Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mēris botnet, climbing to the record

blog.qrator.net

Post reply on HN
Print view View original

41–50 of 61 posts

Re: Mēris botnet, climbing to the record

#41

Post by EvanAnderson »

potamic wrote: post #36
jtchang wrote: post #19

To block something like this you need to determine what is botnet traffic vs legit traffic. It's hard. Source IP doesn't work since it is random and changes. You need to look at things such as HTTP headers, TCP window and any odd flags that might be set. If you're lucky the botnet isn't capable of running a copy of Chrome or Safari or using a random sample template from legit traffic. Lots of botnets are made up of l…

I think in future servers will ask clients to solve a small computation. It can be theoretically incorporated into the handshake and if it takes something like 100ms, human users would not notice but botfarms will feel the pinch. An additional benefit is that servers can monetise the computation offsetting some of their costs.

Wouldn't bot farms just incorporate that as a "cost of doing business" and expand to absorb the computational load? After all, it's not like the bot farmers are paying to add more hardware.

Re: Mēris botnet, climbing to the record

#42

Post by geitir »

jgrahamc wrote: post #30
colejohnson66 wrote: post #22

Earlier quoted context omitted.

But how do you distinguish an abnormal traffic spike (HN hug-of-death) vs a botnet? Cloudflare’s solution is a CAPTCHA, but are there better options?

Cloudflare's solution is not a CAPTCHA. We have a ton of stuff going on that detects bots. CAPTCHAs are a small part of the tools we use. https://blog.cloudflare.com/cloudflare-bot-management-machin...

Do you have a scraper that looks for mentions of Cloudflare or did you just happen upon this?

Re: Mēris botnet, climbing to the record

#45

Post by jgrahamc »

geitir wrote: post #42
jgrahamc wrote: post #30

Earlier quoted context omitted.

Cloudflare's solution is not a CAPTCHA. We have a ton of stuff going on that detects bots. CAPTCHAs are a small part of the tools we use. https://blog.cloudflare.com/cloudflare-bot-management-machin...

Do you have a scraper that looks for mentions of Cloudflare or did you just happen upon this?

Yeah. I use something like this: https://github.com/jgrahamc/hncomments

Although I really need to commit the final version as that one isn't quite what I use.

Re: Mēris botnet, climbing to the record

#47

Post by mleonhard »

jgrahamc wrote: post #30
colejohnson66 wrote: post #22

Earlier quoted context omitted.

But how do you distinguish an abnormal traffic spike (HN hug-of-death) vs a botnet? Cloudflare’s solution is a CAPTCHA, but are there better options?

Cloudflare's solution is not a CAPTCHA. We have a ton of stuff going on that detects bots. CAPTCHAs are a small part of the tools we use. https://blog.cloudflare.com/cloudflare-bot-management-machin...

Cloudflare uses CAPTCHA to drive away proxy users. Privacy conflicts with Cloudflare's endgame of profiling every Internet user and then monetizing that data.

Re: Mēris botnet, climbing to the record

#48

Post by achillean »

jtchang wrote: post #19

To block something like this you need to determine what is botnet traffic vs legit traffic. It's hard. Source IP doesn't work since it is random and changes. You need to look at things such as HTTP headers, TCP window and any odd flags that might be set. If you're lucky the botnet isn't capable of running a copy of Chrome or Safari or using a random sample template from legit traffic. Lots of botnets are made up of l…

In cases like this it's actually not that difficult as they're using devices that can be fingerprinted from the Internet. We at Shodan provide a local, embedded database (SQLite or RocksDB) so you can see which open ports connecting IPs have. If an IP is connecting from a device that's running weird ports, is compromised or has other unusual characteristics then you can either flag the connection as high risk or outright drop it if you're under attack. It's mostly used by banks etc. for fraud prevention but we have a few that use it for blocking traffic based on IP risk.

Re: Mēris botnet, climbing to the record

#50

Post by jtchang »

achillean wrote: post #48
jtchang wrote: post #19

To block something like this you need to determine what is botnet traffic vs legit traffic. It's hard. Source IP doesn't work since it is random and changes. You need to look at things such as HTTP headers, TCP window and any odd flags that might be set. If you're lucky the botnet isn't capable of running a copy of Chrome or Safari or using a random sample template from legit traffic. Lots of botnets are made up of l…

In cases like this it's actually not that difficult as they're using devices that can be fingerprinted from the Internet. We at Shodan provide a local, embedded database (SQLite or RocksDB) so you can see which open ports connecting IPs have. If an IP is connecting from a device that's running weird ports, is compromised or has other unusual characteristics then you can either flag the connection as high risk or outr…

How does fingerprinting them help? You can fingerprint them but they are just desktops/mobile phones/laptops that have been compromised to be part of the botnet.

The compromised hosts that are part of the botnet look exactly like normal traffic.

Post reply on HN