Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My first DDoS attack for a $200 ransom

ghirardotti.fr

Post reply on HN
Print view View original

11–20 of 67 posts

Re: My first DDoS attack for a $200 ransom

#11

Post by tyingq »

tyingq wrote: post #8

Roughly, a somewhat lackluster response to a somewhat lackluster DDoS attempt. They tried blocking specific ip addresses, which didn't work, because the attack was somewhat distributed. They then just turned on some caching, which allowed the site to function, albeit with an unknown excess bandwidth charge pending. And, the DDoS itself can't of been terribly impressive, as all it took to mitigate was a bit of caching…

Thinking on this some more, this story makes even less sense.

He first mentions having to change Apache to recognize X-Forwarded-For, because there is Amazon Elastic Load Balancing between his site and the internet.

This means, of course, that the "attacking ips" aren't making direct connections to his EC2 instance. They are proxied connections, all from the internal ELB service.

So later, when he mentions trying to use iptables to block traffic...that just doesn't make sense. There are no connections from those ips to the EC2 instance. You could use .htaccess rules, since Apache is aware of X-Forwarded-For.

Lastly...why would you put an elastic load balancer in front of a single web server?

Re: My first DDoS attack for a $200 ransom

#12

Post by Remiii »

tyingq wrote: post #11
tyingq wrote: post #8

Roughly, a somewhat lackluster response to a somewhat lackluster DDoS attempt. They tried blocking specific ip addresses, which didn't work, because the attack was somewhat distributed. They then just turned on some caching, which allowed the site to function, albeit with an unknown excess bandwidth charge pending. And, the DDoS itself can't of been terribly impressive, as all it took to mitigate was a bit of caching…

Thinking on this some more, this story makes even less sense. He first mentions having to change Apache to recognize X-Forwarded-For, because there is Amazon Elastic Load Balancing between his site and the internet. This means, of course, that the "attacking ips" aren't making direct connections to his EC2 instance. They are proxied connections, all from the internal ELB service. So later, when he mentions trying to…

I can't answer for LaurentGh but if I well remember is a temporary situation (for few months).

Re: My first DDoS attack for a $200 ransom

#13

Post by SomeCallMeTim »

tyingq wrote: post #8

Roughly, a somewhat lackluster response to a somewhat lackluster DDoS attempt. They tried blocking specific ip addresses, which didn't work, because the attack was somewhat distributed. They then just turned on some caching, which allowed the site to function, albeit with an unknown excess bandwidth charge pending. And, the DDoS itself can't of been terribly impressive, as all it took to mitigate was a bit of caching…

I was shocked that 12 requests/second could take down any site.

I use async logic (previously OpenResty, more recently NodeJS and Go) and largely pregenerated sites, so 2500 requests/second is a minimum baseline -- on a much lower end instance than an m4.xlarge.

There's a reason I don't use PHP (or any primarily synchronous language like Ruby) any more.

Re: My first DDoS attack for a $200 ransom

#14

Post by spatten »

tyingq wrote: post #11
tyingq wrote: post #8

Roughly, a somewhat lackluster response to a somewhat lackluster DDoS attempt. They tried blocking specific ip addresses, which didn't work, because the attack was somewhat distributed. They then just turned on some caching, which allowed the site to function, albeit with an unknown excess bandwidth charge pending. And, the DDoS itself can't of been terribly impressive, as all it took to mitigate was a bit of caching…

Thinking on this some more, this story makes even less sense. He first mentions having to change Apache to recognize X-Forwarded-For, because there is Amazon Elastic Load Balancing between his site and the internet. This means, of course, that the "attacking ips" aren't making direct connections to his EC2 instance. They are proxied connections, all from the internal ELB service. So later, when he mentions trying to…

You do this by telling iptables to look at the X-Forwarded-For header when deciding what IP that request is coming from.

This blog posts explains the whole thing: https://centos.tips/fail2ban-behind-a-proxyload-balancer/

I have no idea if using .htaccess rules would be better than this solution, I just know that this one works.

Re: My first DDoS attack for a $200 ransom

#15

Post by brbsix »

The webpage[0] seems to be having issues. The best I could do was the Google cache[1] or the Markdown source[2].

[0]: http://lologhi.github.io/symfony2/2016/04/04/DDoS-attack-for...

[1]: https://webcache.googleusercontent.com/search?q=cache:J7lca_...

[2]: https://github.com/lologhi/lologhi.github.com/blob/master/_p...

Re: My first DDoS attack for a $200 ransom

#16

Post by cortesoft »

otto_ortega wrote: post #9

Ummmm.... A cache layer for any web application is a must have, perhaps he could have avoided the attack all along if it were present on the system since day one?... At least for this kind of attack, a more serious DDoS won't be tamed by "just adding cache"

Well, when your DDOS is '10 requests a second', your site is probably not the most sophisticated.

Re: My first DDoS attack for a $200 ransom

#17

Post by nonamegdsa »

SomeCallMeTim wrote: post #13
tyingq wrote: post #8

Roughly, a somewhat lackluster response to a somewhat lackluster DDoS attempt. They tried blocking specific ip addresses, which didn't work, because the attack was somewhat distributed. They then just turned on some caching, which allowed the site to function, albeit with an unknown excess bandwidth charge pending. And, the DDoS itself can't of been terribly impressive, as all it took to mitigate was a bit of caching…

I was shocked that 12 requests/second could take down any site. I use async logic (previously OpenResty, more recently NodeJS and Go) and largely pregenerated sites, so 2500 requests/second is a minimum baseline -- on a much lower end instance than an m4.xlarge. There's a reason I don't use PHP (or any primarily synchronous language like Ruby) any more.

If the request is performing heavy calculations you will see fever req/sec obviously.

Say an API call spins up a Linux VM and makes it available some user. Or a bulk upload of data which needs to be indexed. Or whatever.

The idea that a site should be able to handle X requests/sec because the stack can handle X NOOPs per second is odd.

Re: My first DDoS attack for a $200 ransom

#18

Post by tyingq »

spatten wrote: post #14
tyingq wrote: post #11

Earlier quoted context omitted.

Thinking on this some more, this story makes even less sense. He first mentions having to change Apache to recognize X-Forwarded-For, because there is Amazon Elastic Load Balancing between his site and the internet. This means, of course, that the "attacking ips" aren't making direct connections to his EC2 instance. They are proxied connections, all from the internal ELB service. So later, when he mentions trying to…

You do this by telling iptables to look at the X-Forwarded-For header when deciding what IP that request is coming from. This blog posts explains the whole thing: https://centos.tips/fail2ban-behind-a-proxyload-balancer/ I have no idea if using .htaccess rules would be better than this solution, I just know that this one works.

The article shows the run of the mill iptables syntax being used, no packet inspection...

And, it's possible this is https, which would render the packet inspection useless.

Re: My first DDoS attack for a $200 ransom

#19

Post by tyingq »

SomeCallMeTim wrote: post #13
tyingq wrote: post #8

Roughly, a somewhat lackluster response to a somewhat lackluster DDoS attempt. They tried blocking specific ip addresses, which didn't work, because the attack was somewhat distributed. They then just turned on some caching, which allowed the site to function, albeit with an unknown excess bandwidth charge pending. And, the DDoS itself can't of been terribly impressive, as all it took to mitigate was a bit of caching…

I was shocked that 12 requests/second could take down any site. I use async logic (previously OpenResty, more recently NodeJS and Go) and largely pregenerated sites, so 2500 requests/second is a minimum baseline -- on a much lower end instance than an m4.xlarge. There's a reason I don't use PHP (or any primarily synchronous language like Ruby) any more.

I wouldn't blame that on PHP. You can make PHP sites with reasonable performance.
Post reply on HN