Earlier quoted context omitted.
[flagged]
yeah bud if the person ends up ddosing I'm 100% certain their ban was justified lol
[flagged]
Azure hit by 15 Tbps DDoS attack using 500k IP addresses
111–120 of 318 posts
Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses
#112Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses
#113I will never understand why there isn’t an international law enforcement agency with teeth, which can get rid of the bad actors.
It's national interest of China and Russia to see the West to fail. Why would they co-operate? They are willing to murder people, West and their own, so "law" enforcement means a bit different in international context.
Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses
#114Earlier quoted context omitted.
we were getting hit with attacks like this daily at some point and were forced to use cloudflare magic transit it's pretty random and you shouldn't read too deep into it as nearly every anti-ddos solution, host and isp has been hit with this botnet by now.
but why? For fun?
As someone on the receiving end of these, I've yet to receive any explanation. Every other week we see the most basic of attacks against our infrastructure (http floods - GET / - for example), with no specific goal in mind and we never received any threats. I can only assume it's some disgruntled user or maybe a competitor, but it could also just be stray bullets. I don't know who used these IPs before us, though it's been several years we've owned them. Who knows.
Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses
#115Earlier quoted context omitted.
Why, OpenWRT firmware and packages are both signed, of course. You can manually and independently check the image signature before flashing an update. The build infrastructure is, of course, a juicy target: infect the artifact after building but before signing, and pwn millions of boxes before this is detected. This is why bit-perfect reproducible builds are so important. OpenWRT in particular have that: https://open…
Bit-Reproducible infrastructure could also result in some of the wildest build distribution architectures if you think about it. You could publish sources and have people register like in APT mirrors to provide builds, and at the end of the day, the build from the largest bit-equal group is published. I do see the Tor-Issue - a botnet or a well-supplied malicious actor could just flood it. And if you flip it - if you…
The distribution system you're describing exists and has been in use for decades. You just distribute the build using bittorrent.
Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses
#116Earlier quoted context omitted.
Why, OpenWRT firmware and packages are both signed, of course. You can manually and independently check the image signature before flashing an update. The build infrastructure is, of course, a juicy target: infect the artifact after building but before signing, and pwn millions of boxes before this is detected. This is why bit-perfect reproducible builds are so important. OpenWRT in particular have that: https://open…
Bit-Reproducible infrastructure could also result in some of the wildest build distribution architectures if you think about it. You could publish sources and have people register like in APT mirrors to provide builds, and at the end of the day, the build from the largest bit-equal group is published. I do see the Tor-Issue - a botnet or a well-supplied malicious actor could just flood it. And if you flip it - if you…
>It'd just have to be more annoying to breach the distributed build infrastructure than to plant a malicious developer.
It really wouldn't. You don't even need a powerful build server since you can mirror whatever someone else built. You can also buy / hack nodes of existing trusted people.
Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses
#117Earlier quoted context omitted.
How exactly would you keep the origin from sending a command to a botnet?
you don’t stop the message to the botnet, thats impossible: You detect the behaviour downstream and send a signal to the ISP that there is traffic that needs to he rate limited. One mechanism for this is called RTBH (Remote Triggered BlackHole) which relies on community tagged prefixes of addresses exceeding rate limited to be blackholed from forwarding traffic further in to the internet. There’s also things like flo…
It's not that simple and hasn't been for awhile.
There's layer upon layer of relays now, and meshed C2C networks.
Lots of DNS fastflux too
Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses
#118Earlier quoted context omitted.
They get banned for trolling, griefing, cheating, breaking rules etc. and want revenge. Every game operator has to deal with idiots like this
[flagged]
At the end of the day, at least for silly private servers, you are always welcome to build it yourself. Theres much to learn in doing that.
Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses
#119Earlier quoted context omitted.
How do you know where it comes from, if they use UDP and change the src of the packets.
IP spoofing is pretty uncommon nowadays because everyone has anti-spoofing mechanisms in place and most ASNs often don't forward spoofed addresses outbound. But as the sibling mentioned, even with spoofing, you can still follow the packet trail from your border routers upstream. I think the main thing we are lacking is just responsibility on the ISP side, if someone reaches out complaining that half of your customers…
This is clearly not true, or the CAIDA anti-spoofer project wouldn't exist.
Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses
#120I will never understand why there isn’t an international law enforcement agency with teeth, which can get rid of the bad actors.
If we were all running IPv6, we could just block this crap.
But here we are in 2025 still running IPv4 with CGNAT, so we can't.