Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Azure hit by 15 Tbps DDoS attack using 500k IP addresses

bleepingcomputer.com

Post reply on HN
Print view View original

161–170 of 318 posts

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#161

Post by bsder »

kundi wrote: post #154
bsder wrote: post #120

Earlier quoted context omitted.

If we were all running IPv6, we could just block this crap. But here we are in 2025 still running IPv4 with CGNAT, so we can't.

What difference would it make?

You can block the specific offending IPs without collateral damage.

CGNATs reuse IPs so any IP block rule fairly quickly becomes somebody else's IP that you shouldn't be blocking.

If, however, you use IPv6, you don't need CGNAT and, while addresses may change, a blocked address won't suddenly get recycled to an unsuspecting user. In addition, if the allocation is static, you can block the whole network range and the problematic devices can't change their allocation sufficiently to escape the IP block.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#162

Post by jsheard »

bstsb wrote: post #104
haunter wrote: post #98

This is what I don't get >The Aisuru DDoS botnet operates as a DDoS-for-hire service with restricted clientele; operators have reportedly implemented preventive measures to avoid attacking governmental, law enforcement, military, and other national security properties. Most observed Aisuru attacks to date appear to be related to online gaming. https://www.netscout.com/blog/asert/asert-threat-summary-ais... So why? Li…

the ddos market has been somewhat centered around gaming for a while now, mainly to take down game server competition, or as an attempt to sell big players on "ddos protection" services. well, gaming and Krebs's blog: https://krebsonsecurity.com/2025/05/krebsonsecurity-hit-with...

Yep, Minecraft servers get DDoSed so often that Cloudflare actually offers turnkey protection for them specifically.

https://www.cloudflare.com/en-gb/application-services/produc...

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#163

Post by unnouinceput »

discordance wrote: post #151
supportengineer wrote: post #16

I will never understand why there isn’t an international law enforcement agency with teeth, which can get rid of the bad actors.

Who would they take orders from?

from those who pay them. They are a service for hire. you can hire them if you want and have the dough.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#165

Post by neilv »

haunter wrote: post #98

This is what I don't get >The Aisuru DDoS botnet operates as a DDoS-for-hire service with restricted clientele; operators have reportedly implemented preventive measures to avoid attacking governmental, law enforcement, military, and other national security properties. Most observed Aisuru attacks to date appear to be related to online gaming. https://www.netscout.com/blog/asert/asert-threat-summary-ais... So why? Li…

A satisfying theory for a lot of DDoS would be extortion or protection rackets. Pay up or we will DDoS you, or pay up or 'someone else' will DDoS you.

That's enough to explain it. But if you wanted to go more full shadowy conspiracy theory, someone arranged for a protection service that just so happens to work by giving some entity cleartext surveillance over much of the internet. Perhaps as a response to HTTPS everywhere being annoying.

I'm not suggesting that's the situation, but that it's the kind of possibility to keep in mind, intellectually, and it would be consistent with history.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#166

Post by manquer »

mihaaly wrote: post #81
perfmode wrote: post #42

A DDoS attack is often used to distract a company's security team. While the security staff is scrambling to get the website back online, the attackers use the chaos to conduct a more serious, stealthy attack.

It was interesting to read that the record breaking attack caused no glitch whatsoever in the service MS provides. Which is so slow normally that I start to wonder if that is a strategy, having headroom for these kind of situations, no-one realizes slowdown when it is already slow. ;) This is just a crazy thought, tangential to what are happening during an attack.

or rather the slowness problems of MS has nothing to do with hardware or infrastructure limitations. You cannot just throw infra at a problem to mask poorly written code beyond a point.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#168

Post by manquer »

averageRoyalty wrote: post #88

> This attack lasted only 40 seconds but was roughly equivalent to streaming one million 4K videos simultaneously. Who is this for? Is there anyone reading the article that can't grasp what a terrabit is but can somehow conceptualise one million 4k videos streaming simultaneously? I don't think anyone sits in that venn diagram.

An regular user would associate 4k is premium / expensive and difficult to use without better phones/network/plans/signal strength etc so the idea would be to be signal it is 1M times with a somewhat challenging thing for them.

Non-tech savy users know how live streams crash with sports like with Netflix recently during boxing etc or on Twitter last year and usually those come with some n Million users in kind of headlines or the like, so they have some reference to that scale.

As analogies go, there are worse examples. BleepingComputer is hardly the New Yorker or Atlantic, best we can hope for these days is a human is writing the article I suppose.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#169

Post by fc417fc802 »

contravariant wrote: post #156
nine_k wrote: post #72

Earlier quoted context omitted.

Why, OpenWRT firmware and packages are both signed, of course. You can manually and independently check the image signature before flashing an update. The build infrastructure is, of course, a juicy target: infect the artifact after building but before signing, and pwn millions of boxes before this is detected. This is why bit-perfect reproducible builds are so important. OpenWRT in particular have that: https://open…

This exchange is somewhat hilarious. Oh how on earth do we keep things safe and secure if everyone can see the code and verify what it does! Who would keep us safe if we turn our backs to unverifiable, unvetted, unprofitable security fixes, by for-profit companies!

> how on earth do we keep things safe and secure if everyone can see the code and verify what it does!

That's not always the silver bullet you seem to think it is. Have you ever tried to build something like Chromium, Firefox, or LLVM yourself? It's not realistic to do that on a mid tier let alone low end device.

Even when you go to the trouble of getting a local build set up, more often than not the build system immediately attempts to download opaque binary blobs of uncertain provenance. Try building some common pieces of software in a network isolated environment and you will likely be surprised at how poorly it goes.

If projects actually took this stuff seriously then you'd be able to bootstrap from a sectorlisp and pure human readable source code without any binary blobs or network access involved. Instead we have the abomination that is npm.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#170

Post by AnthonyMouse »

danudey wrote: post #97
jacobgkau wrote: post #54

Earlier quoted context omitted.

I'm confused why you're so honed in on OpenWRT as a third-party open-source project here when the vulnerability you quoted (TotoLink) was the official firmware update server of a brand of devices. Is it "scary" to think about OpenWRT potentially getting hacked? If you get scared by theoretical possibilities in software, sure. Is it relevant? Not exactly. Are companies' official servers more secure than an open-source…

What's scary is that OpenWRT is a project created by people who wanted a better solution than what was out there, and are therefore largely driven by a desire to create a good product. Meanwhile, corporations are driven entirely by profit motive, so as long as it's more expensive to be vigilant about security than it is to be lax about it they will never improve. Until companies which produce (and do not update) vuln…

The disappointing thing is that the companies don't just ship the open source firmware on their devices from the factory. They rarely if ever have any marketable features the open source firmware doesn't -- it's more often the other way around -- and then you don't have a zillion unpatched devices when they decide to stop caring because the community continues to maintain the code.
Post reply on HN