Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Possible Vendetta Behind the East Coast Web Slowdown

bloomberg.com

Post reply on HN
Print view View original

131–140 of 206 posts

Re: Possible Vendetta Behind the East Coast Web Slowdown

#131

Post by grzm »

empath75 wrote: post #129
matthewmacleod wrote: post #88

Earlier quoted context omitted.

I think that's okay. We don't expect all homeowners to be, say, experts in electrical wiring, or gas supply, plumbing, drainage, or waste management. But all of these things—if they are poorly modified, managed, or maintained—can cause impacts on third parties. In the case of networked devices, the possible impact on third parties is even greater. We also enforce strong regulation on these systems – defining what may…

I feel like Amazon, Best Buy and new egg could get together and create a standard for IoT devices, no? Though I guess they'd get hit with antitrust.

I'm not all that familiar with standards bodies, but is it common for retailers to create standards? Isn't it often the case that industry does this?

Re: Possible Vendetta Behind the East Coast Web Slowdown

#132

Post by NetStrikeForce »

cmdrfred wrote: post #126
NetStrikeForce wrote: post #110

Earlier quoted context omitted.

We partly do that at Wormhole. I say partly because you still have to be able to access one of our addresses. Port of last resort is 443/TCP, so it works on lots of tricky networks out there. The idea is that all your IOT stuff establishes a connection to this server, creating an encrypted network between them. You then add your control servers to that network and job done. You devices don't need any inbound access t…

Interesting, I have a few thoughts. Perhaps you could sell a preconfigured pfsense box (or make a raspberry pi image to start with) that when plugged into the customers router creates a reverse tunnel via your service as well as a WiFi hotspot. Then offer the user a very simple firewall control panel and they can choose what devices to allow to the open internet and what to keep private and accessible via some sort o…

Hi!

Thank you for the feedback and the suggestion. It is a good idea actually. I'm considering new features in the roadmap, because at the moment I don't even offer Internet access through my system, it's just a private LAN (I'm not competing with the myriad of privacy-minded browsing VPNs out there). Adding a manageable Internet Gateway could be a nice option.

Developing and deploying a software+hardware piece would be very interesting too, so there's no need to deploy agents on the remote servers or IOT devices (on most of them you probably can't) and I take the hassle out of my customer's hands to setup a e.g. Linux gateway to route traffic through the tunnel.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#133

Post by braveo »

fzzzy wrote: post #104
redleggedfrog wrote: post #97

Earlier quoted context omitted.

The real problem here, and this isn't going to be a popular position, is that you're relying on the internet for important things. The original engineering and architecture of the the internet (and the web) was not intended to create something you put all your eggs in. It was for sharing information, not building your mission critical business operations on. Right now, if you dumped your business into a cloud service…

Actually, the original engineering and architecture of the internet was intended to provide reliable command & control in the event of a nuclear war. A network of last resort. I can't think of anything more mission critical than that.

And yet I suspect the government could pick up a phone, hop in a vehicle, etc and communicate with the right people.

Which means it falls under what he said.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#134

Post by NetStrikeForce »

RickS wrote: post #99
cmdrfred wrote: post #82

Earlier quoted context omitted.

Exactly, I have tons of IOT devices. I put them on a separate subnet that does not have a gateway to the internet then I VPN into that network to access them. Perhaps a product that makes that a simple process will solve the problem?

FWIW, I would definitely be interested in paying for a service like this. I'm technical enough to care about this, but not technical enough to solve it myself. Similar to where I was before dropbox.

My comment here might be relevant to your interests: https://news.ycombinator.com/item?id=12765051

It could suit your needs or we can help with custom deployments. In any case I'd like to learn more about your needs and your expectations. Can I drop you an email?

Re: Possible Vendetta Behind the East Coast Web Slowdown

#135

Post by JayNeely »

reacharavindh wrote: post #127

Perhaps a naive question, but Why can't a DNS provider identify such participants in a DDOS and ban their IPs forever?

Because IP addresses are often shared resources. Your ISP gives each customer an IP address (often a temporary one), and then that customer's router system handles assigning private, local-network-only IP addresses to any devices connecting through the network.

So if a DNS provider starts banning public IPs (which are the only IPs it sees), you could end up with an entire college getting banned because of one hacked webcam in one student's dorm room.

Or someone in an apartment somewhere with (unknowingly) a hacked thermostat finds their internet no longer works (DNS provider has banned them), so they reboot their modem, which causes their ISP to provide them with a new IP address. Guess what happens to their old IP address? It goes back into the pool of available IPs that that ISP can assign to other customers, and more and more banned-from-DNS addresses keep getting passed along to innocent, un-hacked customers.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#136

Post by mcbits »

pmlnr wrote: post #121
egypturnash wrote: post #113

I am a non-programmer who reads HN and keeps up with tech news in general. And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it. How can I find this out? Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advanta…

For non-technical users, I'd suggest the following: Turn off the devices you don't want to check; leave only those up you want to investigate. Visit your router on the web interface and see if there are any graphs are possible to check for things like requests/second or packets/second. If it's really high while you're not actively doing anything, that's a clue. Visit the UPnP settings on the router. If there are port…

> For non-technical users, ... routers ... packets ... UPnP ... SSH ... tcpdump ... wireshark ... protocol ... telnet ... IRC ... plain text commands ...

I think you unintentionally helped to cement GP's point. There is a huge opportunity for some kind of little box - vetted/certified or even insured - that non-technical users can plug in, click Next > Next > Finish, and be notified when any device on their home network starts acting suspicious.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#137

Post by notatoad »

Jtsummers wrote: post #75
cpncrunch wrote: post #71

Earlier quoted context omitted.

I think it's fair to block the entire network. It is then up to the network administrator to fix the problematic device.

While technically accurate to describe them as such, the vast majority of consumers (and internet service subscribers) lack the actual technical expertise to be network administrators. Where these devices are being attacked inside, ostensibly, professional organizations (companies, schools, government buildings), I agree. But there you have, again ostensibly, an actual network administrator capable of dealing with th…

"the vast majority of consumers (and internet service subscribers) lack the actual technical expertise to be network administrators."

that's true, but the vast majority of internet service subscribers aren't their own network administrators. If you're using an ISP-supplied modem/router combo, i'd say that your ISP is your network administrator. If my ISP wants that kind of access into my local network (and they don't give me any other option) then they should be doing some actual administration.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#138

Post by reacharavindh »

JayNeely wrote: post #135
reacharavindh wrote: post #127

Perhaps a naive question, but Why can't a DNS provider identify such participants in a DDOS and ban their IPs forever?

Because IP addresses are often shared resources. Your ISP gives each customer an IP address (often a temporary one), and then that customer's router system handles assigning private, local-network-only IP addresses to any devices connecting through the network. So if a DNS provider starts banning public IPs (which are the only IPs it sees), you could end up with an entire college getting banned because of one hacked…

Ah, (inter)networking 101. Thanks! Then, is there a way for the DNS providers to know the ultimate recepient at all? MAC address? (or does it get truncated at the lower levels and not passed over IP protocol?)

Re: Possible Vendetta Behind the East Coast Web Slowdown

#139

Post by anotherevan »

Did any one else find the style of writing in this article really annoying? Things like using prefacing statements with "so-called" or putting terms in quotes to make them seem suspect.

e.g.s:

a so-called distributed denial-of-service (DDoS) attack

York said Dyn was “actively” dealing with a “third wave” of the attack.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#140

Post by lqdc13 »

mcbits wrote: post #136
pmlnr wrote: post #121

Earlier quoted context omitted.

For non-technical users, I'd suggest the following: Turn off the devices you don't want to check; leave only those up you want to investigate. Visit your router on the web interface and see if there are any graphs are possible to check for things like requests/second or packets/second. If it's really high while you're not actively doing anything, that's a clue. Visit the UPnP settings on the router. If there are port…

> For non-technical users, ... routers ... packets ... UPnP ... SSH ... tcpdump ... wireshark ... protocol ... telnet ... IRC ... plain text commands ... I think you unintentionally helped to cement GP's point. There is a huge opportunity for some kind of little box - vetted/certified or even insured - that non-technical users can plug in, click Next > Next > Finish, and be notified when any device on their home netw…

This is not an easy problem.

You need a lot of data and a lot of current regularly updated information about websites being attacked or current known CnC servers. Also, there is a privacy aspect, so you can't send a lot of the data or even hashes of things to the cloud.

Such solutions might be more appropriate for workplaces in large companies and they already have things like SRX firewalls that have DDoS features.

Post reply on HN