Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Azure hit by 15 Tbps DDoS attack using 500k IP addresses

bleepingcomputer.com

Post reply on HN
Print view View original

91–100 of 318 posts

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#91

Post by toast0 »

Thaxll wrote: post #89
dijit wrote: post #62

Earlier quoted context omitted.

you don’t stop the message to the botnet, thats impossible: You detect the behaviour downstream and send a signal to the ISP that there is traffic that needs to he rate limited. One mechanism for this is called RTBH (Remote Triggered BlackHole) which relies on community tagged prefixes of addresses exceeding rate limited to be blackholed from forwarding traffic further in to the internet. There’s also things like flo…

How do you know where it comes from, if they use UDP and change the src of the packets.

The Microsoft blog suggests there was miminal source spoofing (although I don't know how they determine that). But if you can't trust the IP source, packet samples from your border router should indicate which upstream is sending those packets ... then you ask them to find the source... eventually you'll get somewhere ... but when the sources are distributed, it's not so helpful to find the source, unless there's a mechanism to stop the source from sending it.

When I was running servers that would routinely attract DDoSed at ~ 10 Gbps, I ended up always running a low sample rate packet capture. Anytime I noticed a DDoS, I could go and look at the packets. If you've got connectivity to sink and measure 15 Tbps of DDoS, you can probably influence your providers to take some sampled packet captures and look at them too.

Even without clear information from packet captures, 15 Tbps is going to make an impact on traffic graphs, and you can figure out sources from those, although it might be a bit tricky because the attack duration was reported at only 40 seconds, so if someone only has hourly stats, it might be too small to be noticed; but once a minute stats are pretty common.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#92

Post by kachapopopow »

Razengan wrote: post #79
kachapopopow wrote: post #56

Earlier quoted context omitted.

fun fact, part of the reason this botnet exists is because europe required the ability to install security updates unattended that you cannot disable and they compromised one of the servers that had the capability to push these updates compromising hundreds of thousands of routers.

Wait when was this?? Did it fly under the news??

it's one of the (i believe) hundreds (at this point) of zero-days that is used to build this botnet, at this point they are using funds that they get from selling this botnet to purchase new zero days

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#93

Post by kachapopopow »

cyberpunk wrote: post #84
kachapopopow wrote: post #56

Earlier quoted context omitted.

fun fact, part of the reason this botnet exists is because europe required the ability to install security updates unattended that you cannot disable and they compromised one of the servers that had the capability to push these updates compromising hundreds of thousands of routers.

That's really impressive finger pointing. If the vendor can't even secure their update server; how long do you think it would be until some RCE on these 100k un-patchable routers gets exploited? The only people to blame for this is the vendor, and they failed on multiple levels here. It's not hard to sign a firmware, or even just fetch checksums from a different site than you serve the files from...

the problem is that these laws just make the problem bigger - instead of having to compromise 100 thousand routers they can just compromise a single update server from a vendor that doesn't care about security.

the fallout is some companies losing their revenue: https://status.neoprotect.net/ and other headaches for people all over the world

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#94

Post by cookiengineer »

imglorp wrote: post #41

> it targeted a single endpoint in Australia. It would really help to understand why attack one endpoint with "the largest DDoS attack ever observed in the cloud". If it was important, it would be redundant in its CDN. Who paid for this attack and what did they gain?

You are assuming that DDoS is signal. It's not, it's the noise.

The idea of DDoS for hire is to bury your own tracks in as much network requests as possible, so that the other side is overwhelmed processing (or even storing) that dataset and won't find out what the real target was.

That's literally the strategy of APT28/29.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#95

Post by toast0 »

lossyalgo wrote: post #82
trollbridge wrote: post #19

Earlier quoted context omitted.

I mean, America can’t do anything about scam phone calls aimed at seniors who forge caller ID of local hospitals.

As alluded to by morkalork, they definitely could if they wanted to, as the (most? of the) rest of the world doesn't seem to have this problem. As long as spammers keep paying telecoms & no law(s) forbidding this exist, it will continue. edit: grammar

> As long as spammers keep paying telecoms & no law(s) forbidding this exist, it will continue.

That's the trick. A lot of countries bill calls to cell phones at 10 cents a minute; in the US, calling is near zero cost. The US makes a great market for scammers to target because of low operating costs, penetration of globally usable payment cards, minimal language diversity.

Of course, these scams are forbidden by law, but that doesn't change the economics. Very few scam shops get busted; especially when most of them run from outside the US. STIR/SHAKEN helps a bit, but not much... without a effective mechanism to report unwanted calls that leads to those callers being ejected from the network as well as ejecting providers that are unresponsive to reports, there's not really hope of progress.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#96

Post by tetha »

nine_k wrote: post #72
shoddydoordesk wrote: post #18

> it suddenly ballooned in size in April 2025 after its operators breached a TotoLink router firmware update server and infected approximately 100,000 devices This is scary. Everyone lauds open source projects like OpenWRT but... who is watching their servers? I imagine you can't run an army of security people on donations and a shoestring budget. Does OpenWRT use digital signing to mitigate this?

Why, OpenWRT firmware and packages are both signed, of course. You can manually and independently check the image signature before flashing an update. The build infrastructure is, of course, a juicy target: infect the artifact after building but before signing, and pwn millions of boxes before this is detected. This is why bit-perfect reproducible builds are so important. OpenWRT in particular have that: https://open…

Bit-Reproducible infrastructure could also result in some of the wildest build distribution architectures if you think about it. You could publish sources and have people register like in APT mirrors to provide builds, and at the end of the day, the build from the largest bit-equal group is published.

I do see the Tor-Issue - a botnet or a well-supplied malicious actor could just flood it. And if you flip it - if you'd need agreement about the build output, it could also be poisoned with enough nodes to prevent releases for a critical security issue. I agree, I don't solve all supply chain issues in one comment :)

But that in turn could be helped with reputation. Maybe a node needs to supply 6 months of perfect builds - for testing as well - to become eligible. Which would be defeated by patience, but what isn't? It'd just have to be more annoying to breach the distributed build infrastructure than to plant a malicious developer.

This combination of reproducible, deterministic builds, tests across a number of probably-trustworthy sources is quite interesting, as it allows very heavy decentralization. I could just run an old laptop or two here to support. And then come compromise hundreds of these all across the world.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#97

Post by danudey »

jacobgkau wrote: post #54
shoddydoordesk wrote: post #44

Earlier quoted context omitted.

You are dismissing the seriousness of this. Their package manager is widely used. One would only need to compromise their build servers to wreak havoc. Didn't they have a vulnerability in their firmware download tool like a minute ago? The difference between OpenWRT and Linux distros is the amount of testing and visibility. OpenWRT is loaded on to residential devices and forgotten about, it doesn't have professional…

I'm confused why you're so honed in on OpenWRT as a third-party open-source project here when the vulnerability you quoted (TotoLink) was the official firmware update server of a brand of devices. Is it "scary" to think about OpenWRT potentially getting hacked? If you get scared by theoretical possibilities in software, sure. Is it relevant? Not exactly. Are companies' official servers more secure than an open-source…

What's scary is that OpenWRT is a project created by people who wanted a better solution than what was out there, and are therefore largely driven by a desire to create a good product.

Meanwhile, corporations are driven entirely by profit motive, so as long as it's more expensive to be vigilant about security than it is to be lax about it they will never improve.

Until companies which produce (and do not update) vulnerable equipment are penalized (e.g. charged with criminal negligence) for DDoS attacks using their hardware then the open-source projects are going to continue to be far more trustworthy and less vulnerable than corporations which mass-produce the cheapest hardware they can and then designating it as obsolete and unsupported as fast as possible to force more updates.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#98

Post by haunter »

This is what I don't get

>The Aisuru DDoS botnet operates as a DDoS-for-hire service with restricted clientele; operators have reportedly implemented preventive measures to avoid attacking governmental, law enforcement, military, and other national security properties. Most observed Aisuru attacks to date appear to be related to online gaming.

https://www.netscout.com/blog/asert/asert-threat-summary-ais...

So why? Like why would someone pay to take a game down? I see this all over reddit with different games but I just don't get the point. What's the benefit of taking down an online game for a couple of hours.

Re: Azure hit by 15 Tbps DDoS attack using 500k IP addresses

#100

Post by dang »

shoddydoordesk wrote: post #29
dang wrote: post #6

Earlier quoted context omitted.

Switched above. Thanks!

FWIW I think this is a bad practice. The Microsoft article reads like a corporate press release. The original link contained additional pertinent information and research which is good for discussion.

OK, I've swapped them back. Thanks!

The principles here are clear: we prefer the best third-party article to corporate press releases*, but at the same time we don't want blogspam (i.e. ripoffs that don't add anything interesting).

* https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...

Post reply on HN