4 ms·

I wish we could see an article like this for AWS.

caleblloyd 11y ago
I don't think AWS mitigates DDOS. If an app is under DDOS at AWS and was using an Elastic Load Balancer, the app would have to pay for the inbound bandwidth through the ELB and would have to pay for scale-up to respond to the increased traffic load. It'd be much more cost effective to pay CloudFlare a fixed monthly fee and stop the DDOS attack before it even gets to your AWS resources.
- themartorana 11y ago
  The more I read from CF, the more I'm impressed and am definitely considering this.
- virtuallynathan 11y ago
  Last time I looked at the AWS jobs site, they were hiring for a DDoS mitigation team.
  - pyvpx 11y ago
    having a slight understanding but no direct knowledge of their network infrastructure, that's probably for financial not technical reasons (they can handle the largest volumetric attacks and then some)
themartorana 11y ago
Agreed. We're full-stack AWS hosted, and I have no real indication of whether or not we've ever been attacked (doubtful) or if AWS could automatically mitigate an attack (possibly??). I presume Netflix is probably a common target, and they're AWS-heavy, but I have no way of knowing for sure.
- mschuster91 11y ago
  > I presume Netflix is probably a common target, and they're AWS-heavy, but I have no way of knowing for sure. Well, DDoS operators usually don't do their job for fun (okay, I'm discarding Lulzsec and other vandalism-motivated folks here). It's much more profitable to hunt for not-CDN-backed sites and extort them for money. Or to look for processor-heavy API endpoints (e.g. login with huge work factors) to improve the DDoS effectivity, but then again a lot of DDoS ops are script-kiddies looking for a quick bunch of monies, all too often not skilled enough for this.
- caleblloyd 11y ago
  ELB is simply a Reverse Proxy with an upstream pointing to your app servers. Last time I checked, I think they were running nginx. I doubt they have advanced DDOS detection code running on that reverse proxy. Netflix likely implements their own DDOS protection layer somewhere in their routing library. For example, since most resource-intensive Netflix endpoints are protected (you have to login to watch a movie), they could use rate-limiting based on User Account ID.
falcolas 11y ago
He last DDoS article from Amazon was a white paper which amounted to "we have enough capacity to let clients out-scale any attack." AKA it becomes a DDoS on your wallet instead of your server. Edit: found it. https://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June2015.pdf https://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June20...
rhavar 11y ago
I run one of the largest legal bitcoin gambling sites (name in profile if interested) and was recently extorted for a whole week by DDoS's unless I paid (something that I never would do). The specifics of our casino require us to have a pretty quality low-latency connection, so AWS was a first choice. I was recommended to use ELB which could mitigate the level3 attacks (primariy SYN floods we were seeing) and automatically scale. I setup a test instances, and tried orchestrate my own SYN flood which it handled without issue (while a normal ec2 instance would just collapse). So I put production behind ELBs, and a few hours later the attacks started. The first thing was that under stress ELB stops being able to make connections, and starts failing your origins for status check (even when they were getting no load), but was able to successfully scale to mitigate the attack within 5-7 minutes. The attacker tried again a few hours later, but it seems things were nice and pre-warmed and the attack didn't get far. For about a day there was a nice calm, and ELBs was performing absolutely fantastic (in terms of latency/jitter), and then I got the email that he's about to throw everything at me. And within a few minutes, he took out all the ELBs and it wasn't able to scale to handle the traffic for over an hour this time. During this time I was in contact with CF's excellent support, and they offered me protection for websockets. It has slightly more latency than ELBs, but is actually an anti-ddos service, and works wonderfully. Since being fully behind CF we've only had one DDoS related outage, and it was specific to Seoul for about ~3 or 4 hours. Can't recommend them enough, quite literally my business might not be around if it wasn't for them.
chinathrow 11y ago
https://www.youtube.com/watch?v=OT2y3DzMEmQ https://www.youtube.com/watch?v=OT2y3DzMEmQ

I don't think AWS mitigates DDOS. If an app is under DDOS at AWS and was using an Elastic Load Balancer, the app would have to pay for the inbound bandwidth through the ELB and would have to pay for scale-up to respond to the increased traffic load. It'd be much more cost effective to pay CloudFlare a fixed monthly fee and stop the DDOS attack before it even gets to your AWS resources.

themartorana 11y ago
The more I read from CF, the more I'm impressed and am definitely considering this.
virtuallynathan 11y ago
Last time I looked at the AWS jobs site, they were hiring for a DDoS mitigation team.
- pyvpx 11y ago
  having a slight understanding but no direct knowledge of their network infrastructure, that's probably for financial not technical reasons (they can handle the largest volumetric attacks and then some)

themartorana 11y ago

Agreed. We're full-stack AWS hosted, and I have no real indication of whether or not we've ever been attacked (doubtful) or if AWS could automatically mitigate an attack (possibly??). I presume Netflix is probably a common target, and they're AWS-heavy, but I have no way of knowing for sure.

mschuster91 11y ago
> I presume Netflix is probably a common target, and they're AWS-heavy, but I have no way of knowing for sure. Well, DDoS operators usually don't do their job for fun (okay, I'm discarding Lulzsec and other vandalism-motivated folks here). It's much more profitable to hunt for not-CDN-backed sites and extort them for money. Or to look for processor-heavy API endpoints (e.g. login with huge work factors) to improve the DDoS effectivity, but then again a lot of DDoS ops are script-kiddies looking for a quick bunch of monies, all too often not skilled enough for this.
caleblloyd 11y ago
ELB is simply a Reverse Proxy with an upstream pointing to your app servers. Last time I checked, I think they were running nginx. I doubt they have advanced DDOS detection code running on that reverse proxy. Netflix likely implements their own DDOS protection layer somewhere in their routing library. For example, since most resource-intensive Netflix endpoints are protected (you have to login to watch a movie), they could use rate-limiting based on User Account ID.

falcolas 11y ago

He last DDoS article from Amazon was a white paper which amounted to "we have enough capacity to let clients out-scale any attack." AKA it becomes a DDoS on your wallet instead of your server. Edit: found it. https://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June2015.pdf https://d0.awsstatic.com/whitepapers/DDoS_White_Paper_June20...

rhavar 11y ago

I run one of the largest legal bitcoin gambling sites (name in profile if interested) and was recently extorted for a whole week by DDoS's unless I paid (something that I never would do). The specifics of our casino require us to have a pretty quality low-latency connection, so AWS was a first choice. I was recommended to use ELB which could mitigate the level3 attacks (primariy SYN floods we were seeing) and automatically scale. I setup a test instances, and tried orchestrate my own SYN flood which it handled without issue (while a normal ec2 instance would just collapse). So I put production behind ELBs, and a few hours later the attacks started. The first thing was that under stress ELB stops being able to make connections, and starts failing your origins for status check (even when they were getting no load), but was able to successfully scale to mitigate the attack within 5-7 minutes. The attacker tried again a few hours later, but it seems things were nice and pre-warmed and the attack didn't get far. For about a day there was a nice calm, and ELBs was performing absolutely fantastic (in terms of latency/jitter), and then I got the email that he's about to throw everything at me. And within a few minutes, he took out all the ELBs and it wasn't able to scale to handle the traffic for over an hour this time. During this time I was in contact with CF's excellent support, and they offered me protection for websockets. It has slightly more latency than ELBs, but is actually an anti-ddos service, and works wonderfully. Since being fully behind CF we've only had one DDoS related outage, and it was specific to Seoul for about ~3 or 4 hours. Can't recommend them enough, quite literally my business might not be around if it wasn't for them.

chinathrow 11y ago

https://www.youtube.com/watch?v=OT2y3DzMEmQ https://www.youtube.com/watch?v=OT2y3DzMEmQ