Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Estimating the Revenue of a Russian DDoS Booter

arbornetworks.com

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Estimating the Revenue of a Russian DDoS Booter

#21

Post by chillydawg »

foobartsimpson wrote: post #17

I can't imagine that DDOS are an effective competitive technique? Are people really buying these against their competitors? I would have assumed that they were mostly part of ransom campaigns.

I guess if you run yet-another-dog-food-store and you want to get more business, you target the top 3 competitors whenever they have sales events and at random throughout the year during busy periods. They'll lose custom to you and other stores because customers hate slow/broken sites. Just make sure you don't ddos everyone except yourself. Bit of a give away.

Re: Estimating the Revenue of a Russian DDoS Booter

#22

Post by Scoundreller »

kyledrake wrote: post #8

Hi. I run a thing that uses a lot of bandwidth. Repeat after me: I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I've brought this u…

Most residential Canadian internet connections have bandwidth caps. They're usually between 20gb and 200gb. Customers could only wish that their markup on overage was just 30x...

Re: Estimating the Revenue of a Russian DDoS Booter

#23

Post by akenn »

jswny wrote: post #15
lossolo wrote: post #14

Earlier quoted context omitted.

Use service like cloudflare, it's 250 dollars and you are UDP attacks completely free + a lot of TCP ones.

CloudFlare protection can be easily bypassed. These types of proxy services which offer decently cheap DDoS protection are fine for defending against small-time attacks, however, plenty of attackers have scripts capable of bypassing them.

What scripts are capable of bypassing CloudFlare/proxy services and how do they do it? Do they look for old DNS records that leak their Origin IP or something like that?

Re: Estimating the Revenue of a Russian DDoS Booter

#24

Post by mgo »

kyledrake wrote: post #8

Hi. I run a thing that uses a lot of bandwidth. Repeat after me: I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I've brought this u…

Cloudflare is cheap, and you can easily stick Cloudflare in front of your AWS/GCS boxes.

Re: Estimating the Revenue of a Russian DDoS Booter

#25

Post by takeda »

mgo wrote: post #24
kyledrake wrote: post #8

Hi. I run a thing that uses a lot of bandwidth. Repeat after me: I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I've brought this u…

Cloudflare is cheap, and you can easily stick Cloudflare in front of your AWS/GCS boxes.

That protects you from dumb attackers who don't understand how things work.

How will you protect the origin?

Re: Estimating the Revenue of a Russian DDoS Booter

#26

Post by kyledrake »

mgo wrote: post #24
kyledrake wrote: post #8

Hi. I run a thing that uses a lot of bandwidth. Repeat after me: I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I've brought this u…

Cloudflare is cheap, and you can easily stick Cloudflare in front of your AWS/GCS boxes.

The free and $20 plan doesn't cover all DDoS attacks. The real stuff costs more than I spend on my entire monthly infrastructure. For my use case, it would cost $6000/mo (I need wildcards and full DDoS mitigation). I'm sure $6k is cheap for someone, but it's not cheap for us.

Meanwhile, providers like OVH, Ramnode, Vultr and BuyVM offer various levels of integrated DDoS protection for their servers and VPS for free or a very reasonable cost ($5-10 per month). It's out there, you just need to look for it.

Re: Estimating the Revenue of a Russian DDoS Booter

#27

Post by Kephael »

akenn wrote: post #23
jswny wrote: post #15

Earlier quoted context omitted.

CloudFlare protection can be easily bypassed. These types of proxy services which offer decently cheap DDoS protection are fine for defending against small-time attacks, however, plenty of attackers have scripts capable of bypassing them.

What scripts are capable of bypassing CloudFlare/proxy services and how do they do it? Do they look for old DNS records that leak their Origin IP or something like that?

Frequently there will be MX records or something similar pointing directly to the server. Even error pages can potentially leak a direct, unprotected IP.

Re: Estimating the Revenue of a Russian DDoS Booter

#28

Post by scurvy »

fweespee_ch wrote: post #3
astrodust wrote: post #2

Under $100 for a large-scale DDOS attack is ridiculously cheap. It's no wonder these are getting freakishly common. Does anyone have a best-practices for dealing with the more modern variants?

There really isn't any beyond having a large pipe connected to a network device capable of filtering a high volume of pps. That has always been the problem with competently executed DDoS attacks. You need a very large pipe as Step #1 which is simply not cost effective for most businesses. :/

Actually there are providers which will sell you a port ACL as part of their DDoS mitigation service. These ACLs can block almost all of the BS volumetric attacks which will cripple you. Everything gets blocked on the provider side. NTT's pricing is especially reasonable. TWTC has a similar service.

Re: Estimating the Revenue of a Russian DDoS Booter

#29

Post by hrrsn »

Kephael wrote: post #27
akenn wrote: post #23

Earlier quoted context omitted.

What scripts are capable of bypassing CloudFlare/proxy services and how do they do it? Do they look for old DNS records that leak their Origin IP or something like that?

Frequently there will be MX records or something similar pointing directly to the server. Even error pages can potentially leak a direct, unprotected IP.

If your email is hosted on the same machine as your web server, I don't think DDoS attacks are your highest priority.

Re: Estimating the Revenue of a Russian DDoS Booter

#30

Post by jswny »

akenn wrote: post #23
jswny wrote: post #15

Earlier quoted context omitted.

CloudFlare protection can be easily bypassed. These types of proxy services which offer decently cheap DDoS protection are fine for defending against small-time attacks, however, plenty of attackers have scripts capable of bypassing them.

What scripts are capable of bypassing CloudFlare/proxy services and how do they do it? Do they look for old DNS records that leak their Origin IP or something like that?

There are two ways to bypass CloudFlare and related services. 1) Most of the time, as Kephael said, websites expose their back end IPs through subdomains like ssh.domain.com or ftp.domain.com. MX records also sometimes function in the same way. There are a variety of ways to resolve a domain through CloudFlare. 2) CloudFlare bypass scripts can be bought for around $400 which manipulate the JavaScript per client when sending an attack (mainly by disabling JavaScript). This prevents the so called "challenge pages" from blocking malicious traffic, effectively slipping through CloudFlare protection. Most of these scripts work on most other providers such as Sucuri as well.
Post reply on HN