Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Botnet Accidentally Destroyed I2P

sambent.com

Post reply on HN
Print view View original

11–20 of 101 posts

Re: A Botnet Accidentally Destroyed I2P

#11

Post by infogulch »

jjmarr wrote: post #4

From the main article, I2P has 55,000 computers, the botnet tried to add 700,000 infected routers to I2P to use it as a backup command-and-control system. https://news.ycombinator.com/item?id=46976825 This, predictably, broke I2P.

That's an interesting stress test for I2P. They should try to fix that, the protocol should be resilient to such an event. Even if there are 10x more bad nodes than good nodes (assuming they were noncompliant I2P actors based on that thread) the good nodes should still be able to find each other and continue working. To be fair spam will always be a thorny problem in completely decentralized protocols.

Re: A Botnet Accidentally Destroyed I2P

#12

Post by bryanrasmussen »

torben-friis wrote: post #7
OgsyedIE wrote: post #5

Earlier quoted context omitted.

Many state bodies involved in adversarial action have dedicated budgets for offensive cyber-warfare, credential thefts, supply chain compromises and disinformation. If they haven't used all of their budget by the end of the budget period, they'll be allocated a smaller budget for the next budget period.

Oh ffs. Whenever I think my opinion on the state of the world can’t get any lower, things somehow manage to get dumber.

I mean this is a common pattern in many large organizations, governmental and non, if you didn't use your budget it means we can save money, yayyyy! I hadn't really considered it would apply to state-backed hacking but makes sense.

Re: A Botnet Accidentally Destroyed I2P

#13

Post by chmod775 »

illusive4080 wrote: post #6

Why does Discord allow a server for a botnet owner?

There's servers where they just hang out, but which themselves are legitimate. Cybersecurity related ones etc. You can ban them and they'll just switch to another account within a minute. Occasionally discord or a server owner does, but everyone knows its pointless. There's probably other servers that are mostly used by cybercriminals, maybe command-and-control backups, and security researchers may stumble upon these when taking some malware apart, join them, and end up getting in contact with the owner.

In general I don't think law enforcement wants discord to take these down or ban them. These guys would have no problem to just make some IRC servers or whatever to hang out on instead, which would be much harder to surveil for law enforcement - compared to discord just forwarding them everything said by those accounts and on those servers.

Re: A Botnet Accidentally Destroyed I2P

#14

Post by sandworm101 »

infogulch wrote: post #11
jjmarr wrote: post #4

From the main article, I2P has 55,000 computers, the botnet tried to add 700,000 infected routers to I2P to use it as a backup command-and-control system. https://news.ycombinator.com/item?id=46976825 This, predictably, broke I2P.

That's an interesting stress test for I2P. They should try to fix that, the protocol should be resilient to such an event. Even if there are 10x more bad nodes than good nodes (assuming they were noncompliant I2P actors based on that thread) the good nodes should still be able to find each other and continue working. To be fair spam will always be a thorny problem in completely decentralized protocols.

No. They should not try to survive such attacks. The best defense to a temporary attack is often to pull the plug. Better than than potentially expose users. When there are 10x as many bad nodes as good, the base protection of any anonymity network is likely compromised. Shut down, survive, and return once the attacker has moved on.

Re: A Botnet Accidentally Destroyed I2P

#15

Post by WaitWaitWha »

torben-friis wrote: post #3

Man, I feel so out of depth with cybersecurity news. Why does i2p (per the article) expect state sponsored attacks every February? Where are those forming from, what does the regularity achieve? How come the operators of giant (I’m assuming illegal) botnets are available to voice their train of thought in discord?

> Why does i2p (per the article) expect state sponsored attacks every February?

Because The Invisible Internet Project (I2P) allows government dissidents to communicate without the government oversight. Censorship-resistant, peer-to-peer communication

> Where are those forming from, what does the regularity achieve?

At least PR China, Iran, Oman, Qatar, and Kuwait. censor communication between dissidents.

> How come the operators of giant (I’m assuming illegal) botnets are available to voice their train of thought in discord?

How would you identify someone as 'operators of giant botnets' before they identified themselves as 'operators of giant botnets'?

please read https://en.wikipedia.org/wiki/I2P

Re: A Botnet Accidentally Destroyed I2P

#17

Post by martin-t »

sandworm101 wrote: post #14
infogulch wrote: post #11

Earlier quoted context omitted.

That's an interesting stress test for I2P. They should try to fix that, the protocol should be resilient to such an event. Even if there are 10x more bad nodes than good nodes (assuming they were noncompliant I2P actors based on that thread) the good nodes should still be able to find each other and continue working. To be fair spam will always be a thorny problem in completely decentralized protocols.

No. They should not try to survive such attacks. The best defense to a temporary attack is often to pull the plug. Better than than potentially expose users. When there are 10x as many bad nodes as good, the base protection of any anonymity network is likely compromised. Shut down, survive, and return once the attacker has moved on.

Why would an attacker move on if it can maintain a successful DoS attack forever?

Re: A Botnet Accidentally Destroyed I2P

#18

Post by xmcp123 »

martin-t wrote: post #17
sandworm101 wrote: post #14

Earlier quoted context omitted.

No. They should not try to survive such attacks. The best defense to a temporary attack is often to pull the plug. Better than than potentially expose users. When there are 10x as many bad nodes as good, the base protection of any anonymity network is likely compromised. Shut down, survive, and return once the attacker has moved on.

Why would an attacker move on if it can maintain a successful DoS attack forever?

Because botnets are mostly there to make money nowadays. Or owned by state actors.

Either way, it’s opportunity cost.

Re: A Botnet Accidentally Destroyed I2P

#19

Post by Zambyte »

WaitWaitWha wrote: post #15
torben-friis wrote: post #3

Man, I feel so out of depth with cybersecurity news. Why does i2p (per the article) expect state sponsored attacks every February? Where are those forming from, what does the regularity achieve? How come the operators of giant (I’m assuming illegal) botnets are available to voice their train of thought in discord?

> Why does i2p (per the article) expect state sponsored attacks every February? Because The Invisible Internet Project (I2P) allows government dissidents to communicate without the government oversight. Censorship-resistant, peer-to-peer communication > Where are those forming from, what does the regularity achieve? At least PR China, Iran, Oman, Qatar, and Kuwait. censor communication between dissidents. > How come…

This answer is missing the key "regularity" part of their questions, which I would love to know more about.
Post reply on HN