Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

461–470 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#461

Post by codedokode »

TheDong wrote: post #419
codedokode wrote: post #349

Earlier quoted context omitted.

No, it cannot. It is well-thought.

There are 2^128 ipv6 addresses. If you store 1 bit (banned/unbanned) + a unix timestamp (ban expiration) for each of those IPs, that requires more storage space than exists many billion times over. To store such a block table you propose would require more memory for routers than any router has ever had and ever will have. An attacker could easily "flush" all entries in this table by, for example, banning a TB of ipv…

We can store an IP address with a mask (ban subnets instead of separate addresses). Also, IPv6 is so rarely used, that I would ban whole address space for the time of attack.

For example, if an attack is coming from a country you where you don't have many paying customers, but where there are many infected devices due to use of pirated outdated software, it is easier to ban the whole country than to figure out who is infected and who is not.

Re: The largest DDoS attack to date, peaking above 398M rps

#462

Post by codedokode »

TheDong wrote: post #419
codedokode wrote: post #349

Earlier quoted context omitted.

No, it cannot. It is well-thought.

There are 2^128 ipv6 addresses. If you store 1 bit (banned/unbanned) + a unix timestamp (ban expiration) for each of those IPs, that requires more storage space than exists many billion times over. To store such a block table you propose would require more memory for routers than any router has ever had and ever will have. An attacker could easily "flush" all entries in this table by, for example, banning a TB of ipv…

> An attacker could easily "flush" all entries in this table by, for example, banning a TB of ipv6 addresses

We can set a limit of ban records per host to prevent it.

Re: The largest DDoS attack to date, peaking above 398M rps

#463

Post by codedokode »

toast0 wrote: post #222
codedokode wrote: post #80

Earlier quoted context omitted.

There should be a protocol to block traffic on the upstream provider. So if someone from 1.2.3.4 sends lots of traffic at you, you send a special packet to 1.2.3.4 and all upstream providers (including the provider that serves 1.2.0.0/16), that see this packet block traffic from that IP address directed at you. Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.…

If the source field in a packet reliably indicated the source of the packet and a given IP was sending you a lot of unwanted traffic, you'd ask their ISP to turn them off and the problem would be solved. Maybe one day BCP38 will be fully deployed and that will work. I also dream of a day where chargen servers are only a memory. Some newer protocols are designed to limit the potential of reflected responses. Null rout…

> If the source field in a packet reliably indicated the source of the packet and a given IP was sending you a lot of unwanted traffic, you'd ask their ISP to turn them off and the problem would be solved

No. Your email will go straight into trash because ISP is not interested in doing something for people who don't pay them money. Also, even if they cooperate, it will take too much time.

> Null routing is available

Null routing means complying with criminals' demand (they want the site to become inaccessible).

> it's unlikely to happen

It will very likely happen if there will be a serious attack on Western infrastructure: for example, if there will be no electricity in a large city for several days, of if hospitals across the country won't work or something like this. Then the measures will be taken. Of course, while the victims are small non-critical businesses, nobody will care.

> Otherwise, the only solution is to have more input bandwidth than the attack and suck it up. Content networks are in a great position here, because they deliver a lot of traffic over symetric connections, they have a lot of spare inbound capacity.

So until my proposal is implemented the only solution is to pay protection money to unnecessary middlemen like Cloudflare.

Re: The largest DDoS attack to date, peaking above 398M rps

#465

Post by 89vision »

rglullis wrote: post #455
ExoticPearTree wrote: post #402

Earlier quoted context omitted.

For the website or for the use of the botnet?

For the use of the botnet...

sure, It's no doubt an arms race. The prevalance of websites going down due to scaling issues feels like order of magnitude less than it was 20 years ago though. Purely anecdotal with no real data to back that up.

Re: The largest DDoS attack to date, peaking above 398M rps

#466

Post by ExoticPearTree »

ajcp wrote: post #416
ExoticPearTree wrote: post #404

Earlier quoted context omitted.

They should have better IT. Blaming it on the people that knock them off will not make improve the situation.

So your logic is: condemning people for criminal behavior is not useful because it de-incentivizes their victims from being vigilant against that criminal behavior. Am I getting that right?

No. My logic is that when it comes to computers, it's a battle of the brains: who is smarter than the other one. And the result is usually a novel way of attacking someone, and then finding novel ways to defend and on and on. So that's why I strongly believe in hiring smarter people to defend your castle, rather than swatting people smarter than you because you're not as smart as the other side.

Re: The largest DDoS attack to date, peaking above 398M rps

#467

Post by CrzyLngPwd »

pythonguython wrote: post #432
CrzyLngPwd wrote: post #399

Earlier quoted context omitted.

Why do you think Finland or Spain might attack USA companies?

I don’t think either of those countries would attack US companies. Obviously I would suspect adversaries instead of allies

The USA sees all countries, even allies, as adversaries, and always has ... hence the deep paranoia the USA has, lack of trust, lies, coercion, and spying (the list is longer but time is limited).

Re: The largest DDoS attack to date, peaking above 398M rps

#469

Post by rglullis »

89vision wrote: post #465
rglullis wrote: post #455

Earlier quoted context omitted.

For the use of the botnet...

sure, It's no doubt an arms race. The prevalance of websites going down due to scaling issues feels like order of magnitude less than it was 20 years ago though. Purely anecdotal with no real data to back that up.

Because the majority of sites run on/behind:

- AWS

- Cloudflare

- Azure

- GCP

- Great Firewall of China

Maybe there was some truth about "the world market for maybe five computers", after all...

Re: The largest DDoS attack to date, peaking above 398M rps

#470

Post by 6510 »

oefrha wrote: post #436
6510 wrote: post #133

Earlier quoted context omitted.

I just imagined this: isp's could make a isp.com?target=yourwebsite.org/fromisp [slow] redirecting url. If you receive unusual amounts of requests from the isp you redirect it though their website. They can then ignore it until their server melts (which takes care of the problem) or take honorable action if one of their customers is compromised. The S stands for service after all.

It appears you don’t understand DDoS at all. There aren’t humans sitting behind browsers or scripts using browser automation software. No one cares about less respects your “redirect” because no one’s reading your response. Most of the time the attacks aren’t even HTTP, they are just packet floods.

> It appears you don’t understand DDoS at all.

I can confirm this. I see web pages talking about redirecting traffic to scrubbing centers.

Post reply on HN