61–70 of 136 posts
Earlier quoted context omitted.
When it comes to ip spoofing based ddos attacks, the ISPs capable of tracking spoofed traffic on their network don't allow spoofed traffic. If they don't allow the spoofed traffic, you aren't participating in the DDoS.
Absolutely. No ISP should allow a packet with a spoofed IP leave it's network.
... which you can conveniently buy on one of the CloudFlare-protected DDoS service websites! I know this point has been hammered to death before, but I find it curious that despite their strong advocacy of being content neutral and not removing a site unless they receive a court order, their Terms of Service explicitly allows them to shut off service based solely on their opinion:
"SECTION 11: INVESTIGATION
CloudFlare reserves the right to investigate you, your
business, and/or your owners, officers, directors,
managers, and other principals, your sites, and the
materials comprising the sites at any time. These
investigations will be conducted solely for CloudFlare’s
benefit, and not for your benefit or that of any third
party. If the investigation reveals any information,
act, or omission, which in CloudFlare’s sole opinion,
constitutes a violation of any local, state, federal, or
foreign law or regulation, this Agreement, or is
otherwise deemed harm the Service, CloudFlare may
immediately shut down your access to the Service."
Earlier quoted context omitted.
Ugh, if you're identifying sensors by IP instead of some other ID in the payload, you're doing it wrong. NAT between the sensors and you can throw a wrench into that whole scheme in a hurry. This is just a smell emanating from another poor design, not a justification for IP spoofing. If you want to spoof addresses, do it in the privacy of your own VPN tunnel between the servers. Don't expose that sickness to the Inte…
You sir are quick to jump to very incorrect conclusions. It's a bad habit and you should abandon it at once. First, I never said we identified the sensors by IP, but it was important that we record the sensor's IP for diagnostic information. Second, IP spoofing was not done over the Internet, but rather only between our own servers inside our data center. Obviously doing this over the internet would not only be bad,…
Can someone explain the consequences of DDoS attacks to me? My understanding is that the worst case is that the target server goes offline for the duration of the attack. If that's indeed the endgame, it seems like a lot of work on the attacker's part to disable a company's servers for a bit, but maybe I"m missing something? The article did mention servers boiling, but that was likely hyperbole unless there's a way t…
Imagine you are a news outlet. You make money by creating articles that entice people to view your website. You make money to pay your expenses by having advertisements on your website. DDoS = No Website. No Website = no users viewing ads. No users viewing ads = No income. Yes, that typically resolves quickly. Depending on your hosting agreement, you may have to pay for all the excess bandwidth that the DDoS bots use…
Earlier quoted context omitted.
It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…
> It's a form of victim blaming. 1. Victim blaming is when you excuse someone's bad behaviour with the justification that the person(s) negatively affected by it could have protected/tried to protect themselves against it. That doesn't have anything to do with the question whether you should try to protect yourself, or whether you might have some obligation to try and protect others. 2. Based on your logic, what you…
Earlier quoted context omitted.
That would penalize a whole pile of parties that probably have nothing whatsoever to do with the spoofers. It's akin to blackholing mail from yahoo.com because there are spammers on yahoo.com.
Isn't it more akin to blackholing mail servers that don't set up DKIM, which almost all major mail providers do these days?
Netflow is a great example of the dual use aspects of tech between surveillance and defense. Making Netflow data more widely available looks like it is going to be essential for defending that Internet but at the same time Netflow data can threaten the anonymity of Tor users.[0][1] [0] https://blog.torproject.org/blog/traffic-correlation-using-n... [1] https://gitweb.torproject.org/torspec.git/tree/proposals/251...
Earlier quoted context omitted.
> the crusade to end useful UDP protocols is successful What? What crusade? I love UDP, use it every chance I get. Who is "crusading" to end UDP on the Internet?
All the orgs suffering from amplification attacks from services using UDP. DNS, NTP, chargen, etc.
Most of the fine people running chargen servers seem to be running the server from Microsoft services for UNIX package which is configured to send giant fragmented responses, and then they have a firewall that drops the first fragment. Thanks a lot guys.