Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Azure hit by 15 Tbps DDoS attack using 500k IP addresses

bleepingcomputer.com

Post reply on HN
Print view View original

251–260 of 318 posts

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#251

Post by littlestymaar »

razakel wrote: post #241
arkh wrote: post #236

Earlier quoted context omitted.

> What's the benefit of taking down an online game for a couple of hours. Competitive MMO. Imagine some event is setup to start at some time and your guild or alliance knows they're gonna lose it and the resource it gives: DDOS the server so it's down during the event so it does not run. Enjoy the fact you kept the asset linked to said event and sell the resources you get for real money. If you've never played those…

EVE Online had to put their foot down when people were talking about what could easily be considered terrorism.

Please tell us more, I need to hear the story!

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#253

Post by helsinkiandrew »

> by exploiting compromised home routers and cameras, mainly in residential ISPs in the United States and other countries,

Presumably it’s possible to log the residential IP of the source of these packets.

Why isn’t there any industry group pushing for the ISPs to a) send the owners an email telling them or b) blocking off all traffic for a period to get them to do something - or is the economic cost higher than caused by the DDoS attacks?

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#255

Post by executesorder66 »

estearum wrote: post #50
kachapopopow wrote: post #49

Earlier quoted context omitted.

we were getting hit with attacks like this daily at some point and were forced to use cloudflare magic transit it's pretty random and you shouldn't read too deep into it as nearly every anti-ddos solution, host and isp has been hit with this botnet by now.

but why? For fun?

So that cloudflare can now MITM their HTTPS encryption. /s

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#256

Post by matt-p »

helsinkiandrew wrote: post #253

> by exploiting compromised home routers and cameras, mainly in residential ISPs in the United States and other countries, Presumably it’s possible to log the residential IP of the source of these packets. Why isn’t there any industry group pushing for the ISPs to a) send the owners an email telling them or b) blocking off all traffic for a period to get them to do something - or is the economic cost higher than caus…

The economic costs of that fall on the (residential) ISPs and they aren't really incurring very much cost in additional bandwidth from the outgoing attacks. In most cases it will be 0. It's not 'good', as it could affect quality to a certain extent for other subscribers and it's theoretically possible it could result in a slightly higher transit bill, but ultimately it's just not really a problem for them.

Setting up the infrastructure to email customers and tell them they've got an infected device is just going to cause the subscriber to: A) Call customer support and tie up an agent who can't really tell them much - you're also going to have to train all your CS agents on these letters and what they mean. B) Complain on faceybook/Churn off your network. or C) They'll ignore it

About one in a million will fix the issue themselves.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#257

Post by mrweasel »

helsinkiandrew wrote: post #253

> by exploiting compromised home routers and cameras, mainly in residential ISPs in the United States and other countries, Presumably it’s possible to log the residential IP of the source of these packets. Why isn’t there any industry group pushing for the ISPs to a) send the owners an email telling them or b) blocking off all traffic for a period to get them to do something - or is the economic cost higher than caus…

That industry group would need to include the big cloud providers, and they also doesn't want to shut of abusive traffic.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#258

Post by ramon156 »

helsinkiandrew wrote: post #253

> by exploiting compromised home routers and cameras, mainly in residential ISPs in the United States and other countries, Presumably it’s possible to log the residential IP of the source of these packets. Why isn’t there any industry group pushing for the ISPs to a) send the owners an email telling them or b) blocking off all traffic for a period to get them to do something - or is the economic cost higher than caus…

This already happens in the Netherlands, your router will be put in quarantine mode and you have to prove that the "virus" is gone

This happened to me, at the time I thought it was strange but seeing this event happen it makes a lot more sense now

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#260

Post by elAhmo »

nine_k wrote: post #72
shoddydoordesk wrote: post #18

> it suddenly ballooned in size in April 2025 after its operators breached a TotoLink router firmware update server and infected approximately 100,000 devices This is scary. Everyone lauds open source projects like OpenWRT but... who is watching their servers? I imagine you can't run an army of security people on donations and a shoestring budget. Does OpenWRT use digital signing to mitigate this?

Why, OpenWRT firmware and packages are both signed, of course. You can manually and independently check the image signature before flashing an update. The build infrastructure is, of course, a juicy target: infect the artifact after building but before signing, and pwn millions of boxes before this is detected. This is why bit-perfect reproducible builds are so important. OpenWRT in particular have that: https://open…

> You can manually and independently check the image signature before flashing an update.

Of course you can. You can also read the ToS before clicking accept, but who does that?

Post reply on HN