Original link: https://blog.qrator.net/en/meris-botnet-climbing-to-the-reco...
Very difficult or slow to load for me:
> https://archive.is/RLkSX
Mēris botnet, climbing to the record
31–40 of 61 posts
Re: Mēris botnet, climbing to the record
#32To block something like this you need to determine what is botnet traffic vs legit traffic. It's hard. Source IP doesn't work since it is random and changes. You need to look at things such as HTTP headers, TCP window and any odd flags that might be set. If you're lucky the botnet isn't capable of running a copy of Chrome or Safari or using a random sample template from legit traffic. Lots of botnets are made up of l…
Introducing javascript into the mix will not make the botnet more difficult to detect. Headless browsers have their own fingerprints which allow defenders to identify them from legitimate traffic. You can spoof the features that headless browsers don't have but that will always be a cat and mouse game.
Re: Mēris botnet, climbing to the record
#33Can someone please explain-like-I'm-not-versed-in-botnets?
DDoS attacks like this are usually launched from large number of malware ridden personal computers. Since the attacks are coming from an IP addresses on a residential network they're very hard to differentiate from legitimate traffic. What's different about this attack is that it appears to not be PCs but network devices (routers) that are being taken over and used to launch attacks. People are much less likely to ca…
Great explanation...
For anyone interested, the following jupyter notebook explains three different ways to process HTTP requests: serial requests (the baseline), pipelined requests and parallel requests with multiple connections (and without threads).
Re: Mēris botnet, climbing to the record
#34[deleted]
Re: Mēris botnet, climbing to the record
#35Earlier quoted context omitted.
Thanks for linking to this. Given the amount of misinformation in infosec, we should not be linking to intermediate sources for this kind of story.
Well, it's the same article officially posted by the same company on a community site.
Right. I don't think conscientious HN readers should have to check this.
Re: Mēris botnet, climbing to the record
#36To block something like this you need to determine what is botnet traffic vs legit traffic. It's hard. Source IP doesn't work since it is random and changes. You need to look at things such as HTTP headers, TCP window and any odd flags that might be set. If you're lucky the botnet isn't capable of running a copy of Chrome or Safari or using a random sample template from legit traffic. Lots of botnets are made up of l…
I think in future servers will ask clients to solve a small computation. It can be theoretically incorporated into the handshake and if it takes something like 100ms, human users would not notice but botfarms will feel the pinch. An additional benefit is that servers can monetise the computation offsetting some of their costs.
Re: Mēris botnet, climbing to the record
#37To block something like this you need to determine what is botnet traffic vs legit traffic. It's hard. Source IP doesn't work since it is random and changes. You need to look at things such as HTTP headers, TCP window and any odd flags that might be set. If you're lucky the botnet isn't capable of running a copy of Chrome or Safari or using a random sample template from legit traffic. Lots of botnets are made up of l…
I think in future servers will ask clients to solve a small computation. It can be theoretically incorporated into the handshake and if it takes something like 100ms, human users would not notice but botfarms will feel the pinch. An additional benefit is that servers can monetise the computation offsetting some of their costs.
we need something like anonymized identity. Something that can prove you are human being, but without requiring your personal data.
Re: Mēris botnet, climbing to the record
#38Earlier quoted context omitted.
But how do you distinguish an abnormal traffic spike (HN hug-of-death) vs a botnet? Cloudflare’s solution is a CAPTCHA, but are there better options?
Cloudflare's solution is not a CAPTCHA. We have a ton of stuff going on that detects bots. CAPTCHAs are a small part of the tools we use. https://blog.cloudflare.com/cloudflare-bot-management-machin...
Sorry. I didn’t mean to imply that you don’t have anything but CAPTCHAs. My wording could’ve been better.
Re: Mēris botnet, climbing to the record
#39To block something like this you need to determine what is botnet traffic vs legit traffic. It's hard. Source IP doesn't work since it is random and changes. You need to look at things such as HTTP headers, TCP window and any odd flags that might be set. If you're lucky the botnet isn't capable of running a copy of Chrome or Safari or using a random sample template from legit traffic. Lots of botnets are made up of l…
I think in future servers will ask clients to solve a small computation. It can be theoretically incorporated into the handshake and if it takes something like 100ms, human users would not notice but botfarms will feel the pinch. An additional benefit is that servers can monetise the computation offsetting some of their costs.
This was a mainstream idea when I was in CS school 12 years ago. There are creative alternatives too, eg. by requiring the client to complete a network scavenger hunt: https://people.cs.pitt.edu/~adamlee/pubs/2012/abliz2012ijas....
Re: Mēris botnet, climbing to the record
#40Earlier quoted context omitted.
I think in future servers will ask clients to solve a small computation. It can be theoretically incorporated into the handshake and if it takes something like 100ms, human users would not notice but botfarms will feel the pinch. An additional benefit is that servers can monetise the computation offsetting some of their costs.
we need something like anonymized identity. Something that can prove you are human being, but without requiring your personal data.
Thumb print reader that pricks you to make sure you bleed.