Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

441–450 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#441

Post by southernplaces7 »

xnx wrote: post #284
jessriedel wrote: post #280

Earlier quoted context omitted.

Very useful, thanks. Do you know roughly what sort of resources, in time, money, and compromised machines, it takes to do something like this? (Order of magnitude.)

approx. 20,000 machines https://news.ycombinator.com/item?id=37831355

If this attack takes only 20,000 machines to orchestrate, how is it the "largest DDoS attack to date"? It was to my understanding that some botnets and organizations have placed far more than 20,000 machines under their control before or currently. Could you explain a bit better?

Re: The largest DDoS attack to date, peaking above 398M rps

#442

Post by [deleted] »

menscher wrote: post #417
glenngillen wrote: post #400

> We noticed these attacks at the same time two other major industry players — Google and AWS — were seeing the same. Curious if there's anyone in the HN crowd that works at this level in one of the major vendors. What happens during an attack of this scale? Are there people from Cloudflare + Google + AWS on a live videoconference call co-ordinating with each other in real-time to mitigate it? Or is each vendor mostl…

We typically fight our own fires, but if one of us sees something interesting/new we often ask others (after the fire is out) if anyone else saw a similar attack (which could be a new botnet, a new attack method, or whatever). In this case we realized we were all looking at the same thing (which could have huge impact on smaller targets), so collaborated on understanding the problem and coordinated the security respo…

[deleted]

Re: The largest DDoS attack to date, peaking above 398M rps

#443

Post by bimguy »

danwee wrote: post #337
pythonguython wrote: post #219

Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it w…

Google? If you analyze the situation from the perspective of "Who benefits from it?", then the answer is clearly: Google benefits from it (they are so good, they can mitigate gigantic DDoS attacks). So, I don't think it's that crazy to think this is all a publicity stunt .

I was thinking the same thing. Especially when the the bottom of the article is basically a sales pitch for their own services. Whilst what they are saying is true and correct even if they aren't behind it (which I really doubt that they are the culprit).

"With or without patches, organizations would need to make significant infrastructure investments to keep services running in the face of attacks of any moderate size and larger. Instead of bearing that expense themselves, organizations running services on Google Cloud can take advantage of our investment in capacity at global scale in our Cross-Cloud Network to deliver and protect their applications."

Re: The largest DDoS attack to date, peaking above 398M rps

#444

Post by xnx »

southernplaces7 wrote: post #441
xnx wrote: post #284

Earlier quoted context omitted.

approx. 20,000 machines https://news.ycombinator.com/item?id=37831355

If this attack takes only 20,000 machines to orchestrate, how is it the "largest DDoS attack to date"? It was to my understanding that some botnets and organizations have placed far more than 20,000 machines under their control before or currently. Could you explain a bit better?

I think they're measuring "largest" by the number of requests per second.

Re: The largest DDoS attack to date, peaking above 398M rps

#445

Post by gloosx »

pythonguython wrote: post #219

Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it w…

few hours of inconvenience in corporate cloud infrastructure has a result also - large amounts of money lost. So most obvious incentive is simply ransom

Re: The largest DDoS attack to date, peaking above 398M rps

#446

Post by Gud »

wly_cdgr wrote: post #368
jedberg wrote: post #249

Earlier quoted context omitted.

I've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these big attacks for street cred amongst the botting community. They then use their street cred to get paid by less scrupulous actors to attack their rivals. Sometimes the people paying are governments, sometimes just shady companies. For example last year there wa…

Wow, I guess sometimes the real world is as cool as the movies

Not cool at all, just a waste of talent.

Re: The largest DDoS attack to date, peaking above 398M rps

#447

Post by BitPirate »

dominicdoty wrote: post #218

Couldn't cloudflare show a page to the next handful of http requests from an IP informing the user that "something on your network is participating in DDoS attacks". All the big providers could do this, just inject a little turnstile like page in front of the next cloudflare site you visit. I would love to know if there's a compromised device on my network, and I don't have any real monitoring set up to detect it. It…

In the age of CGNAT? Not a good idea.

Re: The largest DDoS attack to date, peaking above 398M rps

#448

Post by iforgotpassword »

codedokode wrote: post #356
iforgotpassword wrote: post #152

Earlier quoted context omitted.

How do you verify the source address of the packet is legit?

The router can send back a confirmation code and you must send it back to confirm that request comes from your IP. Also, on a well-behaved networks that do not allow spoofing IP addresses, this check can be omitted.

> The router can send back a confirmation code and you must send it back to confirm that request comes from your IP.

Ideally with the token packet being larger than the initial packet, so it can easily be abused for a reflection attack... ;-)

> Also, on a well-behaved networks that do not allow spoofing IP addresses, this check can be omitted.

This is already not true for most networks, and in your case would've to be true for all intermediate networks which is just impossible.

In another post you suggest this should also allow blocking entire networks; how do you prevent abuse of that?

Your suggestion is anything but well-thought, it's a pipe dream for a perfect world, but if we'd live in one, we wouldn't have ddos attacks in the first place.

Re: The largest DDoS attack to date, peaking above 398M rps

#450

Post by tsimionescu »

papichulo2023 wrote: post #119
tsimionescu wrote: post #104

Earlier quoted context omitted.

So I can deny service to your site with a single packet, instead of having to bother with establishing a whole botnet? The current botnet customers would be the first to advocate for this new protocol!

Yeah, we should invent secure communication channels and crypto keys first...

This proposal only works if the packets are readable by every intermediate router. Or are you suggesting that you establish a TLS session with every router between you and the attacker?
Post reply on HN