4 ms·

Can anyone recommend a good article that explains how attacks like these work, and what is required to stop them? Also, we're on Heroku and they advertise Ddos

by jonahx 10y ago

Can anyone recommend a good article that explains how attacks like these work, and what is required to stop them? Also, we're on Heroku and they advertise Ddos mitigation as a feature, but "mitigation" sounds non-commital and I'm curious how they'd fare against a similar attack?

deleted 10y ago
[deleted]
whorleater 10y ago
Cisco has the easiest to grasp fundamentals [1], but to really understand DDOS attacks you'll have to dig down into learning about how TCP works and network layers. Mitigation sounds non-commital because it is. I don't personally have any experience with mitigating a DDOS attack on Heroku, so I'm not qualified to talk about their prepardness, but DDOS mitigation varies quite a bit [2][3], running the entire gamut of "block a single IP address" to "there's hundreds of IP's rotating and attacking". So the answer to that would be: it depends on who you've pissed off or who's feeling particularly nasty that day. [1]: https://www.cisco.com/c/en/us/products/collateral/security/traffic-anomaly-detector-xt-5600a/prod_white_paper0900aecd8011e927.html https://www.cisco.com/c/en/us/products/collateral/security/t... [2]: http://www.continuitycentral.com/index.php/news/technology/624-the-evolving-nature-of-ddos-attacks-separating-the-wheat-from-the-chaff http://www.continuitycentral.com/index.php/news/technology/6... [3]: https://www.radware.com/newsevents/mediacoverage/changing-challenging-ddos-attacks/ https://www.radware.com/newsevents/mediacoverage/changing-ch...
viraptor 10y ago
It's non-commital, because at some point, when you have enough zombie hosts properly distributed all over the world attacking you, your only defence is - have more bandwidth than the attackers. If your peers can't filter out the traffic before it hits your network and it simply saturates your pipes, there's nothing you can do inside the company anymore.
- jonahx 10y ago
  Thanks for the reply. Can you elaborate on what you mean by "peers" in the above? Eg, who (or what) would Heroku's peers be?
882542F3884314B 10y ago
The discussion [1] below was helpful to summarize the last DDoS attack and new controls implemented. [1] https://news.ycombinator.com/item?id=10998661 https://news.ycombinator.com/item?id=10998661

by jonahx 10y ago

deleted 10y ago

[deleted]

whorleater 10y ago

Cisco has the easiest to grasp fundamentals [1], but to really understand DDOS attacks you'll have to dig down into learning about how TCP works and network layers. Mitigation sounds non-commital because it is. I don't personally have any experience with mitigating a DDOS attack on Heroku, so I'm not qualified to talk about their prepardness, but DDOS mitigation varies quite a bit [2][3], running the entire gamut of "block a single IP address" to "there's hundreds of IP's rotating and attacking". So the answer to that would be: it depends on who you've pissed off or who's feeling particularly nasty that day. [1]: https://www.cisco.com/c/en/us/products/collateral/security/traffic-anomaly-detector-xt-5600a/prod_white_paper0900aecd8011e927.html https://www.cisco.com/c/en/us/products/collateral/security/t... [2]: http://www.continuitycentral.com/index.php/news/technology/624-the-evolving-nature-of-ddos-attacks-separating-the-wheat-from-the-chaff http://www.continuitycentral.com/index.php/news/technology/6... [3]: https://www.radware.com/newsevents/mediacoverage/changing-challenging-ddos-attacks/ https://www.radware.com/newsevents/mediacoverage/changing-ch...

viraptor 10y ago

It's non-commital, because at some point, when you have enough zombie hosts properly distributed all over the world attacking you, your only defence is - have more bandwidth than the attackers. If your peers can't filter out the traffic before it hits your network and it simply saturates your pipes, there's nothing you can do inside the company anymore.

jonahx 10y ago
Thanks for the reply. Can you elaborate on what you mean by "peers" in the above? Eg, who (or what) would Heroku's peers be?

882542F3884314B 10y ago

The discussion [1] below was helpful to summarize the last DDoS attack and new controls implemented. [1] https://news.ycombinator.com/item?id=10998661 https://news.ycombinator.com/item?id=10998661