Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

111–120 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#111

Post by codedokode »

ilyt wrote: post #96
codedokode wrote: post #80

Earlier quoted context omitted.

There should be a protocol to block traffic on the upstream provider. So if someone from 1.2.3.4 sends lots of traffic at you, you send a special packet to 1.2.3.4 and all upstream providers (including the provider that serves 1.2.0.0/16), that see this packet block traffic from that IP address directed at you. Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.…

What you say already exists, hell, you can use BGP to distribute ACLs But it costs space in the routing tables and that means replacing routers earlier. It's no wonder, especially if you multiply it by thousand customers. "block all traffic from outside from this IP" is significantly easier than "block all traffic from outside from this IP to this client". And you need to do it per ISP client, else it is ripe for abu…

> What you say already exists, hell, you can use BGP to distribute ACLs

But you should own an AS for that?

> But it costs space in the routing tables

Not implementing my proposal leaves critical infrastructure unprotected from foreign attacks. Make larger routing tables. Also, instead of blocking single IPs one can block /8 or /16 subnets.

Re: The largest DDoS attack to date, peaking above 398M rps

#112

Post by codedokode »

tsimionescu wrote: post #104
codedokode wrote: post #80

Earlier quoted context omitted.

There should be a protocol to block traffic on the upstream provider. So if someone from 1.2.3.4 sends lots of traffic at you, you send a special packet to 1.2.3.4 and all upstream providers (including the provider that serves 1.2.0.0/16), that see this packet block traffic from that IP address directed at you. Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.…

So I can deny service to your site with a single packet, instead of having to bother with establishing a whole botnet? The current botnet customers would be the first to advocate for this new protocol!

You can deny access only from your IP, not for anyone else.

Re: The largest DDoS attack to date, peaking above 398M rps

#113

Post by scrpl »

nine_k wrote: post #92
scrpl wrote: post #64

Earlier quoted context omitted.

Great solution for a world without shared and dynamic ips.

Not as bad as one may think. It's proper feedback which can be acted upon. Every reasonable connectivity provider would pay attention to this info, or face intense complaints from its users with shared and dynamic IPs. It would identify sources of attacks, and block them at higher granularity level, reporting that the range has been cleared. (If a provider lied, everyone would stop believing it, and the disgruntled c…

If the one doing the blocking is not at FAANG it would do nothing of sorts. And FAANG benefit from DDoS by getting people into their walled cloud gardens.

Re: The largest DDoS attack to date, peaking above 398M rps

#114

Post by vasachi »

kijin wrote: post #50
hayyyyydos wrote: post #43

Earlier quoted context omitted.

> In many parts of the world, landline IP allocations tend to be stable enough for this to have a real effect. And what about CGNAT?

In that scenario, it's on the ISP to clean their network of abuse, the same thing they would need to do if Gmail had blacklisted their IPs for spamming. After all, an ISP that can't connect to YouTube isn't going to stay in business for long. People have been begging ISPs for ages to do a bit of egress filtering, for example, to prevent source address falsification. They've demonstrated time and again that they don't…

OK, but how should an ISP distinguish a good HTTP/2 connection from a bad one (I'm talking about this particular attack)? As far as I can tell, the DoS starts after the connection from bot to server is established, at which point the connection is fully encrypted. Should all ISPs MITM their clients to ensure that all traffic is good and proper?

Re: The largest DDoS attack to date, peaking above 398M rps

#115

Post by codedokode »

alexfoo wrote: post #109
tsimionescu wrote: post #104

Earlier quoted context omitted.

So I can deny service to your site with a single packet, instead of having to bother with establishing a whole botnet? The current botnet customers would be the first to advocate for this new protocol!

Simple! To prevent it being abused easily you could make it so you would need to send a high number of those packets for a sustained period in order to activate the block.

You can only block access to your IP address, so you can ban someone from sending packets to you but not to anyone else. My proposal is well-thought and doesn't require any lists like Spamhaus that have vague policies for inclusion and charge money for removing. My proposal doesn't have any potential for misuse.

Re: The largest DDoS attack to date, peaking above 398M rps

#116

Post by seanw444 »

gchamonlive wrote: post #69
mihaic wrote: post #14

The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.

What? Let's go back to username and password. 2FA forces scammers to up their game. What about password managers? Having separate passwords to every account makes hacking into your accounts much harder and might hurt everyone in the long run. And don't get me started on end to end encryption. Privacy, long term, will mean the fall of civilization. Sarcasm aside. I think I understand your point in which we shouldn't j…

> Privacy, long term, will mean the fall of civilization.

I'm curious about your rationalization for this. Lack of privacy will also mean the fall of civilization. Civilization is just doomed to fail at one point or another. All things come to an end.

Re: The largest DDoS attack to date, peaking above 398M rps

#117

Post by simondotau »

alexfoo wrote: post #109
tsimionescu wrote: post #104

Earlier quoted context omitted.

So I can deny service to your site with a single packet, instead of having to bother with establishing a whole botnet? The current botnet customers would be the first to advocate for this new protocol!

Simple! To prevent it being abused easily you could make it so you would need to send a high number of those packets for a sustained period in order to activate the block.

And there could be a short time limit on that block, perhaps one hour, but even 60 seconds would be enough to completely flip the script on a DDoS.

Re: The largest DDoS attack to date, peaking above 398M rps

#118

Post by scrpl »

dmm wrote: post #65
scrpl wrote: post #64

Earlier quoted context omitted.

Great solution for a world without shared and dynamic ips.

Block the whole subnet and make it the ISP's problem?

I‘m sure comcast is terrified that their users won’t be able to read my blog.

Re: The largest DDoS attack to date, peaking above 398M rps

#119

Post by papichulo2023 »

tsimionescu wrote: post #104
codedokode wrote: post #80

Earlier quoted context omitted.

There should be a protocol to block traffic on the upstream provider. So if someone from 1.2.3.4 sends lots of traffic at you, you send a special packet to 1.2.3.4 and all upstream providers (including the provider that serves 1.2.0.0/16), that see this packet block traffic from that IP address directed at you. Of course, the packet should allow blocking not only a single address, but a whole network, for example, 1.…

So I can deny service to your site with a single packet, instead of having to bother with establishing a whole botnet? The current botnet customers would be the first to advocate for this new protocol!

Yeah, we should invent secure communication channels and crypto keys first...

Re: The largest DDoS attack to date, peaking above 398M rps

#120

Post by justaman »

RandomLensman wrote: post #67
mihaic wrote: post #14

The fact that large cloud providers can handle huge DDoS attacks I think in the long run leads to a worse internet. It forces botnets to up their game and for websites the only solutions available are to pay Google, Amazon or Cloudflare a protection tax. I honestly don't see any other options, but I'd really wish for them to come through some community coordinated list of botnet infected IPs or something.

We could also treat it as a public security threat and act accordingly.

I think this is the key take away. Unfortunately world leaders are not tech savvy enough to even consider this a threat.
Post reply on HN