Earlier quoted context omitted.
Wow, I guess sometimes the real world is as cool as the movies
Not cool at all, just a waste of talent.
They should work to increase ad revenue by subliminal messaging and lootboxization instead!
The largest DDoS attack to date, peaking above 398M rps
451–460 of 487 posts
Re: The largest DDoS attack to date, peaking above 398M rps
#452As elections are getting closer, the public needs to be primed for adversary attacks and disinformation.
Re: The largest DDoS attack to date, peaking above 398M rps
#453Earlier quoted context omitted.
Maybe Google is responsible for the attack, to be able to publish this blog post!
If Google truly went rouge, they could turn all those Chrome installs and Android devices into one gargantuan botnet.
Google is already partly rouge, at least in their logo.
Re: The largest DDoS attack to date, peaking above 398M rps
#454Earlier quoted context omitted.
Patch what though? They know that they're getting hit with unprecedented traffic, not how those computers were infected.
It's mostly not infected computers, but rather poorly configured proxies that are open for anyone to bounce malicious traffic through. Convincing everyone to clean up their open proxies is a long-term, hard problem. But I plan to tackle it soon....
[deleted]
Re: The largest DDoS attack to date, peaking above 398M rps
#455Re: The largest DDoS attack to date, peaking above 398M rps
#456How does DDoS mitigation work? When people say "I put my website behind Cloudflare to mitigate DDoSes", what does it mean exactly? Is it only about having a large enough ingress pipe that you can weather however many Gb/s you are being bombarded with, and still having some spare capacity for legitimate traffic?
You use algorithms like token bucket.
Re: The largest DDoS attack to date, peaking above 398M rps
#457Earlier quoted context omitted.
It's not very hard to send packets with a fake source IP, especially if you don't care about the reply.
The routers can send back a confirmation token to confirm the origin address.
First of all, there is no way this works reliably for anything but the first hop. There is no way for a router to send a packet to you in a way where you can reply to that router unless you are connected directly to it, unless all ISP routers start being assigned public IP addresses. Additionally, there are normally many paths between you and your attacker, and there is no guarantee that packets you send will take the same path as the packets you were receiving. Especially as the routing rules get modified by your successful blocking requests.
That also means that every router now has to maintain a connection table to keep track of all of the pending confirmations, and to periodically check that table for expirations so it can clean it up. Maybe not that bad for a local router, but this is completely unworkable for routers handling larger parts of the internet.
And of course, anyone who has a tap into that level can trivially spoof all of the correct replies so it's still not a secure mechanism.
Re: The largest DDoS attack to date, peaking above 398M rps
#458The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.
For a side-hobby of mine (writing), I imagine what would happen if current trends would continue. Thus, big caveat, it's all just thought experiments, not realistic predictions of any kind. For this particular scenario, the public Internet would get so bad ("enshitified") that people would tend to leave it alone. For essential public services, governments would set up their own networks disconnected from the Internet…
You heard of New IP? The Huawei/Chinese plan to reform the Internet that keeps getting criticized for a variety of reasons. I haven't had the times to read the proposals proper, but the stuff about build trust directly into the network seems like it could solve this problem, at a price.
> Having security and trust be “intrinsic” to the network will require core layers to carry metadata about the users, applications and services being transported. If users need to register in order to have packets sent to their destination, the result is that network operators, and those who license the operators, can remove individual users’ access at any time.
https://dnsrf.org/.k-media/d3c1d810de1e98bdf7af7aa52406e837.... (critical of the proposal)
Re: The largest DDoS attack to date, peaking above 398M rps
#459Earlier quoted context omitted.
approx. 20,000 machines https://news.ycombinator.com/item?id=37831355
So a single machine can do ~ 20,000 rps?
Of course. Depending on the machine and on the network, a single modern machine can do even up to a few millions RPS. This is routinely used in benchmarking tools.
Here with the "attack", it's simply exploiting the ability of HTTP/2 to compress requests and reduce them to just a few bytes, meaning that within a few kilobytes of data you can easily have hundreds of requests. Again this is not new and was already being discussed in 2012 about SPDY's use of zlib to compress requests.
The extra stuff that seems to have made this attack "new" for such service providers is that attackers took care of closing their requests so as not to have to wait for a response and be able to fill the wire with a flow of request. Again this has been known from the inception of HTTP/2 and routinely met by those dealing with proxies which timeout and send headers followed by rst_stream.
Here it makes noise because new records were broken, and likely because the stacks in place were not properly designed so they omitted to check for the real number of streams and only focused on the protocol validity...
Re: The largest DDoS attack to date, peaking above 398M rps
#460Earlier quoted context omitted.
Not as bad as one may think. It's proper feedback which can be acted upon. Every reasonable connectivity provider would pay attention to this info, or face intense complaints from its users with shared and dynamic IPs. It would identify sources of attacks, and block them at higher granularity level, reporting that the range has been cleared. (If a provider lied, everyone would stop believing it, and the disgruntled c…
Funny man, thinks big ISP cares you yourself blocked your own site from your own customers coming from the big ISP network.
No; with a shared hosting, somebody else manages to blacklist the IP that serves many paying customers.