Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

IP Spoofing

idea.popcount.org

Post reply on HN
Print view View original

71–80 of 136 posts

Re: IP Spoofing

#71

Post by hueving »

zAy0LfpBZLC8mAC wrote: post #49
hueving wrote: post #31

Earlier quoted context omitted.

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing c…

> It's a form of victim blaming. 1. Victim blaming is when you excuse someone's bad behaviour with the justification that the person(s) negatively affected by it could have protected/tried to protect themselves against it. That doesn't have anything to do with the question whether you should try to protect yourself, or whether you might have some obligation to try and protect others. 2. Based on your logic, what you…

Services used in amplification attacks are victims because their services are being DoS'ed as well and their IPs are the ones that end up on flowspec block lists.

They are also victims from the second order effects of idiots in prominent places claiming that their services are the source of the Internet's woes (e.g. Cloudflare's ridiculing of dns resolver operators).

Your entire second point is nonsensical because they aren't impacted by DoS attacks. They aren't 'victims' in any sense.

Also, people running UDP services cannot stop source spoofed DDoS attacks. You can block the entire UDP protocol today and the problem of untraceable attacks will be just as prevalent tomorrow. The largest attack observed (>1tbps didn't use amplifying UDP services at all).

BCP 38 would end this problem, full stop. ISPs complicit in what amounts to fraud deserve no sympathy. On most routers, ingress filtering is a one line option. Yet people like you promote breaking changes to UDP protocols as a half-baked solution that doesn't do anything to actually stop source spoofed DDoS attacks. It baffles me.

Re: IP Spoofing

#72

Post by hueving »

oldmanjay wrote: post #66
zAy0LfpBZLC8mAC wrote: post #49

Earlier quoted context omitted.

> It's a form of victim blaming. 1. Victim blaming is when you excuse someone's bad behaviour with the justification that the person(s) negatively affected by it could have protected/tried to protect themselves against it. That doesn't have anything to do with the question whether you should try to protect yourself, or whether you might have some obligation to try and protect others. 2. Based on your logic, what you…

Using this definition, another example of victim blaming is telling children to look both ways before crossing the street.

No, the equivalent would be telling children they can't have toys because someone might steal a toy gun from them and use it to hold up a bank.

Re: IP Spoofing

#73

Post by openasocket »

w8rbt wrote: post #52
erichocean wrote: post #40

Earlier quoted context omitted.

> the crusade to end useful UDP protocols is successful What? What crusade? I love UDP, use it every chance I get. Who is "crusading" to end UDP on the Internet?

All the orgs suffering from amplification attacks from services using UDP. DNS, NTP, chargen, etc.

... do people still use chargen? Are there seriously still chargen servers in the world?

Re: IP Spoofing

#74

Post by hueving »

w8rbt wrote: post #52
erichocean wrote: post #40

Earlier quoted context omitted.

> the crusade to end useful UDP protocols is successful What? What crusade? I love UDP, use it every chance I get. Who is "crusading" to end UDP on the Internet?

All the orgs suffering from amplification attacks from services using UDP. DNS, NTP, chargen, etc.

Those organizations are unfortunately confused and are not directing their frustrations towards the real cause (ISPs which allow spoofing).

Re: IP Spoofing

#75

Post by joombaga »

oldmanjay wrote: post #66
zAy0LfpBZLC8mAC wrote: post #49

Earlier quoted context omitted.

> It's a form of victim blaming. 1. Victim blaming is when you excuse someone's bad behaviour with the justification that the person(s) negatively affected by it could have protected/tried to protect themselves against it. That doesn't have anything to do with the question whether you should try to protect yourself, or whether you might have some obligation to try and protect others. 2. Based on your logic, what you…

Using this definition, another example of victim blaming is telling children to look both ways before crossing the street.

No, it's telling a child that has been hit by a car repeatedly to look both ways next time, when you know it would definitely reduce their chance of getting hit.

Performing edge ingress traffic filtering of known-trunked node addresses (i.e. BCP 38) has a high likelihood of reducing the effectiveness of DDoS attacks.

Re: IP Spoofing

#76

Post by x1798DE »

jacquesm wrote: post #67
x1798DE wrote: post #23

Earlier quoted context omitted.

Isn't it more akin to blackholing mail servers that don't set up DKIM, which almost all major mail providers do these days?

No, if you drop the BGP route the whole range disappears, not just the host that spoofs the IPs. So it kills off a whole pile of innocents as collateral damage.

I don't know if I understand. At first I thought you meant that we shouldn't drop entire providers because one of their customers spoofed an IP, but of course the burden should be on those providers to make sure spoofed packets can't leave their network (since further up the chain you're getting packets that are originating from many networks). Are you talking about something else?

Re: IP Spoofing

#77

Post by jerefa1 »

ryanlol wrote: post #24
mordocai wrote: post #19

Earlier quoted context omitted.

I don't believe this is actually arguable. People use tor to attempt to anonymize their (generally non-ddos) attacks. I don't believe tor can support the type of ddos the OP is talking about, of course. If you could provide the source of this debunk it'd be appreciated.

This is ridiculous. Anyone can grep their access logs for signs of obvious attacks and very quickly verify that very few, if any, of them originated from Tor exits.

It amuses me greatly that probably no one in this thread realizes who you are. (Except maybe Cloudflare.)

Re: IP Spoofing

#79

Post by AndyMcConachie »

marcosdumay wrote: post #46
AndyMcConachie wrote: post #43

A couple things: 1) There is no evidence that the recent giant DDOS attacks on Brian Krebs used IP Spoofing. In fact, there is every reason to believe that they did not since the generators of the packets were low powered IoT devices. There is increasingly little reason for attackers to even bother with IP spoofing given how easy it is becoming to capture giant herds of low power IoT devices. The attackers don't care…

You answered your question there. Without spoofing, only the largest botnets can launch a successful DDoS attack. That's a big barrier to entry, and if the police were effective on this area, would be a huge boom to fighting those attacks.

I dunno. Spoofing for reflection/amplification is only going to work for certain services(e.g., DNS, NTPD). So perhaps if you don't spoof, but instead capture a large enough IoT botnet, you might be able to generate traffic that's harder to spot and segregate. I think we need to watch this space and see how things develop.

Re: IP Spoofing

#80

Post by AndyMcConachie »

aidenn0 wrote: post #48
AndyMcConachie wrote: post #43

A couple things: 1) There is no evidence that the recent giant DDOS attacks on Brian Krebs used IP Spoofing. In fact, there is every reason to believe that they did not since the generators of the packets were low powered IoT devices. There is increasingly little reason for attackers to even bother with IP spoofing given how easy it is becoming to capture giant herds of low power IoT devices. The attackers don't care…

Footnote at bottom of article specifically mentioning #1

Thanks. I missed that on first read.
Post reply on HN