Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The largest DDoS attack to date, peaking above 398M rps

cloud.google.com

Post reply on HN
Print view View original

481–487 of 487 posts

Re: The largest DDoS attack to date, peaking above 398M rps

#481

Post by dang »

zapdrive wrote: post #194
dudeinjapan wrote: post #33

Earlier quoted context omitted.

Was at Tokyo Disneyland today and taught my girlfriend the word “enshittification”. (i.e. making your customers pay via your stupid app to do literally anything in your park, and not even providing wi-fi.)

[flagged]

Since we just asked you to stop doing this and you just did it again, I've banned the account.

https://news.ycombinator.com/item?id=37817068

Not cool. And it's not as if you've lacked for warnings:

https://news.ycombinator.com/item?id=37202760 (Aug 2023)

https://news.ycombinator.com/item?id=35558080 (April 2023)

https://news.ycombinator.com/item?id=29923717 (Jan 2022)

https://news.ycombinator.com/item?id=29123203 (Nov 2021)

https://news.ycombinator.com/item?id=27216698 (May 2021)

https://news.ycombinator.com/item?id=26440096 (March 2021)

https://news.ycombinator.com/item?id=24562304 (Sept 2020)

https://news.ycombinator.com/newsguidelines.html

Re: The largest DDoS attack to date, peaking above 398M rps

#482

Post by saltminer »

OsrsNeedsf2P wrote: post #6
oldtownroad wrote: post #5

At a previous company, we were subject to semi-frequent attacks (of a much smaller scale). The operating assumption internally was that it’s a competitor trying to undermine us but it remains a mystery. Anyone involved in these type of attacks (at internet-infrastructure scale or targeting specific companies) brave/crazy enough to create a throwaway account and tell hn about the motivations?

We had a similar issue and assumed it was script kiddies having fun. Turns out someone (raises hand) wrote a really bad microservice who's inefficient queries sometimes triggered all our alerts.

Reminds me of a support ticket I had to investigate recently.

Performance metrics were taking a dive and triggered automated alerts - average response time jumped from 200ms to 2000, 8000, and eventually began approaching 15000, at which point requests were timing out all over the place. At first I was wondering if my recently-deployed MR was responsible, but upon further investigation, it was from one developer on another team doing two very dumb things with their application prototype:

- Constantly retrying the same query with no filtering and setting the maximum allowed page size

- Sending massive quantities of small queries for specific individuals (50-100 per second) which quickly hit the rate limit, and immediately resuming after the rate limit expired

Some developer outreach was required...

Re: The largest DDoS attack to date, peaking above 398M rps

#483

Post by rglullis »

89vision wrote: post #479
rglullis wrote: post #469

Earlier quoted context omitted.

Because the majority of sites run on/behind: - AWS - Cloudflare - Azure - GCP - Great Firewall of China Maybe there was some truth about "the world market for maybe five computers", after all...

Sure, I fail to see how that invalidates my point

What I am saying is that we are getting "scalable websites" today individually, but it has cost us overall resiliency because most of us all are hiding behind the big providers. I am not so sure if this is a good trade-off.

Re: The largest DDoS attack to date, peaking above 398M rps

#484

Post by averageRoyalty »

forward1 wrote: post #238
pythonguython wrote: post #219

Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it w…

If they're unsophisticated, it's for clout and "street cred" in hacking communities, no different than tagging a freeway overpass with graffiti. If they're advanced, they are doing it to test capabilities and responses. The Taliban used to pay kids to light off firecrackers outside base to check defensive TTPs. It also had the effect of desensitizing the sound of gunfire. Really good adversaries know how to accomplis…

Or... It's for fun. Are the 90s/00s that long ago? Not everything is about money and terrorism.

Bring back CotDC, MoD, even lulzsec. I miss the days of the internet being the open seas and everyone having their own fun on it, user beware.

Re: The largest DDoS attack to date, peaking above 398M rps

#485

Post by averageRoyalty »

dominicdoty wrote: post #218

Couldn't cloudflare show a page to the next handful of http requests from an IP informing the user that "something on your network is participating in DDoS attacks". All the big providers could do this, just inject a little turnstile like page in front of the next cloudflare site you visit. I would love to know if there's a compromised device on my network, and I don't have any real monitoring set up to detect it. It…

> All the big providers could do this, just inject a little turnstile like page in front of the next cloudflare site you visit.

Oh good. We can go back to the pre-HTTPS days where ISPs injected ads into HTML. Except this time we normalise it for the CDN provider.

Re: The largest DDoS attack to date, peaking above 398M rps

#486

Post by averageRoyalty »

codedokode wrote: post #370
DanAtC wrote: post #286

Earlier quoted context omitted.

The tier 1 & 2 ISPs I've worked with have a blackhole BGP community. https://www.rfc-editor.org/rfc/rfc7999.html

As I understand, "blackholing" is basically siding with criminals: attackers want the victim to get off the network, and by "blackholing" the network operator complies with their demand, which allows attackers to save resources. Everybody wins except for the victim.

Implementation dependent.

Normally for DDoS migitation, you blackhole on your normal ISP, and you simultaniously advertise on the mitigator. The mitigator scrubs the traffic and sends the clean stuff over a private session back to you.

If you just black hole and move on, yes that's a lose. However many ISPs will, because the quick reaction holds the most value for them.

Re: The largest DDoS attack to date, peaking above 398M rps

#487

Post by superjan »

menscher wrote: post #415
superjan wrote: post #297

Earlier quoted context omitted.

How? I suppose the most effective way is to have those proxies attack each other. But don’t, it’s likely illegal.

Get a few companies to agree that open proxies are a scourge that needs to be stopped. They each apply some action to open proxies (user-facing messaging, loss of functionality, captcha, or complete block), and the users of those proxies will get the problem fixed. The hard part (and it truly is hard!) is convincing a few companies to do this. It risks user complaints in the short term, to solve a problem that may no…

How about downgrading all connections from said proxies to http 1.1? This can be done in coordination, but it ought not to be too hard to embed such ‘graylisting’ functionality in a webserver.

(No I don’t expect any response but I am just leaving this thought for those who stumble on this thread in the future).

Post reply on HN