Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Global Internet slows after 'biggest attack in history'

bbc.co.uk

Post reply on HN
Print view View original

31–40 of 159 posts

Re: Global Internet slows after 'biggest attack in history'

#31

Post by supar »

OGinparadise wrote: post #6

The main problem is that some people decide what's good and what's not online and paint with the broadest brush possible. Spamhaus, sadly I say, is used by a lot of providers as gospel and a lot of innocent sites are hurt.

If you ever tried to handle any mail server at all, you would recognize that you have choice in using spamhaus (or any other DNSBL).

These people have put in place a high quality method to discriminate spammers. I've been around since their beginnings, and their list has been incredibly successful (very high quality) for me, compared to njabl and other "dynamic" lists based on honeypots, or backlash entirely (say hi to spamcop).

You would also recognize that you can just as well tag the message with "likely spammminess" for use along the chain, and people would still complain that your "legitimate" message was tagged as spam by SOMEBODY, while you wouldn't complain if it was tagged as spam by a learning algorithm.

In short, people would complain anyway, except that spamhaus is doing real damage to the spammers (as in "the mail really didn't go through") and reducing their revenue, and thus forcing them to come out which such measures. Not that they will accomplish anything anyway. Spamhaus helped stop a lot of known/professional spammers, and I applaud them for that.

Re: Global Internet slows after 'biggest attack in history'

#33

Post by jgrahamc »

This story doesn't mention that Spamhaus is protected by CloudFlare and we took a beating from this attack. At some point I'm hoping the full technical story about how the attack morphed from our infrastructure to Internet infrastructure can be told.

Also, http://openresolverproject.org

PS Technical details: http://blog.cloudflare.com/the-ddos-that-almost-broke-the-in...

Re: Global Internet slows after 'biggest attack in history'

#34

Post by TranceMan »

jobigoud wrote: post #19

"In this case, Spamhaus's Domain Name System (DNS) servers were targeted" I'm not sure to understand why this should slow down the whole internet. It seems to be only for email filtering, not for the web, and only those ISP that use their service should be impacted, and only when their DNS cache is not triggered. Am I missing something ?

"In this case, Spamhaus's Domain Name System (DNS) servers were targeted"

This is blatantly wrong, the DNS system and poorly configured networks were used to target and attack Spamhaus.

Re: Global Internet slows after 'biggest attack in history'

#35

Post by otterley »

sp332 wrote: post #22
jessriedel wrote: post #8

Earlier quoted context omitted.

If she has Microsoft Security Essentials installed, doesn't run unknown software, and doesn't give out her password, what more could my mother, as a layman, reasonably be expected to do? I understand there are all sorts of complicated steps she could take if she had good intuition about sniffing out bad guys, but she doesn't. Isn't the problem with the crappy software, not her?

Use a router that monitors spikes in traffic. Check the logs occasionally (weekly?). Turn the computer off when you're not using it.

A well-orchestrated DDoS attack sends packets at the rate of the noise floor of each "owned" host involved. Such a spike should be undetectable.

Re: Global Internet slows after 'biggest attack in history'

#36

Post by sounds »

jgrahamc wrote: post #33

This story doesn't mention that Spamhaus is protected by CloudFlare and we took a beating from this attack. At some point I'm hoping the full technical story about how the attack morphed from our infrastructure to Internet infrastructure can be told. Also, http://openresolverproject.org PS Technical details: http://blog.cloudflare.com/the-ddos-that-almost-broke-the-in...

Yes, please.

Not just for the awesome read but this seems like a data point for the global internet. Very much of interest.

Re: Global Internet slows after 'biggest attack in history'

#37

Post by ohwp »

peterwwillis wrote: post #16
xSwag wrote: post #2

Funny story from the Hosting company[1]: "Before the break of dawn on a morning in April, a full SWAT team was sent to execute a search warrant on CyberBunker's property." "It must not have occurred to the officers that the blast doors were designed to withstand a 20 megaton nuclear explosion from close range. When the SWAT team realized that the door was not being opened for them, they throw flashbangs and take othe…

I looked up a video with an actual Dutch SWAT team and their uniform looks different. The one in the picture is pretty derpy, and they're carrying what looks like tiny medieval shields. I'm not convinced.

The picture is clearly Photoshopped. Light in the background is coming from the right, while light on the team is coming from the left.

Edit: talking about this picture: http://cyberbunker.com/web/images/swat-bunker.jpg

Edit2: I think it's more difficult to determine if it's real than I thought.

Re: Global Internet slows after 'biggest attack in history'

#38

Post by entropy_ »

random_ind_dude wrote: post #23
criley wrote: post #7

Earlier quoted context omitted.

3000 computers means each one is putting out a full 100Mb/s, which unless those 3000 computers are in data centers seems unlikely. Seems like 30,000 nodes at 10Mb/s would be more likely? But I don't have experience in botnets, just curious.

From what I understood, these attacks used DNS amplification. I am no expert on botnets either, but here is the basic idea: they basically send a small request to a DNS server with the source spoofed. The server sends a much larger response to the spoofed source, which in this case is Spamhaus. This happens on those DNS servers that don't check whether the request originated from inside their own network. So the botn…

I think the onus for this one is on ISPs who don't properly filter outgoing traffic. It's pretty simple, really, you have a block of IP addresses you allocate to your customers, any outgoing traffic with a source outside of this block should be dropped. A simple iptables rule on the router handling that block would suffice.

There is no legitimate use case for sending traffic with a spoofed source IP. I'm simply amazed that ISPs who should have the technical knowhow still haven't eradicated all kinds of network attacks that rely on spoofed source addresses(of which DNS amplification is only one).

Re: Global Internet slows after 'biggest attack in history'

#39

Post by sounds »

xSwag wrote: post #2

Funny story from the Hosting company[1]: "Before the break of dawn on a morning in April, a full SWAT team was sent to execute a search warrant on CyberBunker's property." "It must not have occurred to the officers that the blast doors were designed to withstand a 20 megaton nuclear explosion from close range. When the SWAT team realized that the door was not being opened for them, they throw flashbangs and take othe…

I also enjoyed their "thumb my nose at the SWAT team" attitude.

However, realistically speaking it would be very, very simple to get their attention. With one shovel: http://online.wsj.com/article/SB1000142405274870463000457624...

Post reply on HN