Mēris botnet, climbing to the record • Hacker News Board

Re: Mēris botnet, climbing to the record

#21

Post by ogurechny » Thu, Sep 09, 2021, 3:27 PM UTC

datameta wrote: post #2

Can someone please explain-like-I'm-not-versed-in-botnets?

0. There seems to be a MikroTik exploit, and all versions are vulnerable. Well, it possible that someone collected the passwords back in 2018, and used them to access updated devices this year, but I guess naaah.

I wonder what should happen to that fine company to make them stop running all the potentially vulnerable system configuration services on all interfaces by default. IP > Services is one of the locations anyone should check ASAP to make sure unneeded ones are disabled, but it's actually misleading. These are just preconfigured wrappers for some components, and others, like DNS or bandwidth test server mentioned in the article, are not shown even if they are running. There isn't even a netstat-like command to check which ports are open.

1. While reaching a record number, the attack against something on the scale of Yandex and Cloudflare is more of a maximum capacity test not limited by target's connectivity, and/or an advertisement for someone's DDoS services.

2. Still, it's an application-level DDoS, so you have to have a swift application-level detection in place if you don't want to just ban IP addresses (and potentially cut legal users from HTTP(S) APIs and other services that might be shared on the server or network).

3. Some skill was demonstrated in finding no-trivial weak points to amplify the server load.

Re: Mēris botnet, climbing to the record

#22

Post by colejohnson66 » Thu, Sep 09, 2021, 3:42 PM UTC

PragmaticPulp wrote: post #16

20 million requests per second from a single beefy AWS server is easy to detect and block. 20 million requests per second coming from a rotating list of hosts from generic IP addresses is a nightmare: > However, we suppose the number to be higher – probably more than 200 000 devices, due to the rotation and absence of will to show the "full force" attacking at once. If your site normally has 10,000 users per day and…

But how do you distinguish an abnormal traffic spike (HN hug-of-death) vs a botnet? Cloudflare’s solution is a CAPTCHA, but are there better options?

Re: Mēris botnet, climbing to the record

#23

Post by aj3 » Thu, Sep 09, 2021, 3:42 PM UTC

jtchang wrote: post #19

To block something like this you need to determine what is botnet traffic vs legit traffic. It's hard. Source IP doesn't work since it is random and changes. You need to look at things such as HTTP headers, TCP window and any odd flags that might be set. If you're lucky the botnet isn't capable of running a copy of Chrome or Safari or using a random sample template from legit traffic. Lots of botnets are made up of l…

This attack was 20m requests per second, not 100k.

Re: Mēris botnet, climbing to the record

#24

Post by aj3 » Thu, Sep 09, 2021, 3:45 PM UTC

PragmaticPulp wrote: post #16

20 million requests per second from a single beefy AWS server is easy to detect and block. 20 million requests per second coming from a rotating list of hosts from generic IP addresses is a nightmare: > However, we suppose the number to be higher – probably more than 200 000 devices, due to the rotation and absence of will to show the "full force" attacking at once. If your site normally has 10,000 users per day and…

Thankfully these attackers haven't heard about Layer 7 attacks yet.

Re: Mēris botnet, climbing to the record

#25

Post by aj3 » Thu, Sep 09, 2021, 3:46 PM UTC

colejohnson66 wrote: post #22

PragmaticPulp wrote: post #16

20 million requests per second from a single beefy AWS server is easy to detect and block. 20 million requests per second coming from a rotating list of hosts from generic IP addresses is a nightmare: > However, we suppose the number to be higher – probably more than 200 000 devices, due to the rotation and absence of will to show the "full force" attacking at once. If your site normally has 10,000 users per day and…

But how do you distinguish an abnormal traffic spike (HN hug-of-death) vs a botnet? Cloudflare’s solution is a CAPTCHA, but are there better options?

Generally you don't. Just be prepared to scale resources and handle everyone.

Re: Mēris botnet, climbing to the record

#26

Post by ogurechny » Thu, Sep 09, 2021, 3:47 PM UTC

chalst wrote: post #20

FrankSansC wrote: post #9

Original link: https://blog.qrator.net/en/meris-botnet-climbing-to-the-reco...

Thanks for linking to this. Given the amount of misinformation in infosec, we should not be linking to intermediate sources for this kind of story.

Well, it's the same article officially posted by the same company on a community site.

Re: Mēris botnet, climbing to the record

#27

Post by nik41tkins » Thu, Sep 09, 2021, 3:48 PM UTC

datameta wrote: post #14

junon wrote: post #13

Earlier quoted context omitted.

It is not clear to us which information is not clear to you.

I would like to understand the significance of each bullet point under "Specific features of Mēris botnet".

The main point of this article seems to be to highlight the 20 million requests per second arbitrary metric.

Otherwise the bullet points are about the functionality in place in the infected clients. The port is likely a detection metric for infected clients.

Re: Mēris botnet, climbing to the record

#28

Post by ximaera » Thu, Sep 09, 2021, 4:01 PM UTC

aj3 wrote: post #24

PragmaticPulp wrote: post #16

20 million requests per second from a single beefy AWS server is easy to detect and block. 20 million requests per second coming from a rotating list of hosts from generic IP addresses is a nightmare: > However, we suppose the number to be higher – probably more than 200 000 devices, due to the rotation and absence of will to show the "full force" attacking at once. If your site normally has 10,000 users per day and…

Thankfully these attackers haven't heard about Layer 7 attacks yet.

They have. These are 20 million Layer 7 requests per second.

Re: Mēris botnet, climbing to the record

#29

Post by smasher164 » Thu, Sep 09, 2021, 4:06 PM UTC

colejohnson66 wrote: post #22

PragmaticPulp wrote: post #16

20 million requests per second from a single beefy AWS server is easy to detect and block. 20 million requests per second coming from a rotating list of hosts from generic IP addresses is a nightmare: > However, we suppose the number to be higher – probably more than 200 000 devices, due to the rotation and absence of will to show the "full force" attacking at once. If your site normally has 10,000 users per day and…

But how do you distinguish an abnormal traffic spike (HN hug-of-death) vs a botnet? Cloudflare’s solution is a CAPTCHA, but are there better options?

An attack-resistant trust metric? Although I haven’t seen them used against denial of service attacks.

Re: Mēris botnet, climbing to the record

#30

Post by jgrahamc » Thu, Sep 09, 2021, 4:15 PM UTC

colejohnson66 wrote: post #22

PragmaticPulp wrote: post #16

20 million requests per second from a single beefy AWS server is easy to detect and block. 20 million requests per second coming from a rotating list of hosts from generic IP addresses is a nightmare: > However, we suppose the number to be higher – probably more than 200 000 devices, due to the rotation and absence of will to show the "full force" attacking at once. If your site normally has 10,000 users per day and…

But how do you distinguish an abnormal traffic spike (HN hug-of-death) vs a botnet? Cloudflare’s solution is a CAPTCHA, but are there better options?

Cloudflare's solution is not a CAPTCHA. We have a ton of stuff going on that detects bots. CAPTCHAs are a small part of the tools we use. https://blog.cloudflare.com/cloudflare-bot-management-machin...