Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fastmail, Runbox, and Posteo under DDoS extortion attack

therecord.media

Post reply on HN
Print view View original

81–90 of 130 posts

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#81

Post by will4274 »

zugi wrote: post #65
Kye wrote: post #27

Earlier quoted context omitted.

More protection at the OS and ISP level. ISPs can isolate nodes that become part of botnets, and operating systems increasingly remove the avenues malicious actors use to cause trouble. Microsoft's push for hardware security is justly controversial, but the move to TPM by default in Windows 11 is the latest in a long line of changes that's made it harder to take over an ordinary person's computer. Android has had an…

> TPM by default in Windows 11 is the latest in a long line of changes that's made it harder to take over an ordinary person's computer Interesting, I think of TPM as being for holding keys for bitlocker encryption or personal certificates. Can you clarify how TPM makes it harder for to remotely take over a computer?

It's what you can do with the TPM. With the TPM to hold keys, you can require that e.g. bootloader changes be signed by the vendor. It's hard for malware to convince an ordinary person to go into BIOS and disable vendor locked bootloaders. Of course, Microsoft also gets into trouble here, because sometimes the vendors (and Microsoft itself) don't put the option to disable locking in the BIOS.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#82

Post by neom »

throwawaysea wrote: post #68

If you didn’t want to depend on a big provider like AWS or Cloudflare, what is the approach to fending off a DDoS attack? What type of hardware would you need to acquire? What type of software? Are there guides on this type of thing?

You could try to do it yourself with firewall rules, reverse proxies, things like that, but to fight large scale ddos you really need to be moving the traffic around using BGP, and you'd want to dump the traffic somewhere, so you'd need bandwidth to dump the traffic into, that's why companies like cloudflare exist, they're able to work with bgp and they have a lot of bandwidth to absorb the traffic on behalf of the customer.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#83

Post by yarcob »

muttantt wrote: post #67
julianlam wrote: post #64

The sooner these kids realize that DDoS extortion attacks do nothing except waste resources (and monetary resource to CloudFlare, basically), the sooner they'll give up. They hit a number of VoIP providers recently, too.

The latest attacks on VoIP providers resulted in a SIP/VoIP specific solution from Cloudflare. I expect we will see Cloudflare mail protection soon enough... Makes you wonder.

I first learned that someone cracked my app from a company that offered to help me fight cracked downloads of my app. I was immediately suspicious.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#84

Post by Kye »

will4274 wrote: post #81
zugi wrote: post #65

Earlier quoted context omitted.

> TPM by default in Windows 11 is the latest in a long line of changes that's made it harder to take over an ordinary person's computer Interesting, I think of TPM as being for holding keys for bitlocker encryption or personal certificates. Can you clarify how TPM makes it harder for to remotely take over a computer?

It's what you can do with the TPM. With the TPM to hold keys, you can require that e.g. bootloader changes be signed by the vendor. It's hard for malware to convince an ordinary person to go into BIOS and disable vendor locked bootloaders. Of course, Microsoft also gets into trouble here, because sometimes the vendors (and Microsoft itself) don't put the option to disable locking in the BIOS.

Bingo. I've seen multiple instances in the last year or so where people were advised to reboot their devices to make sure a newly identified and patched out malware was removed.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#85

Post by ryanlol »

TacticalCoder wrote: post #66
__s wrote: post #32

Earlier quoted context omitted.

Botnets aren't smaller (IoT has been quite a boon to them) & according to https://www.comparitech.com/blog/information-security/ddos-s... their frequency isn't declining But yes, the larger sites have gotten their shit together so that the cost to DDoS has gone up Also if you have a botnet you now have to ask: do you want rent out DDoS or do you want to mine crypto?

How that's a good point: especially that if you DDoS while asking for a ransom, you take the risk that your botnets gets taken down. While if you "discretly" mine CPU (and/or GPU?) mineable cryptocurrencies, you kinda fly under the radar.

You DDoS from routers and other embedded devices which aren’t capable of mining anything.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#86

Post by miked85 »

gonehome wrote: post #30
baybal2 wrote: post #13

Earlier quoted context omitted.

P2P networks are on other hand very susceptible to spam attack. You haven't seen Gnutella in its glory days.

Urbit solves both of these issues in a clever way with how it handles identity on the network.

Urbit does have the added advantage that very few understand what it even is.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#87

Post by bombcar »

IceWreck wrote: post #45
jorgesborges wrote: post #43

Earlier quoted context omitted.

Are most machines involved in attacks like this compromised? Are we talking generic consumer desktop machines, like my grandma’s old XP desktop running in her basement?

> Are most machines involved in attacks like this compromised? Yes > Are we talking generic consumer desktop machines, like my grandma’s old XP desktop running in her basement? Those combined with hundreds of thousands of compromised VPSes, etc.

And don’t forget the millions of IoT devices.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#88

Post by Aachen »

DDoS is said to be very cheap. What if we used that to boot the culprits? It's obviously illegal, so just as a thought experiment: if those amplifiers (dns resolvers or whatever is popular at the moment) started experiencing issues due to their servers being a nuisance to others...?

It still seems much easier to just blackhole IPs that are causing problems, like collectively (at the edge of your AS) block IPs that long-term host a service that is actively involved in facilitating DDoS attacks, but for some reason nobody is doing that. This could be a more direct way: see where DDoS traffic is coming from and... poof

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#89

Post by Aachen »

SavantIdiot wrote: post #53

I've been with RunBox since 2012 because of Norway's internet privacy policies. I support them not giving into to extortion. If I don't have email for a few days, or a month, big deal. I remember how to use a phone to pay bills.

My employer uses runbox. I'm happy you're so unattached that you can go a month without any email (can't sign up anywhere, for example) but we'd miss incoming invoices, can't send invoices to our customers, can't deliver reports to customers (we do security audits so that's kinda important to be able to deliver using e.g. pgp), would miss requests for new assignments...

I'm fully in favor of not paying into the extortion and not going for a global tap system like cloudflare, but we do need some solution in at most a few days. In the Netherlands there is for example the Nawas (it's also a pun, referring to a laundry cleaning thing) that scrubs malicious traffic for ISPs. I don't know the details of how they're being attacked, but with typical reflector services it's easy to remove that traffic based on a source port. Any large Norwegian hosting company (they just need an uplink bigger than the DDoS, or work with whoever the traffic comes from at their peering points) could provide that service as well. Not saying this is trivial but there are options other than waiting.

Re: Fastmail, Runbox, and Posteo under DDoS extortion attack

#90

Post by Aachen »

muttantt wrote: post #59

Yet another reason to host your email at your own domain which you can move at will.

Or less hassle than completely moving over to a competitor (terrorists win in that case, to use counter strike terminology): add a backup MX record, perhaps to a small vps that just forwards mail to the real server with no retry timeout.
Post reply on HN