Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

421–430 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#421

Post by tristan9 »

Analemma_ wrote: post #208
tristan9 wrote: post #187

Earlier quoted context omitted.

> just with everything production-grade, the average enterprise just isn't ready to deal with all the upfront cost to run your entire computing solution That’s not a fair point. We’re not even trying to make the internet safe. There is zero (0) actions being taken to stop this madness. If you run a large website, you still regularly see attacks from routers compromised 3, 4, 5 years ago. Or how a mere few days of pok…

I don't think it's true that 0 actions are being taken. When new vectors for amplification attacks are found, they get patched - you can't do NTP amplification attacks on modern NTP servers anymore, for example. But it takes a long time for the entire world to upgrade and just a handful of open vulnerable servers to launch attacks. And in the meantime people are always looking for new amplification vectors. > The sol…

IP reputation is already a thing. And plenty enough ASNs are well-known for willfully hosting C2 servers and spam, DoS, etc sources…

Re: The largest DDoS attack to date, peaking above 398M rps

#422

Post by tristan9 »

BHSPitMonkey wrote: post #245
tristan9 wrote: post #187

Earlier quoted context omitted.

> just with everything production-grade, the average enterprise just isn't ready to deal with all the upfront cost to run your entire computing solution That’s not a fair point. We’re not even trying to make the internet safe. There is zero (0) actions being taken to stop this madness. If you run a large website, you still regularly see attacks from routers compromised 3, 4, 5 years ago. Or how a mere few days of pok…

Traditionally, a botnet can be compromised (at least largely) of actual consumer devices unknowingly making requests on their owners' behalf. This can cover hundreds of unrelated ISPs as the "origin" and is effectively indistinguishable from organic traffic to a popular destination. "Accountability" is not simple here.

> Traditionally, a botnet can be compromised (at least largely) of actual consumer devices unknowingly making requests on their owners' behalf.

And I do count that in.

Just because a user is the source of an attack unknowingly doesn’t make it right.

What would make it right is for there to be a more generalized remote blackholing system in place.

ie my site runs on an IP, is able to tell my ISP to reject traffic to it from $sources, and my ISP can send that request to the source ISP.

And if it makes my site unavailable to that other ISP because of CGNAT and 0 oversight, tough luck. Guess their support is getting calls so maybe they start monitoring obviously abusive egress spikes per-destination.

Re: The largest DDoS attack to date, peaking above 398M rps

#423

Post by tristan9 »

zelon88 wrote: post #221
tristan9 wrote: post #202

Earlier quoted context omitted.

> What happens when you log an attack from a device that is attacking you from a school or business WiFi network? Block the whole IP forever? No, but for a day perhaps. > What if the user is on a CGNAT. Are you going to block the edge proxy for that entire ISP? Maybe. If the ISP doesn’t bother doing anything about it (which is THEIR job, not mine as a website operator). If the ISP can’t be arsed to do their job, why…

Trust me when I say that you don't want the ISP's to inspect web traffic. That is not how to solve this. That is costly for the ISP and will drive up costs. It also makes supporting a website impossible. The ISP is assumed by all parties to be impartial. That assumption is required for the internet to be operational. Sure it might function your way, but it would be impossible to support. And maybe Facebook and Google…

> Trust me when I say that you don't want the ISP's to inspect web traffic.

They do already. DPI on port 53 for DNS blocks or SNI inspection are common place. So are IP blocks.

> If you want traffic, you need to be equipped to handle traffic. You are the one with the internet facing infrastructure.

Slightly misleading wording here. More accurately your point is: « you want to run a website? Better have the infra to support traffic spikes comparable to that of a tech giant ». 400M rps would cost an unfathomable amount of money to be able to handle even just while dropping all packets.

> And maybe Facebook and Google are big enough to push around the ISP's, but they are the only ones. Nobody will bat an eyelash if 15,000 Comcast users in Phoenix AZ can access your hokey-pokey website.

Obviously yes. Too bad it’s better business for everyone to say nothing and just recommend you use their product.

Re: The largest DDoS attack to date, peaking above 398M rps

#424

Post by c0pium »

jekude wrote: post #342
KomoD wrote: post #250

Earlier quoted context omitted.

Anyone can claim that, there's no link to a specific actor

Step 1: Put message on blockchain beforehand with exact date/time and characteristics of DDoS Step 2: Execute DDoS Step 3: Prove to others you are responsible by using private key

There’s (as ever) no need for a blockchain, people do this with twitter and sha256 all the time. Hash the message, post the hash, wait for prediction to happen, post the full message.

Re: The largest DDoS attack to date, peaking above 398M rps

#425

Post by tristan9 »

dist-epoch wrote: post #210
tristan9 wrote: post #171

Earlier quoted context omitted.

Thing is, don’t care. The problem is that ISPs whose customers are originating the attacks from don’t give a shit. If we have to give up 1% of legitimate traffic to thwart 90% of attacks, it is a good deal. If you and other customers complain to your ISP (or switch), eventually they’ll do something about it. We can’t seriously keep on accepting that « thousands of compromised devices » is a fine reality for a « small…

Amazon definitely cares if they lose 1% of sales. Guess who has more votes, you or Amazon.

I’m aware. Doesn’t make it sting less being in the receiving end of attacks all the time and seeing everyone collectively shrug.

Re: The largest DDoS attack to date, peaking above 398M rps

#426

Post by tristan9 »

londons_explore wrote: post #277
tristan9 wrote: post #174

Earlier quoted context omitted.

You’re completely wrong. All large sites regularly get attacked. The average skiddie’s motivations are that they’re bored. So they DoS a site they use regularly just to see. Heck they generally don’t even mean to cause damage per-se, and just think it’s a funny use of their evening. You have to stop thinking DoS attacks are always particularly personal. They really often just aren’t, and it’s a monumental pain in the…

I run boring sites like government websites which say what kinds of recycling go in which color trash cans. Well used, but never attacked.

Well, lucky you. Or unlucky me and everyone I know running a large website. Guess we’ll never know.

Re: The largest DDoS attack to date, peaking above 398M rps

#427

Post by c0pium »

ExoticPearTree wrote: post #381
jrockway wrote: post #241

Earlier quoted context omitted.

Are you positive that "tell nobody" is the mitigation strategy that Google used here? They could have easily asked router vendors to patch their devices, asked ISPs to blackhole those customers until they're patched, etc.

So you're saying Google and Cloudflare, just as an example, should block consumers of other ISPs because they run "unpatched" software or they have malware running on their devices? Lol, this is a very absurd and narrow minded view how the internet works. You deal with the traffic, you don't randomly block eyeball networks because they're attacking you.

> you don't randomly block eyeball networks because they're attacking you.

ISPs do this literally all the time. They sell services that do this.

Re: The largest DDoS attack to date, peaking above 398M rps

#428

Post by grotorea »

sophacles wrote: post #270
codedokode wrote: post #100

Earlier quoted context omitted.

How exactly? You can authenticate sender by sending a special confirmation token back.

How does one get removed from the block list? Say some IoT device that half of households own gets compromised and turned into a giant botnet. The news gets out and everyone throws away that device. Now they are still blocked over a threat that doesn't exist anymore... doesn't seem like a good situation for anyone. I'd imagine that the website owners that want the attack stopped will soon want to figure out how to ge…

As much as I half-wish there was something like this, it does sound like email spam blacklists all over again.

Re: The largest DDoS attack to date, peaking above 398M rps

#429

Post by grotorea »

tmpX7dMeXU wrote: post #86
swarnie wrote: post #73

Earlier quoted context omitted.

> Sorry citizen, google services are inaccessible because the only ISP in your city sold a service to a bad actor. > We might fix this, we might not, you DONT have a choice. > Thank you for your continued business.

Hacker News nerds will argue all day long that the Internet is a utility when the argument happens to personally benefit them, then in the same breath say that a random network admin is justified in blocking a whole ISP subnet due to one “bad” actor. And of course by bad actor I mean person that almost certainly accidentally got themselves infected with malware by not understanding the completely Byzantine world of c…

Well, if someone had somehow gotten their house wires damaged in a way that causes brownouts to neighbours, wouldn't the electric company be justified in cutting off the house?

Re: The largest DDoS attack to date, peaking above 398M rps

#430

Post by starcraft2wol »

michaelt wrote: post #253
master-lincoln wrote: post #197

Earlier quoted context omitted.

Is this sarcasm? If not please provide some more details on why you think "2FA was in large part motivated by limiting bot accounts and getting customers phone number". I never used a phone number for 2fa. Mostly TOTP. Bots could do that too. I don't see the connection. >I can't imagine how much productivity the economy loses every day due to 2FA. Is it really that much? Every few days I have to enter a 6 digit numbe…

While I don't take starcraft2wol's theory seriously, there are a bunch of services that have made phone numbers essentially mandatory. They claim this is to "protect your account". You sign up for a Skype account or Twitter account and decline to give your phone number, instead choosing a different form of 2FA? In my experience your account will be blocked for 'suspicious activity' even if you have literally no activ…

And you still don't take my theory seriously :)
Post reply on HN