Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

TP240PhoneHome Reflection/Amplification DDoS Attack Vector

akamai.com

Post reply on HN
Print view View original

21–30 of 90 posts

Re: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

#21

Post by user-the-name »

black_puppydog wrote: post #15
frays wrote: post #8

Is it just me, or does it seem crazy that we all just accept that private businesses are obligated to protect themselves from state-sponsored hacking? Imagine if Wal-Mart had to fund a private air force and patrol over their stores in order to combat foreign bombers coming in and everyone was like, "Yeah, that's just how it goes." Isn't a primary responsibility of government to protect its citizens and businesses fro…

Sorry but Walmart has cameras, guards, and most importantly locked windows and doors. Just because nobody has figured out (or bothered to invest into) building the equivalent of basic security doesn't mean it's the state's responsibility. It is the government's responsibility to make sure companies take their responsibilities of protecting their customers' data, and the internet more broadly from the impact of the co…

No post body was provided.

Re: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

#22

Post by temp8964 »

black_puppydog wrote: post #15
frays wrote: post #8

Is it just me, or does it seem crazy that we all just accept that private businesses are obligated to protect themselves from state-sponsored hacking? Imagine if Wal-Mart had to fund a private air force and patrol over their stores in order to combat foreign bombers coming in and everyone was like, "Yeah, that's just how it goes." Isn't a primary responsibility of government to protect its citizens and businesses fro…

Sorry but Walmart has cameras, guards, and most importantly locked windows and doors. Just because nobody has figured out (or bothered to invest into) building the equivalent of basic security doesn't mean it's the state's responsibility. It is the government's responsibility to make sure companies take their responsibilities of protecting their customers' data, and the internet more broadly from the impact of the co…

How can Walmart defend itself from foreign government's attack, with cameras, guards, and most importantly locked windows and doors?

Defending internet infrastructure from foreign government's attack is not "basic security".

Re: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

#23

Post by kube-system »

frays wrote: post #8

Is it just me, or does it seem crazy that we all just accept that private businesses are obligated to protect themselves from state-sponsored hacking? Imagine if Wal-Mart had to fund a private air force and patrol over their stores in order to combat foreign bombers coming in and everyone was like, "Yeah, that's just how it goes." Isn't a primary responsibility of government to protect its citizens and businesses fro…

The US government does do quite a bit to protect their citizens from electronic attacks. There are organizations like CISA and NIST that do a lot of work to help prevent attacks, and the FBI and DOJ do a lot of investigate and enforcement work after the fact.

For example:

https://www.fbi.gov/investigate/cyber/partnerships

https://www.cisa.gov/stopransomware/ransomware-guide

Re: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

#24

Post by actually_a_dog »

black_puppydog wrote: post #15
frays wrote: post #8

Is it just me, or does it seem crazy that we all just accept that private businesses are obligated to protect themselves from state-sponsored hacking? Imagine if Wal-Mart had to fund a private air force and patrol over their stores in order to combat foreign bombers coming in and everyone was like, "Yeah, that's just how it goes." Isn't a primary responsibility of government to protect its citizens and businesses fro…

Sorry but Walmart has cameras, guards, and most importantly locked windows and doors. Just because nobody has figured out (or bothered to invest into) building the equivalent of basic security doesn't mean it's the state's responsibility. It is the government's responsibility to make sure companies take their responsibilities of protecting their customers' data, and the internet more broadly from the impact of the co…

You're missing one thing though: North Korea doesn't rob Walmarts. Expecting private entities to be able to stand up to the kind of attack a hostile nation state can muster is unrealistic, and, quite frankly, probably a drag on the economy.

Besides, what ever happened to "provid[ing] for the common defense?"

Re: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

#25

Post by mschuster91 »

black_puppydog wrote: post #15
frays wrote: post #8

Is it just me, or does it seem crazy that we all just accept that private businesses are obligated to protect themselves from state-sponsored hacking? Imagine if Wal-Mart had to fund a private air force and patrol over their stores in order to combat foreign bombers coming in and everyone was like, "Yeah, that's just how it goes." Isn't a primary responsibility of government to protect its citizens and businesses fro…

Sorry but Walmart has cameras, guards, and most importantly locked windows and doors. Just because nobody has figured out (or bothered to invest into) building the equivalent of basic security doesn't mean it's the state's responsibility. It is the government's responsibility to make sure companies take their responsibilities of protecting their customers' data, and the internet more broadly from the impact of the co…

The correct equivalency would be the roads leading to the Walmart. If a Walmart were blocked by people pointlessly driving on the road to make the Walmart effectively unreachable, police would intervene and clear the road of the noise.

Re: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

#26

Post by LinuxBender »

londons_explore wrote: post #5

Tracking down these systems is easy, so these issues can normally be solved pretty easily. Thats because typically any amplification vector doesn't allow the source IP of the amplifier to be spoofed. So as soon as a DDoS attack begins, a sample of the packets can be taken to get a list of the amplifiers used. Those can then be tracked down and patched to no longer act as amplifiers.

Let's get started! [1][2] You wanna take the odd numbered IP's and I take the even? Just kidding I am way too lazy for this

[1] - https://www.shodan.io/search?query=mitel

[2] - https://www.shodan.io/search?query=mivoice

Re: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

#27

Post by tyingq »

rocqua wrote: post #16
tyingq wrote: post #12

Earlier quoted context omitted.

I guess it depends on the analogy, and whether physical location means anything for the internet. Piracy of commercial ships, for example.

That is also very much a problem where states are expected to intervene.

It seems similar to me. They sometimes intervene, but often don't.

Re: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

#28

Post by mschuster91 »

frays wrote: post #8

Is it just me, or does it seem crazy that we all just accept that private businesses are obligated to protect themselves from state-sponsored hacking? Imagine if Wal-Mart had to fund a private air force and patrol over their stores in order to combat foreign bombers coming in and everyone was like, "Yeah, that's just how it goes." Isn't a primary responsibility of government to protect its citizens and businesses fro…

Indeed. We definitely need laws to hold companies accountable for their IT-related activity.

For one, we need to hold commercial vendors accountable - that means especially to refuse to provide security updates for the reasonably expected life time of a piece of software or hardware.

But especially, we need the companies using IT systems to be held accountable. The magic word is "defense in depth" - the scenario of the post we're talking about is a piece of equipment that was not supposed to be reachable from the Internet and despite that knowledge it was made accessible to the Internet. Seriously, anyone caught exposing dangerous stuff to Shodan should be fined to hell and back. Or to continue using your military comparison: most governments have laws that call for harsh punishment for "aid to the enemy" or similar. Time to update the law to the new digital world.

Re: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

#29

Post by api »

I'm really concerned that DDOS attacks are going to lead to the death of the open Internet and its balkanization and isolation behind walled gardens. If you look at where Cloudflare and some of the big clouds are going with their private networks, private backplanes, and "secure your traffic by putting it all over our network" zero trust plans it seems to be going that way.

If open peering and the open Internet are to survive I think serious work needs to be done to fight DDOS attacks. It needs to be an effort analogous to the "war on spam" in the late 1990s / early 2000s. Unfortunately that war was sort of lost; e-mail is in practice barely an open protocol anymore and almost all e-mail is handled by a few giant companies that can leverage big data to filter spam. If you try to DIY a mail server you'll be simultaneously hit by spam and have to constantly fight mistaken filtration by larger e-mail providers who tend to distrust small mail servers by default.

If the open Internet succumbs to DDOS "spam," we will lose something really huge and important. It would be the ultimate casualty of what so far has been almost a law (with very few exceptions): all open systems are destroyed by abuse if they become sufficiently popular.

We also can't just leave it to the free market because the only solution the market will likely come up with is walled gardens. It's the easiest to engineer solution and the easiest to monetize.

Re: TP240PhoneHome Reflection/Amplification DDoS Attack Vector

#30

Post by jwilk »

nathanyz wrote: post #7
zaik wrote: post #3

Earlier quoted context omitted.

Why would there be a theoretical limit?

Limit would end up being when you send 1 byte of traffic to a box and that box amplifies it to whatever its own max outbound bandwidth rate is. This seems like it would exceed that in many cases, since 1 byte in => 4.2 gigabytes out. Which is roughly 33.6 gbps. Not sure many of these vulnerable boxes actually have that amount of outbound bandwidth to utilize. (Please feel free to correct my quick math if I messed it…

Why do you want to send everything in one second?
Post reply on HN