Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Azure hit by 15 Tbps DDoS attack using 500k IP addresses

bleepingcomputer.com

Post reply on HN
Print view View original

191–200 of 318 posts

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#191

Post by mattwad »

haunter wrote: post #98

This is what I don't get >The Aisuru DDoS botnet operates as a DDoS-for-hire service with restricted clientele; operators have reportedly implemented preventive measures to avoid attacking governmental, law enforcement, military, and other national security properties. Most observed Aisuru attacks to date appear to be related to online gaming. https://www.netscout.com/blog/asert/asert-threat-summary-ais... So why? Li…

competitors might want to drive users to move away if they think a platform is broken

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#192

Post by kachapopopow »

alphager wrote: post #160
kachapopopow wrote: post #56

Earlier quoted context omitted.

fun fact, part of the reason this botnet exists is because europe required the ability to install security updates unattended that you cannot disable and they compromised one of the servers that had the capability to push these updates compromising hundreds of thousands of routers.

That's just not true. I'm in Europe and all of my routers allow me to disable unattended updates and most don't enable it by default.

might be too old, my asus router updated and I could no longer disable updates and you could just look up the relevant law here: EU Cyber Resilience Act (CRA) 2024.

While it doesn't make it mandatory, it does require patching devices in a timely fasion which in other terms: requires forced updates - pushing updated firmware is not enough if you read between the lines.

Even stronger requirements come into effect at the end of 2027.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#193

Post by nunez »

tetha wrote: post #96
nine_k wrote: post #72

Earlier quoted context omitted.

Why, OpenWRT firmware and packages are both signed, of course. You can manually and independently check the image signature before flashing an update. The build infrastructure is, of course, a juicy target: infect the artifact after building but before signing, and pwn millions of boxes before this is detected. This is why bit-perfect reproducible builds are so important. OpenWRT in particular have that: https://open…

Bit-Reproducible infrastructure could also result in some of the wildest build distribution architectures if you think about it. You could publish sources and have people register like in APT mirrors to provide builds, and at the end of the day, the build from the largest bit-equal group is published. I do see the Tor-Issue - a botnet or a well-supplied malicious actor could just flood it. And if you flip it - if you…

> Try building some common pieces of software in a network isolated environment and you will likely be surprised at how poorly it goes.

I have yet to experience a straight shot install or build of anything in an air gapped environment. Always need to hack things to make it work.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#194

Post by kachapopopow »

mmooss wrote: post #182
kachapopopow wrote: post #93

Earlier quoted context omitted.

the problem is that these laws just make the problem bigger - instead of having to compromise 100 thousand routers they can just compromise a single update server from a vendor that doesn't care about security. the fallout is some companies losing their revenue: https://status.neoprotect.net/ and other headaches for people all over the world

Or the law makes the problem smaller, by making the routers secure, and makes outcomes just, by penalizing the responsible companies.

ok, let's redo this: instead of routers it's an IoT device. The router protects the IoT device from direct access so it is secure from majority of attack vectors - now an IoT device provider gets their server compromised and hundreds of thousands of IoT devices are now bots in a botnet due to the ability to forcefully push a security update.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#195

Post by anamexis »

hansvm wrote: post #180
alickz wrote: post #173

Earlier quoted context omitted.

>There is a lot of money to be made from paid cosmetics, ranks, moderator (demi-tyrant) status, etc on custom servers. Anyone have any idea how much a 15 Tbps DDoS attack would cost? Thousands of dollars? Tens of thousands?

Ballpark math says you could sustain it for half an hour on Hetzner for $5k-$6k (only from 1500 IPs though), at least if your account didn't get banned first and you're halfway decent at network programming. I have no idea what a proper botnet like this costs though or how large the profit margins are.

Isn't the idea behind botnets that no one is paying for the bandwidth, besides the unsuspecting random people who have fallen victim to malware?

I'd imagine the pricing is quite disconnected from the price of "legitimate" bandwidth. But I don't know in what direction.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#196

Post by kachapopopow »

Fabricio20 wrote: post #114
estearum wrote: post #50

Earlier quoted context omitted.

but why? For fun?

As someone on the receiving end of these, I've yet to receive any explanation. Every other week we see the most basic of attacks against our infrastructure (http floods - GET / - for example), with no specific goal in mind and we never received any threats. I can only assume it's some disgruntled user or maybe a competitor, but it could also just be stray bullets. I don't know who used these IPs before us, though it'…

likely cause here is carpet bombing

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#197

Post by baxtr »

denkmoon wrote: post #101
haunter wrote: post #98

This is what I don't get >The Aisuru DDoS botnet operates as a DDoS-for-hire service with restricted clientele; operators have reportedly implemented preventive measures to avoid attacking governmental, law enforcement, military, and other national security properties. Most observed Aisuru attacks to date appear to be related to online gaming. https://www.netscout.com/blog/asert/asert-threat-summary-ais... So why? Li…

Mad salt. Imagine a fully grown man having a toddler tantrum. "If I can't play/win/get my way, nobody can" type mentality. It's also a method of coercion. Give me mod status or I'll DDOS your server and destroy your community. The other half comes from sever operators ddosing their competition. There is a lot of money to be made from paid cosmetics, ranks, moderator (demi-tyrant) status, etc on custom servers.

Games continue beyond the Games themselves...

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#198

Post by nunez »

aydyn wrote: post #148

> Aisuru is a Turbo Mirai-class IoT botnet IoT botnet. Just read that again, we're literally inventing problems where none needs to exist. IoT adds basically null or negative value, except to nerds who like to think they're smarter than other people by consuming the latest e-slop. Its all so tiresome.

My Hue lights and vacuums would like a word!

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#199

Post by pabs3 »

fc417fc802 wrote: post #169
contravariant wrote: post #156

Earlier quoted context omitted.

This exchange is somewhat hilarious. Oh how on earth do we keep things safe and secure if everyone can see the code and verify what it does! Who would keep us safe if we turn our backs to unverifiable, unvetted, unprofitable security fixes, by for-profit companies!

> how on earth do we keep things safe and secure if everyone can see the code and verify what it does! That's not always the silver bullet you seem to think it is. Have you ever tried to build something like Chromium, Firefox, or LLVM yourself? It's not realistic to do that on a mid tier let alone low end device. Even when you go to the trouble of getting a local build set up, more often than not the build system imm…

Debian manages to build Chromium, Firefox, and LLVM on servers of multiple architectures, including quite slow riscv64 machines, without any network access to the builds for any architecture.

https://buildd.debian.org/status/package.php?p=firefox-esr

See Bootstrappable Builds for starting from almost nothing, so far only GNU Guix and StageX have worked out how to start from the BB work to get a full distro. Should be fairly trivial for other distros too if they cared.

https://bootstrappable.org/ https://guix.gnu.org/blog/2023/the-full-source-bootstrap-bui... https://stagex.tools/

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#200

Post by pabs3 »

tetha wrote: post #96
nine_k wrote: post #72

Earlier quoted context omitted.

Why, OpenWRT firmware and packages are both signed, of course. You can manually and independently check the image signature before flashing an update. The build infrastructure is, of course, a juicy target: infect the artifact after building but before signing, and pwn millions of boxes before this is detected. This is why bit-perfect reproducible builds are so important. OpenWRT in particular have that: https://open…

Bit-Reproducible infrastructure could also result in some of the wildest build distribution architectures if you think about it. You could publish sources and have people register like in APT mirrors to provide builds, and at the end of the day, the build from the largest bit-equal group is published. I do see the Tor-Issue - a botnet or a well-supplied malicious actor could just flood it. And if you flip it - if you…

Reproducible isn't quite enough, you also need bootstrap from almost-zero binaries.

https://bootstrappable.org/

Post reply on HN