4 ms·

Layer 7 attacks are the new hotness in DDoS. If you have a big enough botnet (either conventional botnet, or hijacked browsers), you can do them, and they're o

by rdl 11y ago

Layer 7 attacks are the new hotness in DDoS. If you have a big enough botnet (either conventional botnet, or hijacked browsers), you can do them, and they're often quite effective. Fundamentally, layer 3/4 are usually amplification. Those are still effective, and very efficient for the attacker, but they will someday (5y? 10y?) be blocked by closing up sources amplification. Address spoofing address at layer 3/4 might get addressed by BCP 38, Vixie's good fight, etc., but not holding my breath. By the time all that happens, attackers will have moved on to layer 7 attacks. Those can target the weakest parts of your stack, and with a large botnet, even the act of blocking the IPs in the wrong place can add enough overhead to hurt. With a huge botnet of hijacked browsers, blocking everyone affected becomes a DoS vector in itself, since some of those are your own legitimate attacks. The big problem for DDoS mitigation is that this requires much deeper knowledge of the protected application. It's hard to just put a box inline, or an unmodified cloud service, and have it block the attacks. There's both good science and great engineering to be done, by developers, platform vendors, and specialty anti-DDoS providers, to block this emerging kind of attack.

ryanlol 11y ago
>Layer 7 attacks are the new hotness in DDoS Maybe 10 years ago. >Fundamentally, layer 3/4 are usually amplification. Those are still effective, and very efficient for the attacker, but they will someday (5y? 10y?) be blocked by closing up sources amplification. Address spoofing address at layer 3/4 might get addressed by BCP 38, Vixie's good fight, etc., but not holding my breath. Sending "raw" UDP floods from bots still has several benefits over amplification attacks provided you can amass enough bandwidth, which isn't that difficult these days. >By the time all that happens, attackers will have moved on to layer 7 attacks. Those can target the weakest parts of your stack, and with a large botnet, even the act of blocking the IPs in the wrong place can add enough overhead to hurt. With a huge botnet of hijacked browsers, blocking everyone affected becomes a DoS vector in itself, since some of those are your own legitimate attacks. Unlikely, it'll take a fundamental change on how networks work for network layer attacks to become irrelevant. Especially considering volumetric attacks have the added benefit of potentially getting your target kicked off by their hosts and causing added damage in BW bills. And as internet connections become faster, DDoS attacks become bigger.
- rdl 11y ago
  Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs. If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers.
  - ryanlol 11y ago
    >Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs. But the "great cannon attack" was absolutely minuscule compared to the stuff that happens every day, attacks of similar sizes were already reasonably common years ago (See: http://i.imgur.com/0quYBdV.png http://i.imgur.com/0quYBdV.png a graph of an attack on reddit, from 2013). Today we're talking about Mrps, not Krps. >If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers. That'd just be sloppy filtering, there's no need to drop L7 attacks on IP basis.
rphlx 11y ago
I agree and IMO it's basically impossible to fully defend a dynamic site against a well-engineered L7 DDoS, short of operating at top-10-website scale and simply have more resources than the attacker(s). That does create a sort of "survival of the largest" effect which is a concern for smaller startups which anger or frighten a much larger competitor.

by rdl 11y ago

ryanlol 11y ago

>Layer 7 attacks are the new hotness in DDoS Maybe 10 years ago. >Fundamentally, layer 3/4 are usually amplification. Those are still effective, and very efficient for the attacker, but they will someday (5y? 10y?) be blocked by closing up sources amplification. Address spoofing address at layer 3/4 might get addressed by BCP 38, Vixie's good fight, etc., but not holding my breath. Sending "raw" UDP floods from bots still has several benefits over amplification attacks provided you can amass enough bandwidth, which isn't that difficult these days. >By the time all that happens, attackers will have moved on to layer 7 attacks. Those can target the weakest parts of your stack, and with a large botnet, even the act of blocking the IPs in the wrong place can add enough overhead to hurt. With a huge botnet of hijacked browsers, blocking everyone affected becomes a DoS vector in itself, since some of those are your own legitimate attacks. Unlikely, it'll take a fundamental change on how networks work for network layer attacks to become irrelevant. Especially considering volumetric attacks have the added benefit of potentially getting your target kicked off by their hosts and causing added damage in BW bills. And as internet connections become faster, DDoS attacks become bigger.

rdl 11y ago
Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs. If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers.
- ryanlol 11y ago
  >Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs. But the "great cannon attack" was absolutely minuscule compared to the stuff that happens every day, attacks of similar sizes were already reasonably common years ago (See: http://i.imgur.com/0quYBdV.png http://i.imgur.com/0quYBdV.png a graph of an attack on reddit, from 2013). Today we're talking about Mrps, not Krps. >If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers. That'd just be sloppy filtering, there's no need to drop L7 attacks on IP basis.

rphlx 11y ago

I agree and IMO it's basically impossible to fully defend a dynamic site against a well-engineered L7 DDoS, short of operating at top-10-website scale and simply have more resources than the attacker(s). That does create a sort of "survival of the largest" effect which is a concern for smaller startups which anger or frighten a much larger competitor.