Fastmail, Runbox, and Posteo under DDoS extortion attack

Post by gsich » Sat, Oct 23, 2021, 4:27 PM UTC

kijin wrote: post #49

birdman914 wrote: post #44

Earlier quoted context omitted.

You are correct on the ISP level. I am a network engineer for an ISP, we utilize Corero to monitor and mitigate DDoS attacks into our network. Since 99% of the time the DDoS is not targeted to us but rather the customer, I also kill the active IP addressing to their Modem/ONT, and configure that endpoint so it isn't allowed to pull an IP. Once the attack stops, re-config the endpoint and have it pull a new address.

Doesn't that simply mean that the customer loses connectivity, just as the attacker intended, for the duration of the attack? From the ISP's point of view, you might have prevented an overload that could have affected other customers. From the customer's point of view, their service was denied all the same. Doesn't sound like anything has improved compared to 10-20 years ago.

Post by Wronnay » Sat, Oct 23, 2021, 4:33 PM UTC

Post by [deleted] » Sat, Oct 23, 2021, 4:36 PM UTC

__s wrote: post #32

TacticalCoder wrote: post #24

We still hear about DDoS attacks like this once in a while but it seems it's not anywhere near as common as it used to be. What happened? It looks like the bad guys are really having more and more trouble mounting succesful DDoS: how comes? It also looks like, in despair, they're targetting smaller fishes. Why? Smaller botnets? Cloudflare and OVH and the likes just being too good at absorbing everything and anything…

Botnets aren't smaller (IoT has been quite a boon to them) & according to https://www.comparitech.com/blog/information-security/ddos-s... their frequency isn't declining But yes, the larger sites have gotten their shit together so that the cost to DDoS has gone up Also if you have a botnet you now have to ask: do you want rent out DDoS or do you want to mine crypto?

Post by DanAtC » Sat, Oct 23, 2021, 4:37 PM UTC

birdman914 wrote: post #44

Kye wrote: post #27

Earlier quoted context omitted.

More protection at the OS and ISP level. ISPs can isolate nodes that become part of botnets, and operating systems increasingly remove the avenues malicious actors use to cause trouble. Microsoft's push for hardware security is justly controversial, but the move to TPM by default in Windows 11 is the latest in a long line of changes that's made it harder to take over an ordinary person's computer. Android has had an…

You are correct on the ISP level. I am a network engineer for an ISP, we utilize Corero to monitor and mitigate DDoS attacks into our network. Since 99% of the time the DDoS is not targeted to us but rather the customer, I also kill the active IP addressing to their Modem/ONT, and configure that endpoint so it isn't allowed to pull an IP. Once the attack stops, re-config the endpoint and have it pull a new address.

Post by __s » Sat, Oct 23, 2021, 4:39 PM UTC

wongarsu wrote: post #51

xyzzy123 wrote: post #50

Earlier quoted context omitted.

CloudFlare, AWS, GCP.

Cloudflare I agree, but "give us $10000 or we increase your AWS bill by $20000 per day" sounds like a viable extortion scheme to me.