3 ms·

>Layer 7 attacks are the new hotness in DDoS Maybe 10 years ago. >Fundamentally, layer 3/4 are usually amplification. Those are still effective, and very effi

by ryanlol 11y ago

>Layer 7 attacks are the new hotness in DDoS Maybe 10 years ago. >Fundamentally, layer 3/4 are usually amplification. Those are still effective, and very efficient for the attacker, but they will someday (5y? 10y?) be blocked by closing up sources amplification. Address spoofing address at layer 3/4 might get addressed by BCP 38, Vixie's good fight, etc., but not holding my breath. Sending "raw" UDP floods from bots still has several benefits over amplification attacks provided you can amass enough bandwidth, which isn't that difficult these days. >By the time all that happens, attackers will have moved on to layer 7 attacks. Those can target the weakest parts of your stack, and with a large botnet, even the act of blocking the IPs in the wrong place can add enough overhead to hurt. With a huge botnet of hijacked browsers, blocking everyone affected becomes a DoS vector in itself, since some of those are your own legitimate attacks. Unlikely, it'll take a fundamental change on how networks work for network layer attacks to become irrelevant. Especially considering volumetric attacks have the added benefit of potentially getting your target kicked off by their hosts and causing added damage in BW bills. And as internet connections become faster, DDoS attacks become bigger.

rdl 11y ago
Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs. If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers.
- ryanlol 11y ago
  >Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs. But the "great cannon attack" was absolutely minuscule compared to the stuff that happens every day, attacks of similar sizes were already reasonably common years ago (See: http://i.imgur.com/0quYBdV.png http://i.imgur.com/0quYBdV.png a graph of an attack on reddit, from 2013). Today we're talking about Mrps, not Krps. >If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers. That'd just be sloppy filtering, there's no need to drop L7 attacks on IP basis.

by ryanlol 11y ago

rdl 11y ago

Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs. If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers.

ryanlol 11y ago
>Browser JS insertion on HTTP is pretty novel; it was done with ad networks a few times, but never at the scale of the GitHub/Great Cannon attack. Using an existing botnet certainly was fine, but for most sites, blocking botnet IPs doesn't cause as much collateral damage as blocking compromised-browser IPs. But the "great cannon attack" was absolutely minuscule compared to the stuff that happens every day, attacks of similar sizes were already reasonably common years ago (See: http://i.imgur.com/0quYBdV.png http://i.imgur.com/0quYBdV.png a graph of an attack on reddit, from 2013). Today we're talking about Mrps, not Krps. >If you did a watering hole attack, doing JS injection on a really popular "show HN" post on HN, against HN, you'd be effective in getting HN to block the IPs of a large percentage of real users, which would hurt, even if HN could repel the attack entirely. Blocking 50k random botnet IPs wouldn't really affect many regular HN readers. That'd just be sloppy filtering, there's no need to drop L7 attacks on IP basis.