10 ms·
Estimating the Revenue of a Russian DDoS Booter
- astrodust 11y agoUnder $100 for a large-scale DDOS attack is ridiculously cheap. It's no wonder these are getting freakishly common. Does anyone have a best-practices for dealing with the more modern variants?
- fweespee_ch 11y agoThere really isn't any beyond having a large pipe connected to a network device capable of filtering a high volume of pps. That has always been the problem with competently executed DDoS attacks. You need a very large pipe as Step #1 which is simply not cost effective for most businesses. :/
- patcheudor 11y agoDDoS is the antithesis to an open and free internet from a free market perspective because it drives people to a few select providers for hosting and CDN services. In the end, the big players in those spaces who have the bandwidth win. It's not so much about who has the best innovation either as DDoS tends to be all about brute-force.
- specialist 11y agoDDoS is the very exemplar of Freedom Markets (tm). Probably its defining quality. Functioning healthy markets require regulation, protection of property rights, fair and impartial court system, enforcement, etc, etc. In other words, just like there's no free lunch, there's no such thing as "free markets".
- DenisM 11y agoThere's a tiny bit of hope in there. The article claims that bots are polling CNC about once an hour (I suppose because they don't want to DOS themselves). So one option is to shift your service to a different domain name every hour, and notify your customers by email that they have to connect to a different host. This might be a lot of trouble, but may still allow you to support existing business relationships which is better than nothing. It get even better if you're publishing through a mobile app - that one can simply switch from one host to another on the fly without customer even being aware of the problem beyond a slight delay in connection. The list of hosts of would need to be distributed out of band as a tiny payload, either through a high-cost high-bandwidth channel (but in a very low volume, obviously, just the name of the new host), or via DNS TEXT records so that they are hard to decipher reliably and require custom programming and raise the cost of the attack. There might even be hosts that will hold your alternate host list for free, such as the iTunes App Store (app description or even an in-app purchase "description" field). Speaking of high-cost high-bandwidth providers, I think another option would be to host a CAPTCHa there, and those who solve it, or have cookies to prove that they did, or have logged in with a valid account, get redirected to one from the rotating lists of your normal hosts, with names and IP addresses changing every few minutes. An AJAXy application can then try different hosts in turn or in parallel before following a link.
- devicenull 11y agoMy reading was that their C&C monitoring stuff was polling once an hour, not the bots themselves
- scurvy 11y agoActually there are providers which will sell you a port ACL as part of their DDoS mitigation service. These ACLs can block almost all of the BS volumetric attacks which will cripple you. Everything gets blocked on the provider side. NTT's pricing is especially reasonable. TWTC has a similar service.
- fweespee_ch 11y agoYes. But once again, that is someone with a large enough pipe. People sell DDoS mitigation but that isn't anything close to a business being able to mitigate things and caring about best practices.
- scurvy 11y agoA 1gig circuit is a large pipe? Also, what are you talking about? Are you claiming that NTT nor TWTC can mitigate a DDoS attack? If so, you're massively wrong.
- fweespee_ch 11y ago> Also, what are you talking about? Are you claiming that NTT nor TWTC can mitigate a DDoS attack? If so, you're massively wrong. Both are in possession of large networks which allow them to mitigate DDoS attacks. The small business with the 1gbps pipe isn't "mitigating" the attack. Their provider is mitigating the attack in return for payment.
- lossolo 11y agoUse service like cloudflare, it's 250 dollars and you are UDP attacks completely free + a lot of TCP ones.
- jswny 11y agoCloudFlare protection can be easily bypassed. These types of proxy services which offer decently cheap DDoS protection are fine for defending against small-time attacks, however, plenty of attackers have scripts capable of bypassing them.
- lossolo 11y agoYou can't bypass with syn floods or udp flood. And if we are talking about size of attack in context of bandwidth, look at spamhaus and cloudflare case. That wasn't small. I admit that specialized, sophisticated attack from lets say top3 botnets would make damage and probably bypass cloudflare http protection. But if someone is making such an attack on you then probably you can afford getting prolexic.
- akenn 11y agoWhat scripts are capable of bypassing CloudFlare/proxy services and how do they do it? Do they look for old DNS records that leak their Origin IP or something like that?
- Kephael 11y agoFrequently there will be MX records or something similar pointing directly to the server. Even error pages can potentially leak a direct, unprotected IP.
- hrrsn 11y agoIf your email is hosted on the same machine as your web server, I don't think DDoS attacks are your highest priority.
- jswny 11y ago
- azernik 11y agoInteresting note - the stereotype is of Russian attackers attacking developed-world targets, but around 50% of the targets are in Russia.
- dublinben 11y agoAttacking competitors presumably?
- azernik 11y agoOr just attacking plain legal Russian targets - what we're getting in the US is likely just a spillover of the general computer crime problem over there. Although there was one interesting case cited here that's sort of "the competition" - some criminals' forum admin removed the botnet's ad, so they attacked the forum. And then the forum turned around and reported them to the police.
- kyledrake 11y agoHi. I run a thing that uses a lot of bandwidth. Repeat after me: I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I can not safely use usage-based pricing clouds like AWS and GCS until they get serious about the DDoS problem. I've brought this up before: https://news.ycombinator.com/item?id=11261882 https://news.ycombinator.com/item?id=11261882 https://news.ycombinator.com/item?id=11000086 https://news.ycombinator.com/item?id=11000086 Many people that are in denial about this. This article is not an outlier, this is exactly how DDoS is now. DDoSes are cheap to execute and devastating to the host. Your competitor will chip in a little Bitcoin and get these people to attack your site. Or they'll just do it because they're bored and it's basically free for them. I knew a guy that worked on a site, he told me they always got DDoSed every time his site put on a sale. Guaranteed DDoS. Who gets the $30,000+ bandwidth bill for the attack? Well, if you're using AWS or GCS, you do of course (it happened to Greatfire, why won't it happen to you?) 30x market bandwidth markups, zero DDoS mitigation. Good luck. Edit: Oh, and VPS providers (DigitalOcean, Linode) that just null route servers for hours or days during a DDoS: you're not off the hook either.
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- Scoundreller 11y agoMost residential Canadian internet connections have bandwidth caps. They're usually between 20gb and 200gb. Customers could only wish that their markup on overage was just 30x...
- wongarsu 11y agoBecause of economies of scale bandwidth in a datacenter is always going to be substantially cheaper than bandwidth in homes. Connecting thousands of homes to an internet backbone requires much more infrastructure than connecting one datacenter.
- bks 11y agoDennis you left the name of the Russian DDoS site in one of your images...you may want to consider cropping this.
- ZoF 11y agoHe explicitly states the site name in the article. No real reason to remove it imo. >ASERT keeps tabs on DDoS botnets and their attack activity with our BladeRunner botnet monitoring system and kypitest[.]ru is no exception.
- bks 11y agoExcept it's not that site - https://fuc***.ru/ https://fuc***.ru/ is where you can purchase these services.
- givan 11y agoThis problem exists mainly because the most used os doesn't have a package manager/app store or a secure and safe way to install software and it still doesn't because there is a huge av/security industry built to solve the problem it creates.
- AMcQuarrie 11y agoIt does, actually, it's just that a) nobody uses it and b) any time it gets brought up people rail against Microsoft for trying to tell them what to do with their computers.
- chefkoch 11y agoWhat has a dns relay attack to do with windows clients?
- foobartsimpson 11y agoI can't imagine that DDOS are an effective competitive technique? Are people really buying these against their competitors? I would have assumed that they were mostly part of ransom campaigns.
- chillydawg 11y agoI guess if you run yet-another-dog-food-store and you want to get more business, you target the top 3 competitors whenever they have sales events and at random throughout the year during busy periods. They'll lose custom to you and other stores because customers hate slow/broken sites. Just make sure you don't ddos everyone except yourself. Bit of a give away.
- erikb 11y agoPeople cheat. Especially if they think the cost is low and the chance of punishment is not high. Never assume that people are nice before lazy.
- lamontcg 11y ago$20k/yr, there goes my plans for quitting my dayjob...
- stordoff 11y agoFWIW, the images in this post fail to load if HTTPS Everywhere is enabled.
- madsravn 11y agoI'm no sure I understand why it was an error of forceful to show his MD5 and SHA1 hashes. Can anyone explain?
- notinreallife 11y agoHe uploaded the .exe of his malware to the malware checker sites (like virustotal) and then posted the hashes. You can look up the hashes on virus total and then get the executable.