DDoS attack protection for at-risk public interest websites • Hacker News Board

Re: DDoS attack protection for at-risk public interest websites

#11

Post by opendais » Thu, Jun 12, 2014, 6:08 PM UTC

equalitie wrote: post #9

opendais wrote: post #4

Earlier quoted context omitted.

I think the fundamental problem is cost. Much like raising an army, protecting against things like DDoS on the scale of 10Gbps+ costs real money. Services like Cloudflare, Blacklotus, etc. act like insurance companies [e.g. You have a pool of X services and only Y are getting attacked at a time]. This gives them an economy of scale others can't match on their own. I'd like to see a non-profit public internet security…

"I'd like to see a non-profit public internet security service tbh" - that would be us, opendais :) We do open source digisec solutions for civil society and independent media. Check out the DDoS mitigation service https://deflect.ca .

Cool.

https://github.com/equalitie looks like you are open sourcing some of it as well? Or all? :)

Re: DDoS attack protection for at-risk public interest websites

#12

Post by rdl » Thu, Jun 12, 2014, 6:13 PM UTC

piemonkey wrote: post #2

I'm personally shocked by how much power a DDoS has to potentially sway public opinion and influence the world at large. A few individuals have a hugely disproportionate voice in our public media by nature of the fact that they can control what other websites say through these attacks. Is there any progress on infrastructure improvements that could potentially improve this current state of affairs? Is our only soluti…

Fundamentally ddos is a problem and will continue to be one solved best by scale (and tech, but scale is critical) until all networks apply egress filters everywhere they interconnect. This is probably not happening in the foreseeable future unless networks consolidate (and if they do, then each is operating at scale as well).

It is a pretty pessimal situation. I think you might see critical services run over clean pipes networks, rather than the public internet, which also is a return to scale.

Re: DDoS attack protection for at-risk public interest websites

#13

Post by equalitie » Thu, Jun 12, 2014, 6:19 PM UTC

opendais wrote: post #11

equalitie wrote: post #9

Earlier quoted context omitted.

"I'd like to see a non-profit public internet security service tbh" - that would be us, opendais :) We do open source digisec solutions for civil society and independent media. Check out the DDoS mitigation service https://deflect.ca .

Cool. https://github.com/equalitie looks like you are open sourcing some of it as well? Or all? :)

all of it!

https://wiki.deflect.ca/wiki/Deflect_DIY

we have principles too :) https://equalit.ie/declaration-distributed-online-services/

Re: DDoS attack protection for at-risk public interest websites

#14

Post by e40 » Thu, Jun 12, 2014, 6:47 PM UTC

troels wrote: post #6

We have seen a number of high profile sites being subjected to extortion via ddos. I wonder how many big companies have been paying up and kept silent about it. I also wonder how hard it would be to hire some broad shouldered guys to go and pay the extorter (extortioner?) a not-so-friendly visit, considering how inefficient law enforcement appears to be in this regard.

I seriously doubt the payment is made in person. It's most certainly electronic, possibly even bitcoin based.

Re: DDoS attack protection for at-risk public interest websites

#15

Post by spenvo » Thu, Jun 12, 2014, 6:48 PM UTC

> There is no cost to participate in Project Galileo — it’s free. CloudFlare will not publicly announce involvement in Project Galileo without permission.

> Becoming part of Project Galileo is quick. On average, participants are up and running within a couple of hours; however, set up time ranges from 15 minutes to a couple of days.

> CloudFlare does not cap its DDoS mitigation service. CloudFlare has experience defending against some of the largest DDoS attacks on record. We will keep your website online.

The web is fragile in so many ways... But it's worse: the perpetrators of online attacks are (as good as) anonymous -- so this charitable initiative should be lauded for the load it's carrying.

Pun intended.

Re: DDoS attack protection for at-risk public interest websites

#16

Post by brettfarrow » Thu, Jun 12, 2014, 6:51 PM UTC

What about sites involving religion? I imagine there is a need or will be a need for minority groups (whether pro or anti-religion) in various developing nations, but it's not mentioned on the project page at all.

Re: DDoS attack protection for at-risk public interest websites

#17

Post by rdl » Thu, Jun 12, 2014, 6:52 PM UTC

troels wrote: post #6

We have seen a number of high profile sites being subjected to extortion via ddos. I wonder how many big companies have been paying up and kept silent about it. I also wonder how hard it would be to hire some broad shouldered guys to go and pay the extorter (extortioner?) a not-so-friendly visit, considering how inefficient law enforcement appears to be in this regard.

It's basically been a cost of doing business in certain industries since at least ~2000 -- I remember a bunch of gaming (gambling) companies complaining about huge 80Mbps floods and being extorted back then (often through e-gold, WebMoney, etc.)

Re: DDoS attack protection for at-risk public interest websites

#18

Post by rdl » Thu, Jun 12, 2014, 7:01 PM UTC

opendais wrote: post #4

piemonkey wrote: post #2

I'm personally shocked by how much power a DDoS has to potentially sway public opinion and influence the world at large. A few individuals have a hugely disproportionate voice in our public media by nature of the fact that they can control what other websites say through these attacks. Is there any progress on infrastructure improvements that could potentially improve this current state of affairs? Is our only soluti…

I think the fundamental problem is cost. Much like raising an army, protecting against things like DDoS on the scale of 10Gbps+ costs real money. Services like Cloudflare, Blacklotus, etc. act like insurance companies [e.g. You have a pool of X services and only Y are getting attacked at a time]. This gives them an economy of scale others can't match on their own. I'd like to see a non-profit public internet security…

I think one of the useful things to point out is how the $2-5/Mbps transit ($0.45/Mbps transit is probably not realistic in enough places) is billed -- generally, 95th percentile of the higher of inbound or outbound.

So, a site which has a lot of outbound traffic (most web servers) essentially has an equal amount of "free" inbound capacity available. You could sell this to someone doing web crawls, or online backups, or something, but DDoS (if you end up paying for it) is essentially all inbound, too.

The best position to absorb DDoS, if you're not a specialty firm, is to have a huge amount of outgoing web server traffic, huge systems built for that, and really great cooperation with your upstreams to push out filters as quickly as possible. The problem is this only really works against pure resource-consumption DDoS; if people realize a 50Gbps syn flood doesn't affect you too much, they'll move up the stack to layer 7, and then custom-tailored layer 7.

For a site which is huge and constantly being attacked, I could see this becoming a core competency (USG?) -- for anyone else, it's probably something you could outsource.

There are drawbacks to outsourcing your network, but if you're already hosted in the cloud, those drawbacks are mainly the incremental reliability of your outsourced edge provider -- pick a good one. If you're not in the cloud, you need to be very clear what your security model is -- I definitely wouldn't trust bitcoins to any outsourced service provider operating above the atoms level (i.e. a cage in a colo, with no security dependency on anyone running anything above that), but DDoS mitigation is critical for that kind of business -- the optimal situation is to have "untrusted" frontend nodes handling all your incoming traffic, with DDoS mitigation as a service, WAF, etc. probably outsourced, and then application-specific security on your own infrastructure. The DDoS layer can, if it fails, DoS you, but you can switch away from it. The DDoS layer can't actually subvert your application beyond that.

Re: DDoS attack protection for at-risk public interest websites

#19

Post by JoshTriplett » Thu, Jun 12, 2014, 7:05 PM UTC

opendais wrote: post #7

JoshTriplett wrote: post #5

Earlier quoted context omitted.

Typically, you pay a fixed extra cost for a gigabit or 10Gbps link, but beyond that you only pay for traffic. So, a DDoS will cost you a fair bit, but having the spare capacity to weather one shouldn't cost you all that much. (Depending on just how much you expect to get hit by.) I'm more curious why we don't start large-scale investigations in response to each DDoS attack: each one gives you a list of machines likel…

I suppose I wasn't very clear then. Ah well, life. > I'm more curious why we don't start large-scale investigations in response to each DDoS attack: each one gives you a list of machines likely participating in a botnet. https://securityledger.com/2013/04/cyberbunker-owner-arreste... They do. It just has to be large enough.

I'm not just talking about finding the originator of the attack; I'm talking about finding and cutting off all the vulnerable systems that facilitate the attacks.