Url changed from https://blog.runbox.com/2021/10/runbox-is-under-attack-by-ex..., which points to this.
Fastmail, Runbox, and Posteo under DDoS extortion attack
71–80 of 130 posts
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#72[deleted]
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#73Earlier quoted context omitted.
I agree that you do need some form of first stage that can take the traffic volume (usually a third party service, but could also be 100+ Gbps of bandwidth you get somewhere and an appliance that can do IP filtering), no good way around that. But once you have that, you should be able to tell them "forward me all traffic except " and then list the IPs that are sending you the most (remaining) traffic, or even cost (e…
Agreed adding bandwidth can help against some attacks. as long as the attacker cannot spoof IP addresses at scale That is kindof the rub. Until a majority of tier-1 backbone providers implement bcp38 [1] or some derivative of it, spoofing from the ddos farms is trivial. There has been talk of implementing this for many years but very little action. Perhaps when DDoS attacks cost enough tax revenue or impact investors…
Curious as you speak of "very little action", yet the Wikipedia article you linked says:
> […] contrary to general opinion about the lack of BCP 38 deployment, some 80% of the Internet (by various measures) were already applying anti-spoofing packet filtering
I know very little about global routing, so I'm wondering if it's an ineffective way of filtering against these attacks we see today or is 80% not enough to be effective?
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#74mailbox.org was also attacked https://twitter.com/mailbox_org/status/1451237052855595012?s... I kept having errors in sending emails and logging into the web interface and the mailbox.org status page indicated nothing was wrong. Why have the page if that’s not where I’m supposed to find out something like this?
The server was probably running it was just flooded. Probably requires different type of checks to catch this.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#75Earlier quoted context omitted.
I agree that you do need some form of first stage that can take the traffic volume (usually a third party service, but could also be 100+ Gbps of bandwidth you get somewhere and an appliance that can do IP filtering), no good way around that. But once you have that, you should be able to tell them "forward me all traffic except " and then list the IPs that are sending you the most (remaining) traffic, or even cost (e…
Agreed adding bandwidth can help against some attacks. as long as the attacker cannot spoof IP addresses at scale That is kindof the rub. Until a majority of tier-1 backbone providers implement bcp38 [1] or some derivative of it, spoofing from the ddos farms is trivial. There has been talk of implementing this for many years but very little action. Perhaps when DDoS attacks cost enough tax revenue or impact investors…
My understanding is that the attacker can generate a relatively small amount of IP-spoofed traffic, which is then used to generate a much bigger amount of amplified traffic from servers the attacker doesn't control (i.e. not IP spoofed).
So you need to be able to handle:
a) the reflected volumetric attack (you can block IPs and even protocols/ports here),
b) a much smaller volume of IP-spoofed traffic, which for TCP services basically means you have to be handle a SYN flood (because if they spoof, they can't get a connection established to do the nastier stuff)
c) make sure you don't let your countermeasures against a) be triggered by b) in a way that disrupts your legitimate customers.
For a TCP based service, I'd expect the following to be quite effective:
1. At the very first stage (has to be able to handle the full volume, may be external), discard all UDP traffic, any TCP traffic pointing to the wrong port, and any traffic from blacklisted IPs.
2. At the second stage (has to be able to handle the IP-spoofable volume), terminate TCP connections using SYN cookies, and forward actual connections to the real servers.
3. At the real servers, any remaining incoming connection is coming from a non-spoofed IP. Monitor cost (TCP handshake, TLS handshake, authentication attempt) and successful accounts per IP. Block IPs that cause a high cost but no legitimate users, or an extreme cost and few legitimate users, using the stage 1 blacklist.
4. Optionally you can also aggregate information about successful logins and block sources that cause a high load at stage 2 and have few successful logins using a short-lived entry on the stage 1 blacklist.
UDP based services would be much harder since you don't have such a trivial stage 2, but for TCP, stages 1+2 should be something that you can buy.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#76Is the attack on its webmail/website or on their smtp servers? I’ve been wondering about this, but how does one protect smtp servers from distributed attacks? Let’s assume smaller attackers, do you just need good firewalls in front of your servers to prevent congestion to the smtp servers? Are there off the shelf tools that can be configured to help here (pf maybe)? Do tools like fail2ban help? For context, I’ve pick…
If they're hitting the outbound SMTP servers, there's no way (at least that I know of) to protect the IP/servers via obfuscation with a service like Cloudflare etc. Email deliverability relies heavily on the source IP of the sending SMTP for reputation and is going to be viewable in the headers of an email. Also changing IPs isn't a small task unless you're sitting on a load of good reputation IPs that are pre-warmed up.
I think a scrubbing service would be the only way to help or of course, having enough resources to deal with it directly (bandwidth, cpu, etc).
Disclaimer: I run Pingly [1] an email hosting service, but ironically our signups are turned off at the moment due to a botnet that hits us with fake accounts to send spam that I'm working to mitigate completely.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#77Earlier quoted context omitted.
Agreed adding bandwidth can help against some attacks. as long as the attacker cannot spoof IP addresses at scale That is kindof the rub. Until a majority of tier-1 backbone providers implement bcp38 [1] or some derivative of it, spoofing from the ddos farms is trivial. There has been talk of implementing this for many years but very little action. Perhaps when DDoS attacks cost enough tax revenue or impact investors…
Curious as you speak of "very little action", yet the Wikipedia article you linked says: > […] contrary to general opinion about the lack of BCP 38 deployment, some 80% of the Internet (by various measures) were already applying anti-spoofing packet filtering I know very little about global routing, so I'm wondering if it's an ineffective way of filtering against these attacks we see today or is 80% not enough to be…
It really isn't enough. Everyone needs to do their part [1] not just ISP's but also large businesses, cloud providers, others. And this has to occur in all regions. I admittedly over-simplified the problem statement.
[1] - https://archive.nanog.org/sites/default/files/1_Kaeo_Ddos_Tr... [PDF]
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#78Wonder if it’s the same folks who hit voip.ms last week. That one lasted a while.
Reading through r/VOIP, I could have sworn Voip.ms was 2 weeks ago - then other providers began to be hit with DDoS attacks.
Frankly, it doesn't seem like such a bad strategy. With the amount of panic the attack on Voip.ms caused, a number of people were discussing switching voip providers. And switching targets to other providers just as they get a massive influx of new customers seems like a force multiplier IMO.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#79Yet another reason to host your email at your own domain which you can move at will.
Our Bank "A" suffered a major DDoS attack recently. My non-techy partner, upset, declared were moving to Bank "B". I pointed out that Bank B had also been target of DDoS attacks so we would be moving banks only to face the exact same issues. Point being you may move to a different service provider (email, banking, whatever) to find the new one has the same problems anyway.
Re: Fastmail, Runbox, and Posteo under DDoS extortion attack
#80I've been with RunBox since 2012 because of Norway's internet privacy policies. I support them not giving into to extortion. If I don't have email for a few days, or a month, big deal. I remember how to use a phone to pay bills.
This is a surprisingly insensitive comment. Email is as much a a part of modern life as phone calls and postal mail. Asking people to "just go without" for a few days may be possible for you, but is certainly not possible for a huge fraction of people.