps

#385

Post by jedberg »

ignoramous wrote: post #369
jedberg wrote: post #291

Earlier quoted context omitted.

Nah it's even better because they're considered capable defenders so it's harder. What I'm not sure of is why Google published this. I can't figure out what their strategy is here. We never published about the attacks we absorbed because we didn't want them to know our capabilities. Unless this is marketing for Google Cloud?

> We never published... We ? Netflix or Reddit? I know for a fact that Amazon doesn't.

Nowhere that I've ever worked published about attacks. We didn't want to validate the attackers.

At eBay/PayPal we filed patents on our DDOS shield, since it was as far as we knew the first one to exist, but that was about the only public information on it.

At reddit and Netflix we didn't actually have to deal with it because AWS just absorbed (or mitigated) it before it ever hit us. We only had to deal with L7 attacks, which we had shields in place for.

Re: The largest DDoS attack to date, peaking above 398M rps

#386

Post by imheretolearn »

xnx wrote: post #384
imheretolearn wrote: post #376

Earlier quoted context omitted.

> Another advantage the attacker gains is that the explicit cancellation of requests immediately after creation means that a reverse proxy server won't send a response to any of the requests. Canceling the requests before a response is written reduces downlink (server/proxy to attacker) bandwidth. How is this an advantage? Can someone explain please?

The attacking system is shooting a firehose of requests at the target system, but doesn't have to deal with handling any responses being sent back to the requesting systems.

Makes sense, thank you!

Re: The largest DDoS attack to date, peaking above 398M rps

#387

Post by antonjs »

ortusdux wrote: post #288
fnordpiglet wrote: post #285

Earlier quoted context omitted.

Surely bringing down Google is a bigger technical achievement than some random government website maintained by someone who stumbled into their job after 20 years doing mid level government organizational work.

Heck, I'd imagine that making headlines and having Google benchmark your attack would bring some amazing street cred.

Darknet guerilla marketing. Definitely seems to have worked.

Now we need the SEO content side: "How we hit Google with 398M RPS".

"... you can do this manually, but our product makes it as easy as a sign up and API call. Talk to us about pricing. [Python API example].

Re: The largest DDoS attack to date, peaking above 398M rps

#388

Post by acheron »

adrianN wrote: post #215
bombcar wrote: post #200

Earlier quoted context omitted.

Child-run lemonade stands are technically illegal in most states (some have actually carved out exemptions for them because of overzealous policing). Garage sales often have a specific carve out, also, and limitations on numbers of time per year, etc. Most areas nobody cares at all until it becomes a nuisance somehow.

Selectively enforced laws are the worst kind of law.

Don't tell that to the GDPR defenders.

Re: The largest DDoS attack to date, peaking above 398M rps

#389

Post by NikolaNovak »

frozenport wrote: post #331
jedberg wrote: post #249

Earlier quoted context omitted.

I've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these big attacks for street cred amongst the botting community. They then use their street cred to get paid by less scrupulous actors to attack their rivals. Sometimes the people paying are governments, sometimes just shady companies. For example last year there wa…

>> Most of the people who do this have a lot of technical skill but not a lot of opportunity to get paid for it based on where they live or the circumstances of their upbringing. LOL. No there are plenty of legitimate enterprises as well as opportunity to immigrate. Especially in tech. These guys are just criminals.

Not to condone the DDoS activities in the least, but that's just ignorance. Which prosperous country accepts evrn remotely as many legal immigrants as apply / would want to move there? And a lot of people / political parties are constantly lobbying for less immigration :-/

Re: The largest DDoS attack to date, peaking above 398M rps

#390

Post by jseutter »

imheretolearn wrote: post #376
xnx wrote: post #307

Earlier quoted context omitted.

Depends, but there seems to be a multiplier effect at play with this attack. A single client request may result in 100x the work for the server. More details here: https://cloud.google.com/blog/products/identity-security/how...

> Another advantage the attacker gains is that the explicit cancellation of requests immediately after creation means that a reverse proxy server won't send a response to any of the requests. Canceling the requests before a response is written reduces downlink (server/proxy to attacker) bandwidth. How is this an advantage? Can someone explain please?

It's an advantage because you as a botnet client have made the server side do extra work. You sent two packets, one to request a new connection, and a second to immediately cancel the request. The server on the other hand sees a connection request and does some work like allocating memory and fetching the resource you requested. Once the server starts sending the response back to the client via the reverse proxy, the reverse proxy notices the request is no longer current and just drops the response on the floor. As a result, you made the server do some amount of work and you don't have to worry about saturating your internet connection. They call this a magnification attack because for the cost of two requests you made the server do some multiple of work.

You could add some smarts to the server or reverse proxy that delays starting work in case a cancellation request quickly arrives. This is probably part of the mitigation work they refer to in the article.

Post reply on HN