Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Azure hit by 15 Tbps DDoS attack using 500k IP addresses

bleepingcomputer.com

Post reply on HN
Print view View original

231–240 of 318 posts

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#231

Post by mrweasel »

bsder wrote: post #161
kundi wrote: post #154

Earlier quoted context omitted.

What difference would it make?

You can block the specific offending IPs without collateral damage. CGNATs reuse IPs so any IP block rule fairly quickly becomes somebody else's IP that you shouldn't be blocking. If, however, you use IPv6, you don't need CGNAT and, while addresses may change, a blocked address won't suddenly get recycled to an unsuspecting user. In addition, if the allocation is static, you can block the whole network range and the…

While it would allow us to be more specific with the IPs, it would entail blocking 500.000 IPs, or more. That quickly becomes unmanageable as well.

What I'd love to see is a service where websites could report abuse to ISPs, who would then take the misbehaving customers offline, until their system or behavior is fixed. Right now there's zero incentives to take customers offline, neither for ISP, nor cloud providers.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#232

Post by Etheryte »

fc417fc802 wrote: post #169
contravariant wrote: post #156

Earlier quoted context omitted.

This exchange is somewhat hilarious. Oh how on earth do we keep things safe and secure if everyone can see the code and verify what it does! Who would keep us safe if we turn our backs to unverifiable, unvetted, unprofitable security fixes, by for-profit companies!

> how on earth do we keep things safe and secure if everyone can see the code and verify what it does! That's not always the silver bullet you seem to think it is. Have you ever tried to build something like Chromium, Firefox, or LLVM yourself? It's not realistic to do that on a mid tier let alone low end device. Even when you go to the trouble of getting a local build set up, more often than not the build system imm…

For context, I once found a bug in Chromium and fixed it, the initial build took a few days on and off on my development laptop that was pretty beefy for the time. I say on and off because I had to interrupt the build if I wanted to do anything else computationally taxing. They have incremental builds and caches all properly set up so you can just continue where you left off after the fact. After the initial build it's pretty fast, 5 minutes or so per build for me. On a low end device you're easily looking at a build time of a week or more if you're starting from scratch.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#233

Post by fragmede »

anonym29 wrote: post #140
Aachen wrote: post #130

Earlier quoted context omitted.

When the deed is illegal in both places, they can be tried under either jurisdiction and convicted instead of continuing to roam free and fuck up the open web for everyone else. Yes I do think we'd want that Borders currently get in the way but we needn't have law enforcement on foreign soil to solve that. Exchanging information and reliably acting upon it could be all these agencies need to do in their respective co…

Bad news, implied criticism of CCP policy (by acknowledging you'd change it) is an imprisonable offense. You're under arrest for violating the laws of China. You are not granted a trial. A joint unit comprised of the Ministry of State Security and the FBI will be at your house to pick you up and fly you to a Chinese black site tomorrow morning.

That’s the cartoon version of China you’ve been trained to believe. I’m talking about dual illegality and cooperation between states. You’re talking about a fantasy mashup of MSS and FBI black sites. Not the same thing.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#234

Post by lukan »

anamexis wrote: post #195
hansvm wrote: post #180

Earlier quoted context omitted.

Ballpark math says you could sustain it for half an hour on Hetzner for $5k-$6k (only from 1500 IPs though), at least if your account didn't get banned first and you're halfway decent at network programming. I have no idea what a proper botnet like this costs though or how large the profit margins are.

Isn't the idea behind botnets that no one is paying for the bandwidth, besides the unsuspecting random people who have fallen victim to malware? I'd imagine the pricing is quite disconnected from the price of "legitimate" bandwidth. But I don't know in what direction.

The idea is, the botnets are in control of someone else. Who "owns" them. And some of those will rent "their property" for money, like they would legitimately own them.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#235

Post by sunaookami »

averageRoyalty wrote: post #88

> This attack lasted only 40 seconds but was roughly equivalent to streaming one million 4K videos simultaneously. Who is this for? Is there anyone reading the article that can't grasp what a terrabit is but can somehow conceptualise one million 4k videos streaming simultaneously? I don't think anyone sits in that venn diagram.

Well I found it helpful for putting it into perspective.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#236

Post by arkh »

haunter wrote: post #98

This is what I don't get >The Aisuru DDoS botnet operates as a DDoS-for-hire service with restricted clientele; operators have reportedly implemented preventive measures to avoid attacking governmental, law enforcement, military, and other national security properties. Most observed Aisuru attacks to date appear to be related to online gaming. https://www.netscout.com/blog/asert/asert-threat-summary-ais... So why? Li…

> What's the benefit of taking down an online game for a couple of hours.

Competitive MMO. Imagine some event is setup to start at some time and your guild or alliance knows they're gonna lose it and the resource it gives: DDOS the server so it's down during the event so it does not run. Enjoy the fact you kept the asset linked to said event and sell the resources you get for real money.

If you've never played those kind of games you cannot fathom how cutthroat they can become. I'm part of a guild which has a specific intelligence branch with spies embedded in many other guilds and that's playing nice because we're not selling anything.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#237

Post by rasz »

sabatonfan wrote: post #174
denkmoon wrote: post #101

Earlier quoted context omitted.

Mad salt. Imagine a fully grown man having a toddler tantrum. "If I can't play/win/get my way, nobody can" type mentality. It's also a method of coercion. Give me mod status or I'll DDOS your server and destroy your community. The other half comes from sever operators ddosing their competition. There is a lot of money to be made from paid cosmetics, ranks, moderator (demi-tyrant) status, etc on custom servers.

What you are saying fits perfectly well in minecraft communities. Are you mentioning the minecraft community by your message or any other gaming communities too

https://en.wikipedia.org/wiki/Mirai_(malware) came from Minecraft community.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#238

Post by GaryNumanVevo »

Uptrenda wrote: post #187

Man, if you had that many nodes can you guys imagine how much cool tech you could build with that? Like you could literally rival Tor with one command. Or build a decentralized archive system. Yet, the only thing these nodes will end up doing is being used to prop up some losers ego. Literally what a waste. If you're going to commit crime at least do something cool.

Most of the compromised devices are routers or IoT devices, functionally no compute power to do anything interesting except spam IPs with requests.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#239

Post by rasz »

victorbjorklund wrote: post #124
supportengineer wrote: post #16

I will never understand why there isn’t an international law enforcement agency with teeth, which can get rid of the bad actors.

do you really think for example America would allow say Chinese prosecutors to arrest Americans on American soil and take them abroad to sentence them in a court that America has no influence over and then throw them in a prison which America doesn’t control?

>America would allow say Chinese

for at least 6 months

https://www.bbc.com/news/articles/c785n9pexjpo

https://www.justice.gov/archives/opa/pr/new-york-resident-pl...

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#240

Post by bsder »

mrweasel wrote: post #231
bsder wrote: post #161

Earlier quoted context omitted.

You can block the specific offending IPs without collateral damage. CGNATs reuse IPs so any IP block rule fairly quickly becomes somebody else's IP that you shouldn't be blocking. If, however, you use IPv6, you don't need CGNAT and, while addresses may change, a blocked address won't suddenly get recycled to an unsuspecting user. In addition, if the allocation is static, you can block the whole network range and the…

While it would allow us to be more specific with the IPs, it would entail blocking 500.000 IPs, or more. That quickly becomes unmanageable as well. What I'd love to see is a service where websites could report abuse to ISPs, who would then take the misbehaving customers offline, until their system or behavior is fixed. Right now there's zero incentives to take customers offline, neither for ISP, nor cloud providers.

> it would entail blocking 500.000 IPs, or more. That quickly becomes unmanageable as well.

Companies don't seem to have a tough time managing the blocks for all the various ranges of all the VPS providers to prevent you from using VPNs to access their services. Somehow, I don't think blocking 500,000 IPs is a technical problem.

I also suspect that once you start getting effective IP blocking, that 500,000 number will drop quite rapidly as it simply won't be so profitable to commandeer a device.

> What I'd love to see is a service where websites could report abuse to ISPs, who would then take the misbehaving customers offline, until their system or behavior is fixed.

IPv4 CGNAT is part of that problem, too. Because of CGNAT, the offending IPs get "tumbled" and are more difficult to identify from outside the ISP. Consequently, it makes it difficult to punish the ISPs. Without IPv4 CGNAT, those IPs are more stable over time and can be identified outside the ISP boundary. If ISPs start losing customers because everybody in the universe has blocked various ranges, the ISPs will start blocking devices at origin.

Post reply on HN