Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Estimating the Revenue of a Russian DDoS Booter

arbornetworks.com

Post reply on HN
Print view View original

1–10 of 56 posts

Re: Estimating the Revenue of a Russian DDoS Booter

#3

Post by fweespee_ch »

astrodust wrote: post #2

Under $100 for a large-scale DDOS attack is ridiculously cheap. It's no wonder these are getting freakishly common. Does anyone have a best-practices for dealing with the more modern variants?

There really isn't any beyond having a large pipe connected to a network device capable of filtering a high volume of pps.

That has always been the problem with competently executed DDoS attacks. You need a very large pipe as Step #1 which is simply not cost effective for most businesses. :/

Re: Estimating the Revenue of a Russian DDoS Booter

#6

Post by patcheudor »

fweespee_ch wrote: post #3
astrodust wrote: post #2

Under $100 for a large-scale DDOS attack is ridiculously cheap. It's no wonder these are getting freakishly common. Does anyone have a best-practices for dealing with the more modern variants?

There really isn't any beyond having a large pipe connected to a network device capable of filtering a high volume of pps. That has always been the problem with competently executed DDoS attacks. You need a very large pipe as Step #1 which is simply not cost effective for most businesses. :/

DDoS is the antithesis to an open and free internet from a free market perspective because it drives people to a few select providers for hosting and CDN services. In the end, the big players in those spaces who have the bandwidth win. It's not so much about who has the best innovation either as DDoS tends to be all about brute-force.

Re: Estimating the Revenue of a Russian DDoS Booter

#7

Post by DenisM »

fweespee_ch wrote: post #3
astrodust wrote: post #2

Under $100 for a large-scale DDOS attack is ridiculously cheap. It's no wonder these are getting freakishly common. Does anyone have a best-practices for dealing with the more modern variants?

There really isn't any beyond having a large pipe connected to a network device capable of filtering a high volume of pps. That has always been the problem with competently executed DDoS attacks. You need a very large pipe as Step #1 which is simply not cost effective for most businesses. :/

There's a tiny bit of hope in there. The article claims that bots are polling CNC about once an hour (I suppose because they don't want to DOS themselves). So one option is to shift your service to a different domain name every hour, and notify your customers by email that they have to connect to a different host. This might be a lot of trouble, but may still allow you to support existing business relationships which is better than nothing.

It get even better if you're publishing through a mobile app - that one can simply switch from one host to another on the fly without customer even being aware of the problem beyond a slight delay in connection. The list of hosts of would need to be distributed out of band as a tiny payload, either through a high-cost high-bandwidth channel (but in a very low volume, obviously, just the name of the new host), or via DNS TEXT records so that they are hard to decipher reliably and require custom programming and raise the cost of the attack. There might even be hosts that will hold your alternate host list for free, such as the iTunes App Store (app description or even an in-app purchase "description" field).

Speaking of high-cost high-bandwidth providers, I think another option would be to host a CAPTCHa there, and those who solve it, or have cookies to prove that they did, or have logged in with a valid account, get redirected to one from the rotating lists of your normal hosts, with names and IP addresses changing every few minutes. An AJAXy application can then try different hosts in turn or in parallel before following a link.

Re: Estimating the Revenue of a Russian DDoS Booter

#8

Post by kyledrake »

Hi. I run a thing that uses a lot of bandwidth.

Repeat after me:

I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem.

I've brought this up before: https://news.ycombinator.com/item?id=11261882 https://news.ycombinator.com/item?id=11000086

Many people that are in denial about this. This article is not an outlier, this is exactly how DDoS is now. DDoSes are cheap to execute and devastating to the host. Your competitor will chip in a little Bitcoin and get these people to attack your site. Or they'll just do it because they're bored and it's basically free for them. I knew a guy that worked on a site, he told me they always got DDoSed every time his site put on a sale. Guaranteed DDoS.

Who gets the $30,000+ bandwidth bill for the attack? Well, if you're using AWS or GCS, you do of course (it happened to Greatfire, why won't it happen to you?)

30x market bandwidth markups, zero DDoS mitigation. Good luck.

Edit: Oh, and VPS providers (DigitalOcean, Linode) that just null route servers for hours or days during a DDoS: you're not off the hook either.

Re: Estimating the Revenue of a Russian DDoS Booter

#10

Post by azernik »

dublinben wrote: post #5
azernik wrote: post #4

Interesting note - the stereotype is of Russian attackers attacking developed-world targets, but around 50% of the targets are in Russia.

Attacking competitors presumably?

Or just attacking plain legal Russian targets - what we're getting in the US is likely just a spillover of the general computer crime problem over there.

Although there was one interesting case cited here that's sort of "the competition" - some criminals' forum admin removed the botnet's ad, so they attacked the forum. And then the forum turned around and reported them to the police.

Post reply on HN