Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Global Internet slows after 'biggest attack in history'

bbc.co.uk

Post reply on HN
Print view View original

21–30 of 159 posts

Re: Global Internet slows after 'biggest attack in history'

#21

Post by mikeash »

arethuza wrote: post #10
xSwag wrote: post #2

Funny story from the Hosting company[1]: "Before the break of dawn on a morning in April, a full SWAT team was sent to execute a search warrant on CyberBunker's property." "It must not have occurred to the officers that the blast doors were designed to withstand a 20 megaton nuclear explosion from close range. When the SWAT team realized that the door was not being opened for them, they throw flashbangs and take othe…

Note that "close range" in this case is a 20Mt explosion 5km away: http://cyberbunker.com/web/bunker-specs.php Having said that, in the case of 20Mt nukes I suspect 5km does count as "close range".

According to a convenient nuclear effects calculator I found[1], 20MT at 5km and an optimal burst height will generate over 40psi of overpressure. The fireball itself will reach about 4km in radius. According to another site[2], 20psi is enough to severely damage or destroy heavily built concrete buildings, and the maximum wind speed at 40psi will be greater than the speed of sound. For comparison, 3psi is enough to destroy a normal house.

So, yeah, 5km counts as "close range".

[1] http://www.fourmilab.ch/cgi-bin/Bombcalc?yield=20&yunit=...

[2] http://www.atomicarchive.com/Effects/effects4.shtml

Re: Global Internet slows after 'biggest attack in history'

#22

Post by sp332 »

jessriedel wrote: post #8
jiggy2011 wrote: post #5

Earlier quoted context omitted.

I agree, the problem however is that threats are constantly evolving and getting more complicated. Even most IT people don't understand the threats properly (I know I struggle). It used to be that could just tell people to install a security suite on their computer and they'd be mostly OK. I don't think that's really true any longer. You could also partly lay the blame at Microsoft's door in getting users to start co…

If she has Microsoft Security Essentials installed, doesn't run unknown software, and doesn't give out her password, what more could my mother, as a layman, reasonably be expected to do? I understand there are all sorts of complicated steps she could take if she had good intuition about sniffing out bad guys, but she doesn't. Isn't the problem with the crappy software, not her?

Use a router that monitors spikes in traffic. Check the logs occasionally (weekly?).

Turn the computer off when you're not using it.

Re: Global Internet slows after 'biggest attack in history'

#23

Post by random_ind_dude »

criley wrote: post #7
belorn wrote: post #4

"These attacks are peaking at 300 gb/s (gigabits per second). Is that around like 3000 compromised computers? Maybe 2-5 botnets worth? I might be a bit off on the prices here, but that sound like maybe ~$1k/day on the market? would be nice to get a price tag on the "'biggest attack in history'".

3000 computers means each one is putting out a full 100Mb/s, which unless those 3000 computers are in data centers seems unlikely. Seems like 30,000 nodes at 10Mb/s would be more likely? But I don't have experience in botnets, just curious.

From what I understood, these attacks used DNS amplification. I am no expert on botnets either, but here is the basic idea: they basically send a small request to a DNS server with the source spoofed. The server sends a much larger response to the spoofed source, which in this case is Spamhaus. This happens on those DNS servers that don't check whether the request originated from inside their own network.

So the botnets involved don't have to send 300 Gbps of traffic to Spamhaus. The DNS servers being much more powerful will take care of that. I have no idea about the going rate for a botnet, though.

Re: Global Internet slows after 'biggest attack in history'

#24

Post by leephillips »

OGinparadise wrote: post #6

The main problem is that some people decide what's good and what's not online and paint with the broadest brush possible. Spamhaus, sadly I say, is used by a lot of providers as gospel and a lot of innocent sites are hurt.

You seem to be taking the line of the attackers' spokesman, who accused, rather hysterically, Spamhaus of deciding what goes on the internet. Of course, all Spamhaus does is supply a list of hosts who are sending email spam, and other things like lists of dynamic IPs. Sounds like this hosting outfit was making money hosting spammers and their business is threatened by legitimate countermeasures.

Re: Global Internet slows after 'biggest attack in history'

#26

Post by [deleted] »

jobigoud wrote: post #19

"In this case, Spamhaus's Domain Name System (DNS) servers were targeted" I'm not sure to understand why this should slow down the whole internet. It seems to be only for email filtering, not for the web, and only those ISP that use their service should be impacted, and only when their DNS cache is not triggered. Am I missing something ?

[deleted]

Re: Global Internet slows after 'biggest attack in history'

#27

Post by TranceMan »

belorn wrote: post #4

"These attacks are peaking at 300 gb/s (gigabits per second). Is that around like 3000 compromised computers? Maybe 2-5 botnets worth? I might be a bit off on the prices here, but that sound like maybe ~$1k/day on the market? would be nice to get a price tag on the "'biggest attack in history'".

Is that around like 3000 compromised computers?

Nope, this could easily be done with far less. This is an amplification attack.

Due to the design of DNS and UDP it allows you to send a simple/small request to a poorly configured DNS server [one that open resolves for anybody - there are a lot out there] and pretend you are doing it from your targets IP address.

UDP is a fire and forget protocol, you send it a source address and it will reply to that address. With DNS recursion you can easily send a request which will reply to your target. The amount of data returned from these DNS servers and sent to your victim can often be a 50x larger than your initial request. The more open resolvers you find, the more damage you can do, without needing much more upload bandwidth from your host [relative]

eg:

You request from your host:

  dig ANY isc.org @x.x.x.x +edns=0 == 64bytes
Response to your victim:

  ; > DiG 9.7.3 > ANY isc.org @x.x.x.x
 ;; global options: +cmd
 ;; Got answer:
 ;; ->>HEADER

 ;; MSG SIZE  rcvd: 3223 [bytes]
You start sending 100s of these request a second, the reply data builds up.

Re: Global Internet slows after 'biggest attack in history'

#28

Post by jiggy2011 »

sp332 wrote: post #22
jessriedel wrote: post #8

Earlier quoted context omitted.

If she has Microsoft Security Essentials installed, doesn't run unknown software, and doesn't give out her password, what more could my mother, as a layman, reasonably be expected to do? I understand there are all sorts of complicated steps she could take if she had good intuition about sniffing out bad guys, but she doesn't. Isn't the problem with the crappy software, not her?

Use a router that monitors spikes in traffic. Check the logs occasionally (weekly?). Turn the computer off when you're not using it.

My traffic has lots of spikes. Some days I download HD video, some days I don't.

If I look at the logs, it's all connections to CDNs with weird hostnames. How do I know which ones are legit and which ones might be part of a DDOS?

Also CC numbers are 16 bytes long, would just get lost in all the noise..

Re: Global Internet slows after 'biggest attack in history'

#29

Post by bluedino »

xSwag wrote: post #2

Funny story from the Hosting company[1]: "Before the break of dawn on a morning in April, a full SWAT team was sent to execute a search warrant on CyberBunker's property." "It must not have occurred to the officers that the blast doors were designed to withstand a 20 megaton nuclear explosion from close range. When the SWAT team realized that the door was not being opened for them, they throw flashbangs and take othe…

Wouldn't it be easier to just take a backhoe to the data lines running to the bunker?

Re: Global Internet slows after 'biggest attack in history'

#30

Post by sp332 »

jiggy2011 wrote: post #28
sp332 wrote: post #22

Earlier quoted context omitted.

Use a router that monitors spikes in traffic. Check the logs occasionally (weekly?). Turn the computer off when you're not using it.

My traffic has lots of spikes. Some days I download HD video, some days I don't. If I look at the logs, it's all connections to CDNs with weird hostnames. How do I know which ones are legit and which ones might be part of a DDOS? Also CC numbers are 16 bytes long, would just get lost in all the noise..

Maybe I should say, spikes in outgoing traffic.

The internet is not safe for banking, and I don't see any way it can be made safe.

Post reply on HN