Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Basecamp was under network attack

gist.github.com

Post reply on HN
Print view View original

141–150 of 194 posts

Re: Basecamp was under network attack

#141

Post by derefr »

pessimizer wrote: post #53
mhurron wrote: post #50

Earlier quoted context omitted.

Which are just specific types of criminals. I don't see the problem.

Criminals are just specific types of people, and people are just specific types of mammals. Being more specific sometimes aids understanding.

I think I get what you're saying here; it's an example of the non-central fallacy[1]. Calling someone "a criminal" calls to mind a set of stereotypes, to which blackmail/extortion don't quite fit (most crimes for which one gets called "a criminal" as a generic term are violent, for just one thing.) Calling them "a blackmailer" or "an extortionist" calls to mind a more accurate set of stereotypes, clustered more closely with how you'd react to kidnappers, con-artists, etc. than how you'd react to, say, a mugger.

[1] http://lesswrong.com/lw/e95/the_noncentral_fallacy_the_worst...

Re: Basecamp was under network attack

#142

Post by cft »

troels wrote: post #119
pdeuchler wrote: post #100

Earlier quoted context omitted.

I more or less agree with you, but that's kind of a false dichotomy, isn't it? Signing up for cloudflare or using a CDN isn't giving in, it's taking measures to protect yourself (and that's ignoring the other benefits you get). The unfortunate fact is DDOS attacks are becoming a daily occurrence, and if you have something to lose you should probably take measures to counteract any possible threats. If 37Signals was a…

That's a bit naive though. People can always find ways to hurt you - it's a very asymmetric fight. With a complex application such as Basecamp, you can't really put everything behind a cdn.

That's why I actually think that their thrust on pursuing the legal/FBI route is a good one, especially if they achieve any success there. This extortion/racket is indeed criminal and not tolerable. It would be good to catch the racketeers and make an example of them.

Re: Basecamp was under network attack

#143

Post by JeremyBanks »

Danieru wrote: post #41
alandarev wrote: post #9

Earlier quoted context omitted.

How is torrents protocol used to DDoS you? I never came across torrents being used as a DDoS. I would appreciate more details on what sort of torrent attack it was, and whether you found any ways of partially neglecting damage.

A malicious tracker, or a peer if using DHT, can claim an IP, the victim, is active in the swarm and has valuable bits of the torrent. Then torrent clients will try to connect to the victim. The attack is pretty clever, being indirect it is hard to trace and because bittorrent allows arbitrary ports you can hit a specific ip & port pair. The one downside is the victims can be sure it is a bittorrent DDOS by checking…

or a peer if using DHT

Please confirm my understanding: this would be by inserting yourself into the DHT with an address near/equal to a target high-volume torrent, so that you're frequently queried by clients looking for peers?

If so, I guess it could be possible in some cases to identify the peers who initiated the attack. The non-malicious peers attempting to make BitTorrent connections to your server will provide the infohash of the torrent they think you're downloading, which you might be able use to find the malicious DHT peer who's directing them.

At first I thought you were suggesting that it's possible to for malicious peers to insert invalid IP/port pairs into non-malicious DHT nodes, which I don't believe is possible. (The mainline DHT protocol [1] requires that peers provide a "token" value, previously sent to their IP address, to verify themselves when being listed for a torrent.)

[1]: http://www.bittorrent.org/beps/bep_0005.html

Re: Basecamp was under network attack

#144

Post by derefr »

JasonFruit wrote: post #93
pizza wrote: post #70

Earlier quoted context omitted.

it's just framing the scenario in good guys vs bad guys terms, it's childish regardless of how accurately the term describes the actors involved..

Why is it childish to point out when someone is acting criminally — in a literal sense being a bad guy? Is it somehow more adult to act as though you are morally equivalent to an extortionist?

I think people might be being offended-by-proxy by a sort of status-shift 37s is trying to work into its language. Calling someone "an extortionist" still implies a sort of high-status white-collar cunning-and-intelligence, of the kind you'd expect of a person in the tech industry. An evil person, surely, but the respectable, movie-villain-you-love-to-hate kind of evil.

Calling someone "a criminal", meanwhile, degrades their status to that of a common mugger; someone in the lower class who needs to commit crime to survive, and who doesn't have the intelligence required to come up with a clever crime.

Hackers are generally aesthetes--we tend to value our intelligence, curiosity, etc. more than we value our moral fibre. We can appreciate stories like "A hacked into B to see if it was possible, and reported the vulnerability all responsible-like, but then they threw him in jail! How horrible!" because we think the positive-status from the display of intelligence makes it less likely, rather than more, that they were genuinely seeking to harm the people they hacked.

Because of this, I think we here are scared of being potentially associated with dumb, low-status, lower-class criminals more than we are of just being considered evil. People hire "evil, black-hat" hackers. Nobody hires a dumb hacker.

Re: Basecamp was under network attack

#145

Post by pktgen »

grok2 wrote: post #90
TacticalCoder wrote: post #51

I take it at one point people will start to believe that I work for OVH (I really don't) but... OVH has a mandatory DDoS protection on all its dedicated servers: fees have been slightly raised to take that mandatory protection into account. There are a few gotchas, including if I understand it correctly the need to "retry twice" when you try to SSH in your server when a DDoS is going on but... OVH doesn't even feel a…

Products by people like Arbor Networks ( http://www.arbornetworks.com/ ) helps with this -- I think they essentially observe traffic patterns and siphon what they detect to be DDoS traffic to alternate routers at the edge of the network to study and blackhole.

OVH uses Peakflow as one component of its mitigation system.

Re: Basecamp was under network attack

#146

Post by jackgavigan »

devicenull wrote: post #114
grey-area wrote: post #111

Earlier quoted context omitted.

If you're going to make accusations like that, you should really back it up with extensive proof.

http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb... > As I noted in a talk I gave last summer with Lance James at the Black Hat security conference in Las Vegas, a funny thing happens when you decide to operate a DDoS-for-hire Web service: Your service becomes the target of attacks from competing DDoS-for-hire services. Hence, a majority of these services have chosen to avail themselves of Cloudflare’s fr…

CloudFlare's CEO, Matthew Prince, has made his stance on this matter very clear:

CloudFlare is firm in our belief that our role is not that of Internet censor. There are tens of thousands of websites currently using CloudFlare's network. Some of them contain information I find troubling. Such is the nature of a free and open network and, as an organization that aims to make the whole Internet faster and safer, such inherently will be our ongoing struggle. While we will respect the laws of the jurisdictions in which we operate, we do not believe it is our decision to determine what content may and may not be published. That is a slippery slope down which we will not tread.

Source: http://blog.cloudflare.com/thoughts-on-abuse

As a result, both the Israeli Defence Forces and Hamas are CloudFlare customers. Unless one of their customers is doing something that is unambiguously illegal (e.g. hosting child pornography), CloudFlare won't cut them off just because they're doing something that some people regard as "bad".

It's a very principled stance and one that I respect.

Re: Basecamp was under network attack

#147

Post by pktgen »

derekp7 wrote: post #71
TacticalCoder wrote: post #51

I take it at one point people will start to believe that I work for OVH (I really don't) but... OVH has a mandatory DDoS protection on all its dedicated servers: fees have been slightly raised to take that mandatory protection into account. There are a few gotchas, including if I understand it correctly the need to "retry twice" when you try to SSH in your server when a DDoS is going on but... OVH doesn't even feel a…

What happens when a ddos is indistinguishable from regular traffic? Or is it the case that it almost always follows a particular pattern?

It's always a matter of capacity. If there is absolutely no attribute you can distinguish it by, you have no choice but to handle it like normal.

In practice, there is. If we're talking about an HTTP flood, the other endpoint address is always validated (due to the 3-way handshake) so it's plausible to rate limit and block individual addresses. (But without validated client addresses, the rule is to NEVER create state off those, because spoofing is too easy.)

Re: Basecamp was under network attack

#148

Post by coreymgilmore »

devicenull wrote: post #114
grey-area wrote: post #111

Earlier quoted context omitted.

If you're going to make accusations like that, you should really back it up with extensive proof.

http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb... > As I noted in a talk I gave last summer with Lance James at the Black Hat security conference in Las Vegas, a funny thing happens when you decide to operate a DDoS-for-hire Web service: Your service becomes the target of attacks from competing DDoS-for-hire services. Hence, a majority of these services have chosen to avail themselves of Cloudflare’s fr…

very interesting point. I agree that maybe an updated CF TOS could help quell this issue, but then again I don't think CF is going to dedicate too much time to vet out any potentially bad sites.

Re: Basecamp was under network attack

#149

Post by phil21 »

jessaustin wrote: post #101
Danieru wrote: post #41

Earlier quoted context omitted.

A malicious tracker, or a peer if using DHT, can claim an IP, the victim, is active in the swarm and has valuable bits of the torrent. Then torrent clients will try to connect to the victim. The attack is pretty clever, being indirect it is hard to trace and because bittorrent allows arbitrary ports you can hit a specific ip & port pair. The one downside is the victims can be sure it is a bittorrent DDOS by checking…

The attacker's packets will contain bittorrent's magic connection bits. ISTM that once you've determined bittorrent is the attack vector, the hard part is done? Is dropping by "magic bits" harder than dropping by ip/port?

Yes. Very much harder. One can be done at line rate on any halfway decent router, and the other requires deep packet inspection which is considerably more expensive.

Re: Basecamp was under network attack

#150

Post by Danieru »

jessaustin wrote: post #101
Danieru wrote: post #41

Earlier quoted context omitted.

A malicious tracker, or a peer if using DHT, can claim an IP, the victim, is active in the swarm and has valuable bits of the torrent. Then torrent clients will try to connect to the victim. The attack is pretty clever, being indirect it is hard to trace and because bittorrent allows arbitrary ports you can hit a specific ip & port pair. The one downside is the victims can be sure it is a bittorrent DDOS by checking…

The attacker's packets will contain bittorrent's magic connection bits. ISTM that once you've determined bittorrent is the attack vector, the hard part is done? Is dropping by "magic bits" harder than dropping by ip/port?

In theory yes, but it requires deep packet inspection to catch before it hits the server. Such equipment is expensive per GB/s and not something you'd have access to by accident.
Post reply on HN