Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP Spoofing

idea.popcount.org

Post reply on HN
Print view View original

111–120 of 136 posts

Re: IP Spoofing

#111

Post by collinmanderson »

silverwind wrote: post #55
majke wrote: post #34

Earlier quoted context omitted.

This is precisely the point of this article. The only real long term solution to stop large DDoS is to stop spoofing. The only way to stop IP spoofing is to shame misconfigured networks. For that you need attribution.

Recent HTTP DDoS attacks have shown that there is no dependency on spoofing. The problem will be there as long as there's insecure hardware out there.

The footnote says:

this presentation was prepared before the Krebs On Security DDoS attacks which had a different profile and did not use Spoofed IP addresses. Krebs's DDoS attacks launched by internet-of-things devices were unusually large. Most of the non-spoofed attacks were way smaller. This does not invalidate this talk. Non-spoofed attacks are easier to block - since the source addresses are known. It is also possible to fight and eventually destroy the botnets. This is much harder when the IP's are spoofed.

Re: IP Spoofing

#112

Post by collinmanderson »

erichocean wrote: post #40
hueving wrote: post #31

Earlier quoted context omitted.

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…

> the crusade to end useful UDP protocols is successful What? What crusade? I love UDP, use it every chance I get. Who is "crusading" to end UDP on the Internet?

It's fine to have a public UDP server on the internet. Just make sure it can't be used to amplify/mirror attacks.

QUIC uses tokens for example. https://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblH...

Re: IP Spoofing

#113

Post by 0xcde4c3db »

complaint wrote: post #42

That was an excellent presentation, very informative. Except, why put that ridiculous meme in the middle of it? It's cringeworthy seeing an excellent technical presentation littered with such childish imagery. (Not that I agree with this bastardization of "meme" to mean "silly image with text overlaid in capital letters", but unfortunately that is what everyone is calling these things.)

> (Not that I agree with this bastardization of "meme" to mean "silly image with text overlaid in capital letters", but unfortunately that is what everyone is calling these things.)

The term for that is "image macro" [1]. An image macro represents a meme when the image is associated with a particular joke format, catch phrase, archetype, etc..

[1] https://en.wikipedia.org/wiki/Image_macro

Re: IP Spoofing

#115

Post by x0rx0r »

paulddraper wrote: post #84
silverwind wrote: post #55

Earlier quoted context omitted.

Recent HTTP DDoS attacks have shown that there is no dependency on spoofing. The problem will be there as long as there's insecure hardware out there.

Currently DDoS requires insecure hardware. If it didn't, we're one step closer to fixing it.

This statement is simply not true.

Re: IP Spoofing

#116

Post by equalunique »

The slide showing the Internet Exchange's switch says those are Ethernet cables, but they're actually fiber.

I'm really impressed with this presentation, but I wish that one flaw could be fixed.

Re: IP Spoofing

#117

Post by z92js71g »

jgrahamc wrote: post #107
jerefa1 wrote: post #77

Earlier quoted context omitted.

It amuses me greatly that probably no one in this thread realizes who you are. (Except maybe Cloudflare.)

I have no clue who ryanlol is. Would it make a difference if I did?

He's a subject matter expert: Julius Kivimaki.

Re: IP Spoofing

#118

Post by scurvy »

hueving wrote: post #106
scurvy wrote: post #90

Large bandwidth attacks might look sexy, but they're trivially easy to block. Network operators care about pushing packets, not bits. The OVH attacks look huge to the average AWS user, (ZOMG a terabit!) but to even an average tier 2 transit provider it's a trivial attack to block. Especially when the attackers are hitting a single endpoint. To be honest, attackers are not very smart. They almost always use the same o…

It's not trivial by any means other than preventing it from clogging up internal stuff. If they are targeting a specific IP and the traffic is indistinguishable from normal traffic in the l3/l4 headers, there is no way you are going to block the attack without taking down the service. This is why solving spoofing is such an important problem. Once source IPs become sticky, we can actually block based on them to truly…

You block volumetric attacks by filtering the payload, not by blocking IP's. If you block by IP, you're going to have a lot of upset customers. Also, what are you going to do on an IPv6 attack? Block the entire /64? Unlikely. Also remember that a single IP doesn't always mean a single user for IPv4. An IP might represent several thousand customers in the case of NAT and especially CGNAT.

If the traffic is indistinguishable from normal traffic via L3/L4, then it's a layer 7 attack, which cannot be spoofed. You're not dealing with spoofing in a L7 attack.

The first D in DDoS stands for distributed. Even terabit sized attacks are easy to stop if they're sufficiently distributed (the attack is geographically dispersed enough to be diffused). It's when you get a terabit from a handful of AS's (like in S. Korean attacks) that you can feel pain. Even then, it usually only knocks out access in that part of the world, but not everyone.

IP's will not be sticky. IPv6 is showing why it's important to not be sticky. Ending spoofing isn't going to stop DDoS attacks. I've got 10+ years of experience on the subject, and I'll gladly answer any questions you might have.

Re: IP Spoofing

#119

Post by criddell »

Sanddancer wrote: post #92
criddell wrote: post #10

Earlier quoted context omitted.

I agree 100%. I've also wondered why ISPs don't do more to shut down customers that are participating in a DDOS (at least for DDOS attacks where the source IP isn't spoofed)? I would be very happy if my ISP were to let me know that something on my network is involved in an attack.

Support costs for shutting down the average user are higher than the costs of bandwidth. Telling someone that their internet was shut off because their device was used in a botnet would lead to very long support calls and escalations.

Then people and businesses that are DDOS'd should be able to recover damages from the ISPs.

Re: IP Spoofing

#120

Post by micro_softy »

mrb wrote: post #22

I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers ( http://blog.zorinaq.com/nginx-resolver-vulns/ ) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can't be done on the Internet…

The author argues DDoS causes centralization because it's "just too easy to knock unprotected websites offline" and so they need to pay some organization that makes money from centralization for "protection".

This assumes that the centralized topology and usage of the internet as it is implemented will never change, despite the fact that by design an internet can be decentralized and therefore resilient. Isn't that what Paul Baran thought made it a useful idea?

Imagine for a moment that the internet really was like a mesh net instead of several lengths of heavy rope frayed at the ends. Imagine it looked like Paul Baran's sketches.

True or false:

If there was not such reliance on "backbones" and "ISPs" then knocking some endpoint offline would not necessarily threaten the connections of others and would not be costly to anyone except the target. DDoS would only affect a small portion of the network mesh. There would be multiple ways for point A to reach point C besides going through B.

True or false:

If internet users demanded peer-to-peer connections instead of accepting firewalled, calf-cow access to "websites" then there would be no need for DDoS protection, because knocking a website offline would not stop people from getting the served content from other endpoints. The attacker would have to knock offline every supernode that an endpoint could possibly access or every node listed in a distributed hash table.

Post reply on HN