Possible Vendetta Behind the East Coast Web Slowdown • Hacker News Board

Re: Possible Vendetta Behind the East Coast Web Slowdown

#151

Post by mycall » Sat, Oct 22, 2016, 1:17 AM UTC

late2part wrote: post #146

fzzzy wrote: post #104

Earlier quoted context omitted.

Actually, the original engineering and architecture of the internet was intended to provide reliable command & control in the event of a nuclear war. A network of last resort. I can't think of anything more mission critical than that.

No, it wasn't. That's a myth, disturbed in many sources, including [1]. Also in [2]: Many people have heard that the Internet began with some military computers in the Pentagon called Arpanet in 1969. The theory goes on to suggest that the network was designed to survive a nuclear attack. However, whichever definition of what the Internet is we use, neither the Pentagon nor 1969 hold up as the time and place the Inte…

> Arpanet was about time-sharing. Time sharing tried to make it possible for research institutions to use the processing power of other institutions computers when they had large calculations to do that required more power, or when someone else's facility might do the job better.

Arpanet is distributed shared information for science. Nuclear technology is science. Surviving science is a war that requires nuclear insights. Therefore, the Arpanet was developed for surviving nuclear war.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#152

Post by jlgaddis » Sat, Oct 22, 2016, 1:23 AM UTC

JayNeely wrote: post #135

reacharavindh wrote: post #127

Perhaps a naive question, but Why can't a DNS provider identify such participants in a DDOS and ban their IPs forever?

Because IP addresses are often shared resources. Your ISP gives each customer an IP address (often a temporary one), and then that customer's router system handles assigning private, local-network-only IP addresses to any devices connecting through the network. So if a DNS provider starts banning public IPs (which are the only IPs it sees), you could end up with an entire college getting banned because of one hacked…

Yep. The effects of this can be seen when someone sets up a new e-mail server on an IP address they've just acquired, a.b.c.d, and -- as soon as they connect it to the Internet -- are unable to send outgoing e-mail because the IP has previously been blacklisted due to another user's actions.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#153

Post by jlgaddis » Sat, Oct 22, 2016, 1:33 AM UTC

reacharavindh wrote: post #138

JayNeely wrote: post #135

Earlier quoted context omitted.

Because IP addresses are often shared resources. Your ISP gives each customer an IP address (often a temporary one), and then that customer's router system handles assigning private, local-network-only IP addresses to any devices connecting through the network. So if a DNS provider starts banning public IPs (which are the only IPs it sees), you could end up with an entire college getting banned because of one hacked…

Ah, (inter)networking 101. Thanks! Then, is there a way for the DNS providers to know the ultimate recepient at all? MAC address? (or does it get truncated at the lower levels and not passed over IP protocol?)

Nope. Assuming you have a router connecting your home network to your ISP, for example, the MAC addresses of your "internal" devices are not visible to the ISP. The only MAC address they see is the MAC address of your router's "WAN" interface.

The source/destination MAC addresses in an Ethernet frame (layer 2) are rewritten at every router (layer 3) hop. The original IP source/destination addresses in the IP packet, however, do not change (exception: NAT, which does exactly that).

Another problem -- in many (most?) DDoS attacks where UDP traffic is involved -- is that the source IP addresses are "spoofed". That is, IP packet that the victim receives says that it's coming from Alice but it really came from Bob. There are also "amplification" attacks, where an "innocent third-party" is used, unknowingly, to "help" perform the attack.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#154

Post by ikeboy » Sat, Oct 22, 2016, 1:34 AM UTC

lqdc13 wrote: post #140

mcbits wrote: post #136

Earlier quoted context omitted.

> For non-technical users, ... routers ... packets ... UPnP ... SSH ... tcpdump ... wireshark ... protocol ... telnet ... IRC ... plain text commands ... I think you unintentionally helped to cement GP's point. There is a huge opportunity for some kind of little box - vetted/certified or even insured - that non-technical users can plug in, click Next > Next > Finish, and be notified when any device on their home netw…

This is not an easy problem. You need a lot of data and a lot of current regularly updated information about websites being attacked or current known CnC servers. Also, there is a privacy aspect, so you can't send a lot of the data or even hashes of things to the cloud. Such solutions might be more appropriate for workplaces in large companies and they already have things like SRX firewalls that have DDoS features.

How about a simple list of devices and a way to limit bandwidth per device, with sensible defaults (very few IOT devices will need more than 100k/s, the main exception is video cameras). It can allow "burst" bandwidth but limit, say, the total used per six hours.

Disclaimer: this is off the top of my head, there may be reasons it would fail.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#155

Post by jlgaddis » Sat, Oct 22, 2016, 1:44 AM UTC

nastyasiwannabe wrote: post #58

I'm suggesting this just so someone more knowledgeable can debunk it. Suppose FBI or someone up there had a meeting and said "in three weeks, there could be millions of armed Americans who believe that democracy was just stolen from them by some evil dictator in a massive globalist conspiracy. These people love twitter. Is there a way to make twitter go down without making it look like we're suddenly pulling the plug…

If the government wanted to shut them down, it would likely be easier for them to just get a judge to issue an order (an NSL, perhaps?) to Twitter's upstream Internet providers to cut off their service.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#156

Post by Falkon1313 » Sat, Oct 22, 2016, 1:55 AM UTC

mcbits wrote: post #136

pmlnr wrote: post #121

Earlier quoted context omitted.

For non-technical users, I'd suggest the following: Turn off the devices you don't want to check; leave only those up you want to investigate. Visit your router on the web interface and see if there are any graphs are possible to check for things like requests/second or packets/second. If it's really high while you're not actively doing anything, that's a clue. Visit the UPnP settings on the router. If there are port…

> For non-technical users, ... routers ... packets ... UPnP ... SSH ... tcpdump ... wireshark ... protocol ... telnet ... IRC ... plain text commands ... I think you unintentionally helped to cement GP's point. There is a huge opportunity for some kind of little box - vetted/certified or even insured - that non-technical users can plug in, click Next > Next > Finish, and be notified when any device on their home netw…

Precisely. Users need something as simple as Malwarebytes where they just need to click the big 'Scan' button and after a few minutes it will say "Your living room ceiling fan is running a potentially unwanted program (bitcoinminer), your freezer is infected with a virus, your garage door opener is participating in a botnet, and your fitbit has a rootkit. Click here to quarantine and disinfect everything. Click here to repeat this scan daily and notify you if anything new shows up."

End users would expect that such a thing should be simple. But of course it's not (would need to work with any device running any OS with any interface). First we would need some sort of standard protocol for it. But a standard protocol that lets an external agent determine what software is running on any device could potentially be dangerous...

Re: Possible Vendetta Behind the East Coast Web Slowdown

#157

Post by cmdrfred » Sat, Oct 22, 2016, 2:06 AM UTC

voltagex_ wrote: post #145

cmdrfred wrote: post #82

Earlier quoted context omitted.

Exactly, I have tons of IOT devices. I put them on a separate subnet that does not have a gateway to the internet then I VPN into that network to access them. Perhaps a product that makes that a simple process will solve the problem?

I've been thinking about how you'd design a UI for that, that was easy to use. Maybe a separate wifi network that IOT devices go on to, and then a web app that knows devices with XYZ MAC are LIFX bulbs and shouldn't be able to talk to the smart TV, but that phones on the network should be able to jump the subnet and talk to the bulbs.

You can make it semi-automated in a way. I believe the first 6 characters of the mac address are the vendor id, I'd get the DHCP server to assign different vendors into different isolated vlans but with short leases at first and then allow you to merge them, assign permissions and move them around. Call it "learning mode". It won't be perfect but you can also augment it with human created presets.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#158

Post by tw04 » Sat, Oct 22, 2016, 2:21 AM UTC

brightball wrote: post #106

gorbachev wrote: post #33

Here's a better article from Mr. Krebs: https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twit... Personally I think his case is pretty convincing.

From the article: "Last month, a hacker by the name of Anna_Senpai released the source code for Mirai, a crime machine that enslaves IoT devices for use in large DDoS attacks. The 620 Gbps attack that hit my site last month was launched by a botnet built on Mirai, for example." I repeatedly hear people refer to IoT devices that are notoriously difficult to update...yet this Mirai code is technically able to access mi…

The problem is you're reading the situation wrong. Mirai isn't about an exploit, it's IoT devices that haven't had the default username/password changed.

Now, you might say "why doesn't a good samritan just login to all of those devices and change the password to something random?"

OK - ignoring the fact that THEY would be committing felonies in several countries... what happens when the device manufacturer wakes up and decides to patch these devices via that remote access? Suddenly the password doesn't work, and the end-user can't change it because... what's the procedure for changing the default ssh password on a light bulb?

Technically you could make the situation better by writing a worm that changes the passwords, but at this point even that is a lost cause since mirai has a command that will change the pw on all infected hosts.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#159

Post by egypturnash » Sat, Oct 22, 2016, 2:31 AM UTC

egypturnash wrote: post #113

I am a non-programmer who reads HN and keeps up with tech news in general. And every time I read about the IoT botnet, my immediate response is to look around my apartment at my Internet-connected lights, and wonder if they're part of it. How can I find this out? Is anyone making a tool that a non-technical user can run to squint at their network and look for evidence of Mirai, or anything else trying to take advanta…

Looking over all the replies this comment received, I think my plan for seeing if my apartment's Internet Things are on any botnet is going to be "bribe that security researcher I flirt with sometimes to visit my place and run some tests". Which is not really a solution that scales, either for that friend, or for people who don't happen to run in the kinds of circles where that's someone they could conceivably trade favors with.

And it's probably not gonna get any better any time soon, either. Because I'm not sure there's a money stream in making this something a non-programmer can do. And maybe there shouldn't even be a money stream in this - maybe there should just be huge-ass fines to motivate as many people as possible along the chain from "my Internet Thing" to "the Internet" to include a white/grey hat or three on their team very early in the design process of making their camera/light bulb/pacemaker/router/modem/whatever. Although if someone reading this can figure out a way to get a money stream out of making it a lot easier to see the health of your home's devices, and keep them safe, that might be a decent YC app for you.

How do we add an immune system to the Internet Of Things? Because we sure as hell need one.

Re: Possible Vendetta Behind the East Coast Web Slowdown

#160

Post by Falkon1313 » Sat, Oct 22, 2016, 2:36 AM UTC

Analemma_ wrote: post #23

kakarot wrote: post #5

Unfortunately, forced firmware updating is an area our governments should not be mandating. That puts unnecessary strain on small companies and creates a larger gap that companies must cross to become commercially viable

> Unfortunately, forced firmware updating is an area our governments should not be mandating. It absolutely is an area that governments should be mandating, because the problem is an externality. These attacks are a cost imposed on neither the producer nor the consumer of the device itself, and (apart from some highly speculative libertarian conjectures) the only things that can fix externalities are taxes, regulatio…

Which business model works best:

- planned obsolescence cranked to 11, you must replace everything in your house every month

- monthly subscription fees for each lightbulb, refrigerator, and everything else

- all products must refuse to operate unless they can connect to a central update server (which is being DDOSed by competing products made in a country without that government mandate, that are still working, while no products made in your country work)

- company shuts down, goes out of business, and a new company with a different name (but all the same employees and products except for the logo) opens every month

- all software created must be maintained indefinitely into the infinite future for free by...magic elves?