5 ms·

DDoS is a type of attack that is so old that I wonder why it is still possible to exploit it. It is at least 15 years old? (edit: I am not blaming FastMail, thi

by awqrre 11y ago

DDoS is a type of attack that is so old that I wonder why it is still possible to exploit it. It is at least 15 years old? (edit: I am not blaming FastMail, this is just a general assumption)

AYBABTME 11y ago
There's too many ways to do it by abusing legit protocols, tricking web browsers, etc, what fool proof countermeasure would you think there is? Other than out-doing the attacker by over provisioning your networks?
sowbug 11y ago
It's a generic term, not a type of attack. The question is similar to asking why we haven't developed a defense against being blown up when explosions are old. As long as there are services, and as long as those services have finite capacity, there will be DDoSes -- both accidental and intentional.
toast0 11y ago
Ddos traffic generation capacity and server capacity scale in similar ways. As more and more of my servers get 10g Ethernet, more and more idiots are running chargen on 10g Ethernet.
Analemma_ 11y ago
It's still possible to exploit because "DDoS" isn't one attack, but a category: people keep finding new ways to slam a target with tons of traffic. For a while, the most common way was with botnets of compromised PCs. They still exist, but big attacks with them are less common since Microsoft has gotten better at securing people's computers. The big thing now is "amplification attacks": basically, finding a way to send a small amount of data and get some other host to flood your target with a huge amount of data in response. Search "NTP amplification attack" for details. More recently, China has weaponized the Great Firewall to be yet another DDoS vector: they inject JavaScript into pages that people visit, and that JS floods a target with requests. As long as there is some way to point a lot of requests somewhere you want, DDoS attacks will be a thing.
- awqrre 11y ago
  not necessarily... you could use AI to detect attacks or some other methods that I am not aware of.
  - alextgordon 11y ago
    Commander Data, please report to engineering
    - awqrre 11y ago
      Sorry I don't understand... Are you saying that AI doesn't require any training?
      - TeMPOraL 11y ago
        He's saying that we live in 21st, not 24th century.
      - ori_b 11y ago
        Detection is trivial -- "Are we getting orders of magnitude more traffic than average?" What would the AI do?
        fleitz 11y ago
        The AI would whitelist traffic, those streams pass through quickly, everything else gets filtered. The problem is your CPUs filter traffic faster than your NICs accept it, thus dropped packets, thus unhappy customers.
        ori_b 11y ago
        "Excuse me, boss, there's a very robotic voice on the line. It seems to be attempting to negotiate running new fiber to a data center"
  - toast0 11y ago
deleted 11y ago
[deleted]
ori_b 11y ago
Because it's an attack on fundamental physical resources, rather than on any technological feature. There are exactly two workarounds: Minimize processing of packets that you think are coming from the attackers, and have more servers. Asking why we haven't solved DDOS is kind of like saying "Why can't we cure decapitation? We've got all of these new antibiotics!"
- brongondwana 11y ago
  Not even more servers - fatter pipe. We are using less than 1% of the inbound capacity of our connection in normal operation, yet the attackers easily filled it. The firewalls that we are running were easily able to absorb the additional traffic. Neil's metaphor of the post office was quite accurate - even in the heaviest attack, when we didn't have upstream DDoS protection turned on, about 10% of user traffic was getting through just fine - it's just that a random 10% of traffic makes for a very poor TCP experience.
gozo 11y ago
Several people seem to be saying that DDoS isn't one attack, which is correct, but not particularly relevant. Many times the attacks are simpler today, because there's little need for sophistication. Previously many attacks used to use some form of multiplier, either for the traffic itself or the resources targeted. The reason the attacks are still viable is because little has happened to the Internet itself. We still have the same challenges we had 15 years ago. Some things are slowly getting better, but it's still fundamentally the same. Increase in overall bandwidth and vulnerabilities doesn't help either.
rasz_pl 11y ago
We need technical capability for all the tier 1/2 boys to be able to tell if packets incoming from network X are legitimate, and drop them if they are part of currently ongoing attack. Afaik fixed silicon edge routers peering tier 1/2 networks were the biggest obstacle in filtering good traffic from spoofed/botnet one. Just a year ago we had huge problems when BGP rose to >512K entries, which is an order of magnitude easier. Did anything change since ~10 years ago? Last time I dabbled in this it was so bad even Tier3 (ISPs) werent filtering spoofed packets.
- feld 11y ago
  Technical capability exists. Everyone running BGP should be implementing BCP38. http://www.bcp38.info http://www.bcp38.info

by awqrre 11y ago

DDoS is a type of attack that is so old that I wonder why it is still possible to exploit it. It is at least 15 years old? (edit: I am not blaming FastMail, this is just a general assumption)

AYBABTME 11y ago

There's too many ways to do it by abusing legit protocols, tricking web browsers, etc, what fool proof countermeasure would you think there is? Other than out-doing the attacker by over provisioning your networks?

sowbug 11y ago

It's a generic term, not a type of attack. The question is similar to asking why we haven't developed a defense against being blown up when explosions are old. As long as there are services, and as long as those services have finite capacity, there will be DDoSes -- both accidental and intentional.

toast0 11y ago

Ddos traffic generation capacity and server capacity scale in similar ways. As more and more of my servers get 10g Ethernet, more and more idiots are running chargen on 10g Ethernet.

Analemma_ 11y ago

It's still possible to exploit because "DDoS" isn't one attack, but a category: people keep finding new ways to slam a target with tons of traffic. For a while, the most common way was with botnets of compromised PCs. They still exist, but big attacks with them are less common since Microsoft has gotten better at securing people's computers. The big thing now is "amplification attacks": basically, finding a way to send a small amount of data and get some other host to flood your target with a huge amount of data in response. Search "NTP amplification attack" for details. More recently, China has weaponized the Great Firewall to be yet another DDoS vector: they inject JavaScript into pages that people visit, and that JS floods a target with requests. As long as there is some way to point a lot of requests somewhere you want, DDoS attacks will be a thing.

awqrre 11y ago
not necessarily... you could use AI to detect attacks or some other methods that I am not aware of.
- alextgordon 11y ago
  Commander Data, please report to engineering
  - awqrre 11y ago
    Sorry I don't understand... Are you saying that AI doesn't require any training?
    - TeMPOraL 11y ago
      He's saying that we live in 21st, not 24th century.
    - ori_b 11y ago
      Detection is trivial -- "Are we getting orders of magnitude more traffic than average?" What would the AI do?
      - fleitz 11y ago
        The AI would whitelist traffic, those streams pass through quickly, everything else gets filtered. The problem is your CPUs filter traffic faster than your NICs accept it, thus dropped packets, thus unhappy customers.
        ori_b 11y ago
        "Excuse me, boss, there's a very robotic voice on the line. It seems to be attempting to negotiate running new fiber to a data center"
- toast0 11y ago

deleted 11y ago

[deleted]

ori_b 11y ago

Because it's an attack on fundamental physical resources, rather than on any technological feature. There are exactly two workarounds: Minimize processing of packets that you think are coming from the attackers, and have more servers. Asking why we haven't solved DDOS is kind of like saying "Why can't we cure decapitation? We've got all of these new antibiotics!"

brongondwana 11y ago
Not even more servers - fatter pipe. We are using less than 1% of the inbound capacity of our connection in normal operation, yet the attackers easily filled it. The firewalls that we are running were easily able to absorb the additional traffic. Neil's metaphor of the post office was quite accurate - even in the heaviest attack, when we didn't have upstream DDoS protection turned on, about 10% of user traffic was getting through just fine - it's just that a random 10% of traffic makes for a very poor TCP experience.

gozo 11y ago

Several people seem to be saying that DDoS isn't one attack, which is correct, but not particularly relevant. Many times the attacks are simpler today, because there's little need for sophistication. Previously many attacks used to use some form of multiplier, either for the traffic itself or the resources targeted. The reason the attacks are still viable is because little has happened to the Internet itself. We still have the same challenges we had 15 years ago. Some things are slowly getting better, but it's still fundamentally the same. Increase in overall bandwidth and vulnerabilities doesn't help either.

rasz_pl 11y ago

We need technical capability for all the tier 1/2 boys to be able to tell if packets incoming from network X are legitimate, and drop them if they are part of currently ongoing attack. Afaik fixed silicon edge routers peering tier 1/2 networks were the biggest obstacle in filtering good traffic from spoofed/botnet one. Just a year ago we had huge problems when BGP rose to >512K entries, which is an order of magnitude easier. Did anything change since ~10 years ago? Last time I dabbled in this it was so bad even Tier3 (ISPs) werent filtering spoofed packets.

feld 11y ago
Technical capability exists. Everyone running BGP should be implementing BCP38. http://www.bcp38.info http://www.bcp38.info