20 ms·

Akamai takes Brian Krebs’ site off its servers after ‘record’ cyberattack

658 points by bishnu 10y ago

betaby 10y ago
I would like to see stats from Tier1/Tier2/IX for that. Krebs claims it's 665Gbit/s https://twitter.com/briankrebs/status/778404352285405188 https://twitter.com/briankrebs/status/778404352285405188 Such attack must be visible in many places, however not a single major ISP reported that in mailing list. Previous smaller attacks were reported 'slowing down' some regional ISPs. Perhaps ISPs got better.
- solotronics 10y ago
  theoretically if it was a well distributed bot net then it could be a few megs from a TON of different sources.. and since akami had their own ASN it could just be jamming up Akami and not other AS
- Gelob 10y ago
  I've seen the graphs from prolexic, the claims are legit
- morecoffee 10y ago
  In a world of 10 and 40 gigabit NICs, why is 665 considered big?
  - Jweb_Guru 10y ago
    Because you have to classify and filter out the spam packets before they reach the intended host and content, which is really hard to do at line rate, especially if you also plan to serve useful traffic.
    - tdy721 10y ago
      I really like this comment. I think you're saying that moving data is easy, while computing the data hasn't kept up? Then again, I could be reading into this too much, and the computing part has always been a bottleneck at backbone level.
      - alkjshdkfjasdf 10y ago
        It seems to me that he's saying in order to move data at volume, you have to compute on it. Computation is tricky. Per-bit, if you can handle the network input, you're probably able to fire packets up to the OS layer. But when you need to run stats on the incoming data, e.g. an ML classifier of "bad/not bad" or "stop/passthrough", you might be O(n^2) or worse. Moore's can't hang.
        dharma1 10y ago
        Interesting. What ML algos are used to classify packets against DDoS?
        violentvinyl 10y ago
        I think that's the secret sauce for these quys. I'd be surprised if you can find out a lot about current techniques without signing an NDA and leaving your mobile phone in a box at security.
        windowsworkstoo 10y ago
        None, really. It's mostly filters against common types of attacks at L3/L4, then OODA. Variations from normal get looked at and custom filters applied as appropriate. And of course, there's lots of NOC to NOC back channel comms around this stuff constantly to stay relatively on top of things.
        maksimum 10y ago
        Not sure if this applies to DDoS, but a baseline ML method for security is outlier detection. For example, (1) you get a dataset that is mostly "good" data, with some "bad" data (2) you cluster it using something fast like k-means (3) data points are labelled as outliers if they fall further than some threshold from a cluster center.
      - dredmorbius 10y ago
        Linespeed is pretty fast, and there's a lot moving through. Routers are a bit like GNU grep -- they way to be fast is to not touch most of the data. The more you have to touch, and the deeper you have to touch it, the more expensive it gets. The real trick is figuring out what's good, what's evil, and downrating the latter whilst allowing the good. Given peering relations, BGP routing, and the sorry state of much of those protocols, tracing problems to their source, quickly, and getting a useful response, is difficult.
    - morecoffee 10y ago
      I still don't get it. Why not just absorb it? Serving static HTML and related data is fast. A single rack in a datacenter could easily serve this with out breaking a sweat. Sure, this costs Akamai money they don't want to spend, but is such an attack noteworthy? Eh.
      - noselasd 10y ago
        You'd still be filling the pipe. And possibly filling many small(er) pipes at interconnection points. The last meters of pipes into a rack isn't where the issues are.
      - Retr0spectrum 10y ago
        If the tiny "GET" requests are flooding in at 1Tbps, then the responses are going to be orders of magnitude larger, maybe somewhere around 500Tbps
      - Jweb_Guru 10y ago
        I'm curious, what sort of datacenter racks do you run that can serve 665 Gbps of traffic? For instance, Google's ToR switches (in its own datacenters) as of Jupiter (2012) were 16x40G, which is just 640 Gbps. Obviously, all of Google can serve a lot more than that, and you can get absurd stuff like 640-port Infiniband etc., but you seem to have pretty unrealistic ideas about network capacity. And, as another comment pointed out, that's just the input for this attack... the output would be a lot larger.
  - lsc 10y ago
    you need 665 gigabits of idle capacity to... wherever the attacker is coming from. If the attacker can send five gigabits from some town in vermont, and your provider(s) can't get five gigabits plus normal traffic from that town in Vermont to your scrubbers, then legitimate users within those networks will be denied service, even if users on other networks are just fine. Essentially, it comes down to the fact that getting packets from point a to point b requires a lot of cooperation, and cooperation is difficult. Yes, yes, if you bought me the fiber, I could build you a 665 gigabit network, on the kind of money that a nerd could come up with, (not counting the fiber) but interconnecting that network with other people's networks? yeah, that's gonna cost you. Settlement-free peering is a thing, but it is really difficult to set up and maintain those relationships.
  - rkangel 10y ago
    The limitation isn't the NIC, it's the processor (and possibly storage). The 10 and 40 Gigabit NICs exist but processing them on a conventional PC is hard. It is, just about, possible to perform actions on every packet in a 10Gb stream on an x86 machine. You have to use a userspace stack, handle packets across multiple cores, and be VERY careful with what you are doing so you don't do cache misses. At 10Gb/s you're talking only a few hundred clock cycles per packet - anything that doesn't work as planned causes massive backlog. Now try serving (dynamic) HTTP to that.
  - tgpc 10y ago
    Because 665 is a bigger number than 10 and 40 :-)
- lossolo 10y ago
  Akamai has ~140 000 servers around the world. Attack was probably spread around many locations that's why you don't see any report on mailing lists.
ckdarby 10y ago
The ddos attacks seem to be getting larger these days. I've recently seen a ~200 Gbit/s hit us. Does anyone have good resources around mitigation? I was looking at the BGP flowspec but was hopefully that someone might have come across other tactics?
- betaby 10y ago
  Yes, here is a very good described by OVH http://media.frnog.org/FRnOG_24/FRnOG_24-3.pdf http://media.frnog.org/FRnOG_24/FRnOG_24-3.pdf
- blhack 10y ago
  >The ddos attacks seem to be getting larger these days. Consumer bandwidth is increasing.
- jedisct1 10y ago
  Take a look at FastNetmon: https://fastnetmon.com/ https://fastnetmon.com/
pitaj 10y ago
tl;dr Akamai was hosting his site pro bono. His site was being DDOSed, which cost Akamai a ton of money, so they kicked him off since they were literally only losing money on the deal.
- benmarks 10y ago
  Yes, courteously and graciously verified by him on Twitter: "Before everyone beats up on Akamai/Prolexic too much, they were providing me service pro bono. So, as I said, I don't fault them at all." https://twitter.com/briankrebs/status/779111614226239488 https://twitter.com/briankrebs/status/779111614226239488
- Confusion 10y ago
  Why would it cost Akamai a ton of money? If they already have the infrastructure and automation in place to mitigate such attacks, it wouldn't be a lot of work and would not require additional resources to mitigate this attack? And as others have said: isn't this bad PR?
  - rasz_pl 10y ago
    all those botnets ddossing Krebs = less DOSses for the rest of us = less new clients for Akamai ;)
  - ejcx 10y ago
    You still have to pay for bandwidth and if the attack began impacting SLAs and paying customers, that's bad for business.
- dingaling 10y ago
  > tl;dr Akamai was hosting his site pro bono Let us not permit companies to co-opt language for their benefit. If it was genuinely pro bono ( lit: for the public good ) then they would have taken all steps possible to keep the site online since the public good was served more by having Mr Krebs online than not. However, in this case they were hosting him free-of-charge because it was good publicity for them. That's a very different scenario.
redorb 10y ago
Cloudflare should pick up the site for good advertising..
- bdcravens 10y ago
  Cached version where Krebs paints picture of Cloudflare supporting DDoS: http://webcache.googleusercontent.com/search?q=cache:0uf9RIu0ZswJ:krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu...
zx2c4 10y ago
Isn't this the point at which Cloudflare is supposed to gain a handful of PR points for putting him back online, pro bono, and then doing a write up on how effortlessly they handled the bandwidth with eBPF?
- Jweb_Guru 10y ago
  Unfortunately, Krebs has (correctly) repeatedly attacked Cloudflare for sheltering most of the most prolific DDOS attackers. I doubt that's going to happen.
  - zx2c4 10y ago
    Care to fill in the details for me? Do you mean to say the most prolific DDoS attackers work for Cloudflare? Or that their network somehow (?) shelters them? What do you mean exactly? This sounds interesting.
    - Jweb_Guru 10y ago
      There's another comment that links to one of his posts about it (http://webcache.googleusercontent.com/search?q=cache:0uf9RIu0ZswJ:krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu...).
    - invokestatic 10y ago
      Cloudflare hilariously acts as a reverse proxy for booters and does not respond to abuse reports against them.
      - kyledrake 10y ago
        I can confirm that this is true. "Hilarious" is not the word I would use to describe it, "potentially criminal" I think is closer to correct.
        10y ago
reustle 10y ago
It would be interesting to try out some of these new p2p website technologies like IPFS/WebTorrent with these high profile sites who are frequently attacked.
- vmp 10y ago
  +1 for IPFS Hosting static blogs is really easy on IPFS (and if you absolutely can't live without comments: use disqus) but the URL's are cryptic and you either need a public IPFS gateway to access the site - which could get DDoS'ed - or run your own. Another alternative is ZeroNet but you still need to run the client to access the site.
  - whyrusleeping 10y ago
    IPFS team member here: If the URLs are cryptic, you can use dns to make them look nicer. Take a look at the TXT record for ipfs.io, as well as the TXT record for _dnslink.ipld.io Both of those websites are hosted through ipfs and have A (or CNAME) records pointing to our gateways. You can also access this locally if you happen to be running an ipfs daemon at http://localhost:8080/ipns/ipfs.io http://localhost:8080/ipns/ipfs.io
    - phunehehe0 10y ago
      A little hard to find, but this is well described in https://github.com/ipfs/examples/blob/5d77470eb5ae944aa540934e5eeb71a9d862877f/examples/websites/README.md https://github.com/ipfs/examples/blob/5d77470eb5ae944aa54093....
      - vmp 10y ago
        That's awesome, not sure if this was around last time I tried but it is still hard to find, thanks! :)
Globz 10y ago
At this scale it must also cost a ton of money to carry out this attack, I wonder if there's a vulnerability that we don't know about that let them do this so easily?
- toomuchtodo 10y ago
  > At this scale it must also cost a ton of money to carry out this attack It doesn't; you're using compromised machines to initiate the attacks, which is free to you.
  - derefr 10y ago
    You're almost never using machines you compromised. Instead, you're using someone else's compromised machines: a botnet-backed DDoS-ing service, which you rented on the open (black) market, at the going rate. Bigger attacks still cost more in such setups—whether or not the botnet nodes were free to acquire, the resulting network is still a scarce resource whose price rises with demand. (Of course, in the very special case of Krebs, the people he is reporting on frequently are the owners of the botnets, who can of course use their own botnets freely.)
- kev009 10y ago
  Well, no, if you are committing crime you can just use illegally pwned computers.
parshimers 10y ago
Quite impressive. You know your blog is good when folks will try to take down a CDN to supress what's on it. He's also had heroin mailed to him in combination with a swatting attempt before: http://webcache.googleusercontent.com/search?q=cache:gEjqPfcbtlgJ:krebsonsecurity.com/2015/10/hacker-who-sent-me-heroin-faces-charges-in-u-s/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:gEjqPfc...
- gnarbarian 10y ago
  holy shit. that is terrifying.
  - ddorian43 10y ago
    Normal game streamers get swatted and sending heroin would be easy with the silkroad-alternative market online.
    - untog 10y ago
      Does that in any way negate the fact that it is terrifying?
      - ddorian43 10y ago
        No.
  - 1ris 10y ago
    Could have been child porn.
    - BinaryIdiot 10y ago
      An almost horrible, related story: When I was in middle school and the internet was still fairly new (we had just gotten it) a classmate of mine hatched a terrible plan to get rid of a teacher he hated. He waited until the teacher was out sick one day then during the substitute's typical teaching pattern of having us "read these 3 chapters, answer questions then keep your head down until class is over" he jumped on the teacher's computer. After reassuring the substitute that he was allowed to he tried desperately to find child porn. His plan was to save it into semi hidden folders onto the computer then later on turn the teacher in for having child porn. Fortunately this classmate wasn't able to find any and eventually gave up. But I've always remembered his plan. It's terrifyingly believable that if someone managed to get into your computer and download child porn, there is likely little recourse or way to prove you did not do it.
panic 10y ago
This recent talk about DDoS attacks is worth a watch if you're curious about why it's a hard problem to solve: https://www.youtube.com/watch?v=79u7bURE6Ss https://www.youtube.com/watch?v=79u7bURE6Ss
- dtnewman 10y ago
  Starting watching this and he gives a great explanation of the issue. Thanks for sharing.
geofft 10y ago
https://twitter.com/briankrebs/status/779111614226239488 https://twitter.com/briankrebs/status/779111614226239488 "Before everyone beats up on Akamai/Prolexic too much, they were providing me service pro bono. So, as I said, I don't fault them at all."
xarope 10y ago
I tried to get to an article on Krebs' site from a Bruce Schneier blog post, and couldn't, then bumped into this post in HN. It's a pity Akamai booted him off; on the one hand, I can understand that it would significantly impact on their SLAs to other customers, but on the other hand it's a shame they don't have a lower impact network to re-host him on, and use this as a learning lesson on how to better mitigate such DDoSs...
known 10y ago
Is it according to terms/conditions of Akamai?
- mmel 10y ago
  What is 'it' that you are referring to?
- Twirrim 10y ago
  Akamai were providing him hosting free of charge, but the size of the attack will have had not insignificant financial impact on them, and on their customers. It's completely understandable that they've chosen to terminate their hosting agreement at this time. https://twitter.com/briankrebs/status/779111614226239488 https://twitter.com/briankrebs/status/779111614226239488 https://twitter.com/briankrebs/status/779062433902170112 https://twitter.com/briankrebs/status/779062433902170112
exolymph 10y ago
It would be interesting if he started writing on Medium (not saying technically advisable, just interesting). I wonder if he'd ever consider trying that.
- okwhatthe2 10y ago
  Why would it be interesting?
  - exolymph 10y ago
    To see how Medium would deal with massive DDoS attacks and whether they'd kick Krebs off.
- angry-hacker 10y ago
  Why would he give away advertising dollars? Also, medium is bad. Everyone now thinks if you publish something on medium, the writing is suddenly a masterpiece.
dragonbonheur 10y ago
Who profits from this attack?
- wmf 10y ago
  Someone's ego.
  - joshmn 10y ago
    LOL LOOK WE TOOK HIM OFFLINE HAHAHA HIS LIFE IS OVER
    - kevingadd 10y ago
      Well, if your site needs to be online and processing payments so your company can pay salaries and rent, a week (or month) long DDOS would basically end things for you... Everywhere I've worked, a DDOS like this would basically be an emergency.
      - pbarnes_1 10y ago
        Not many companies can go a week (let alone a month) without revenue.
    - sctb 10y ago
      Please don't post unsubstantive comments like this on Hacker News. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
josho 10y ago
I'd love to learn more about these botnets. I wonder about things like What's the average time that a compromised computer stays in this net. What is the typical computer (grandmas old PC running XP). Do the ISPs ever get involved to kill bots running on their networks?
- solotronics 10y ago
  for the most part ISP are not set up to defend or stop DDoS from within their network. Do you go to a road building company to stop car thieves?
  - zeeZ 10y ago
    If that road building company also collects tolls and controls access to their roads you sure as hell do
    - jethro_tell 10y ago
      Well that's the state. His analogy is like saying 'why would your fiber splicer police this.'
  - jethro_tell 10y ago
    no you don't because that's a bad analogy. We do however go to states and could ties to protect the infrastructures they paid the contractor to build. ISPs are uniquely situated to stop this kind of ddos because the traffic originates from IPs they don't own. The traffic has a spoofed from address. And as a rule, the ISP.should only need to send traffic out of a neighborhood from the block of IPs that is assigned to that neighborhood. You can put a filter on every switch or even every interface allowing only traffic from the IP or IPs on the other side of the link to send traffic. A company like Comcast could make it default part of account setup scripts. If everyone did that, these would disappear over night.
    - ghshephard 10y ago
      Aren't there botnets that use their actual source address when spamming a DDOS target? How do you defend against that type of attack?
dragonbonheur 10y ago
Are there web servers or software that blacklist IP addresses that disconnects after a short time and redirects them to a static page?
- samplonius 10y ago
  Yes, but they can be flooded as well. Every system is going to have a finite capacity. And if the capacity is exceeded, the system will slow. If the capacity is significantly exceeded, it will become unreachable itself. So if the capacity of your system is X Gbps, then it will start to have problems if the attacker sends X + 1 Gbps. And will probably be completely unreachable if the attacker sends X * 2 Gbps.
flashman 10y ago
> “I likely cost them a ton of money today.” But more specifically, whoever launched the attack cost them that money. Also, ha: PING krebsonsecurity.com (127.0.0.1): 56 data bytes
- guessmyname 10y ago
  I would say that is a clever move, but to be honest that is the most he can do now. https://twitter.com/briankrebs/status/779144394360381440 https://twitter.com/briankrebs/status/779144394360381440 @ 123 IN SOA ns1.prolexic.net. hostmaster.prolexic.com. 2016092204 86400 900 1209600 3600 @ 900 IN NS ns1.prolexic.net. @ 900 IN NS ns2.prolexic.net. *@ 300 IN A 127.0.0.1 @ 300 IN MX 10 smtp.krebsonsecurity.com. @ 300 IN TXT "v=spf1 ip4:... ip4:... ip6:... a mx ?all" m 300 IN CNAME krebsonsecurity.mobify.me. smtp 900 IN A 198.251.81.28 *www 300 IN A 127.0.0.1
- kijin 10y ago
  It might be more useful to return the IP address of whoever made the DNS query. This could trick the computers that make up the botnet to either attack themselves on the public interface (more resource-intensive than trying to DDoS your own loopback), or even better, their ISP's resolvers (it would force the ISP to do something about it).
  - staticfloat 10y ago
    With the recursive nature of DNS, I imagine that could get a little hairy as the DDoS'ers would then be targeting whichever DNS servers they were using.
- DCoder 10y ago
  > PING krebsonsecurity.com (127.0.0.1): 56 data bytes Reminds me of: https://twitter.com/troyhunt/status/716408697266679808 https://twitter.com/troyhunt/status/716408697266679808
zaidf 10y ago
He should get a Facebook page and publish a copy of all his posts on it.
- Jupe 10y ago
  Interesting idea, but probably doesn't go far enough... Perhaps he should re-post his blog articles everywhere: Facebook, flickr, tumbler, watpad, wordpress, various feedback forums, etc. Combat a DDoS attack with a DPD (distributed publishing defense - just made that up)
  - nikcub 10y ago
    That would harm his business model, which is advertising. It could work with Facebook Instant Articles, he may even be better off using it since they source the advertising and have been out trying to poach and source quality content.
- sandGorgon 10y ago
  I was going to say a different version of this. Real men mirror. Krebsonsecurity deserves to be on git and use something like Jekyll. Mirror it instantly in a hundred different places.
  - GFK_of_xmaspast 10y ago
    Why do you have to bring gender norms into this.
    - sandGorgon 10y ago
      I'm sorry if it came off that way .. I thought the reference was well known. http://quotes.yourdictionary.com/author/linus-torvalds/190296 http://quotes.yourdictionary.com/author/linus-torvalds/19029...
      - GFK_of_xmaspast 10y ago
mirekrusin 10y ago
Isn't this whole thing a bit silly? I mean what's the point? They just spend time on making him the best marketing, he'll double his audience/readers, no?
- Arcsech 10y ago
  The point isn't to cost Krebs readers most likely. It's to show off how awesome this bonnet is. I'd guess the DDoSer is jumping with joy over this news actually, because now the DDoSer can advertise his service with "I DDoSed Krebs so hard Akamai had to drop him!"
- codedokode 10y ago
  They have shown who is stronger and probably got some PR for their DDOS services.
ttam 10y ago
so long for using a CDN to protect from DDOS attacks...
- caryhartline 10y ago
  There are different tiers. Some people can get away with using a CDN because they aren't that big of a target.
- brazzledazzle 10y ago
  This was prolexic, a ddos protection service purchased by Akamai.
desireco42 10y ago
I understand that this is burning bandwidth for Akamai, but seriously, taking into account what is at stake here, I think they need to do their share and continue to support Brian.
EGreg 10y ago
Why don't we switch to a distributed network with a DHT like freenet? So many benefits, including not being able to take down content via DDOS.
- JamesLeonis 10y ago
  The DHT can still be attacked. Here's three methods: 1: Take out the bootstrap nodes. These are several nodes that bootstrap a new client into the DHT system. BitTorrent, Inc. keeps a couple such nodes. On first boot, the client registers it's DHT address and collects a few from the bootstrapping node. The client could then can traverse the network itself. By knocking out these nodes, newly started clients now have to browse the whole IP space for possible DHT clients, which is not feasible. 2: Attack the peers themselves. A malicious program could traverse the network searching for DHT peers in the same way. At first, it would only collect a large number of DHT addresses and their corresponding nodes. Once a sufficient mass is gained, each is targeted with a low level DDOS to knock them offline to further requests. Most of these peers will be homes and local ISPs, which can't effectively deal with DDOS traffic themselves. Others trying to connect to a down client will eventually remove them from their own address space for later queries. 3: Poison DHT peers. This is probably the hardest, but once complete could poison an entire network with a switch. On each of your compromised Bot machines, you make a valid DHT node. Make a LOT of these (like a Botnet). For the most part, participate correctly with the DHT network. Collect as many valid/real DHT user and content addresses as you can and host them in your nodes. When it's time to attack, prevent these valid DHT addresses from resolving on inquiry. Even better, make them go in the wrong direction and infinitely pass around requests to other poisoned bots in your ring to prevent resolution but not hang the process. This is especially useful for content attacks because it attacks the content addresses themselves.
  - Dylan16807 10y ago
    1a. A system could be made for bootstrap links that have the addresses of a few nodes in them. 1b. When you have 10 million nodes like torrents, you can go searching random IPs. As long as many nodes bind to the same ports. 2. Sure, if you have comparable bandwidth to the entire network you can take it down. But that's a lot harder than overwhelming a single target. Nobody can send 20mbps each to millions of IPs. 3. This is the method that takes the least resources, but pretty good countermeasures can be made.
rabboRubble 10y ago
Here's a link to the last post from his website. Google did not appear to have this cached: https://archive.fo/t94ve https://archive.fo/t94ve
- anotheryou 10y ago
  relevant quote from that: ››Many readers have been asking whether this attack was in retaliation for my recent series on the takedown of the DDoS-for-hire service vDOS, which coincided with the arrests of two young men named in my original report as founders of the service. I can’t say for sure, but it seems likely related: Some of the POST request attacks that came in last night as part of this 620 Gbps attack included the string “freeapplej4ck,” a reference to the nickname used by one of the vDOS co-owners.‹‹
  - 24gttghh 10y ago
    I'd err on the side of caution and consider that string a Red Herring without more evidence to corroborate the claim. It is a nice coincidence though...
    - anotheryou 10y ago
      I'm just here for the popcorn :)
deleted 10y ago
[deleted]
WhitneyLand 10y ago
This is bad PR for Akamai and a tactical error for them to boot Krebs even if they were providing free service. To some, the implication would will be "they couldn't handle it" so why should I trust the DDOS they are heavily promoting on their site? At minimum they should comment on the situation, at best restore his service and learn how deal with high profile clients.
- cft 10y ago
  Even if they tried to mitigate and quietly semi failed (like 30% packet loss) the PR would have been better. It could be that such attack takes down their entire network hard. Verisign said a year ago to us they could mitigate 2Tbps for comparison.
  - pbarnes_1 10y ago
    Akamai can easily mitigate this. They just don't want to provide it for free. And pretty much no one can afford to use their services @ 655Gb/s for that long unless they had billions of $.
    - cft 10y ago
      Well a single 48 hr mitigation costs 12k/yr contact. Unlimited mitigations probably cost about 130k/yr. Either this negative PR is worth 12-100k in savings for them or they would drop any paying customer if the attack is over a certain threshold?
      - 4ad 10y ago
        They might bill you that money, but on average it costs them less to provide that service to you, otherwise they wouldn't make any money. Because we don't know the operating margins and the distribution of DDoS costs per customer, we can't infer how much this particular attack would cost Akamai.
  - krzyk 10y ago
    According to Kerbs (https://twitter.com/briankrebs/status/778398865619836928 https://twitter.com/briankrebs/status/778398865619836928) Akamai did mitigate this DDOS, they kicked him of after the attack, not during.
nodesocket 10y ago
Brian Krebs' wasn't a paying customer right? Akamai provided the service pro-bono. Perfectly acceptable for them to suspend service if it becomes more than trivial in terms of cost or it puts their paying customers at risk.
ChuckMcM 10y ago
Wow, I figured that everyone that had hired vDOS would be irritated but that is pretty impressive. Still it says a lot for how effective he has been at rooting out this stuff, not like the TierN infrastructure folks have managed to track this stuff down with their resources.
nodesocket 10y ago
I've always wondered if your domain is under a http DDoS attack, couldn't you in theory update your DNS A record to another ip and take other servers down (maliciously)?
- Jweb_Guru 10y ago
  Most DDOS attacks are launched directly against the IP, so it wouldn't really help.
xarope 10y ago
Here's a "philosophical" question with regards to the internet, and perhaps even it's future. Given that a currently anonymous attacker, and likely not a "state" player (i.e. not a governmental entity with almost unlimited resources) has managed to DDoS a single website, does this portend that unless there are significant changes to the way the internet infrastructure works, we are seeing the demise of the WWW? Kind of like a reverse wild-wild-west evolution, where the previously carefully cultivated academic and company site presence, gradually degenerates into misclick-hell? And the non-technical, non-IT savvy masses, in a bid to escape this all, end up in a facebook-style future where media is curated and presented for consumption (or perhaps in future, facebook-type entities end up with their own wild-wild-west hell)? I have a strange feeling that we are seeing the decline of a city/civilisation; once you used to feel safe walking out at night, knew everybody in the neighbourhood, could leave your doors unlocked... and now, you don't dare to go down the lane to the left in case you pick up a nasty virus, and if you hear a knock on the door at night/email from DHL, you don't dare to even look through the peephole/preview the JPG!
- tdy721 10y ago
  Perhaps its the government? Lots of people think all these NSA programs are evil surveillance, could be it's just the glue that has saved us from just this. I'm personally amazed that people don't get hacked more often TBH... I can't think of any instances where non-technical people have been pwned in my own life. I personally have a pa55word that I use for sites I don't trust, but the accounts never seem to fall or even falter. It's amazing really.
  - kardos 10y ago
    There's too many people in the general population to target them one by one, but > I'm personally amazed that people don't get hacked more often ... the machines participating in the DDOS are (almost entirely) hacked, yes?
- samplonius 10y ago
  You are not the first to come up with this idea. This same thought has been posted every year for the past 20 or so years in mailing lists, forums or Usenet (thought lately, not too often to Usenet). I think prevention should be emphasized. If there wasn't so much garbage plugged into the Internet, there wouldn't be huge botnets to send DDoSes. There are few groups that scan the Internet for vulnerable systems, and rather than compromise them, send notices to the ISPs. In Canada, the CCIRC does this. But they only check IP blocks assigned to Canadian ISPs and enterprises. Plus, why do so many ISPs still allow spoofing of IPs? It isn't 1999 anymore. We should start a grass roots group to talk to everyone they meet, and get people to update their OSes, devices, and get rid of crap.
tuna-piano 10y ago
Some are guessing the DDOS was because of this recent post of his, about a large DDOS network. http://webcache.googleusercontent.com/search?q=cache:kaymYsbcGc8J:krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:kaymYsb...
hetfeld 10y ago
You'll be redirected in... never redirected.
rasz_pl 10y ago
I think its time for some serious financial incentives for ISPs to start getting serious about routing (or rather not routing) garbage. Financial fines for every DOS originating from your AS, or blacklisting if you are a repeated offender.
- samplonius 10y ago
  There is an incentive: it is the cost of transit. However, there usually are not a lot of zombies per single ISP for the access level ISP to even see any abnormal traffic. The best thing is that access ISPs need to implement BCP38 (https://tools.ietf.org/html/bcp38 https://tools.ietf.org/html/bcp38). And shutdown all open recursive DNS servers. It would be great if Microsoft didn't ship such a retarded DNS server too. I would say that most ISPs do not do this. NTP really should be replaced with something better. There are still large numbers of NTP amplification attacks going on. The big issue with NTP today, is that by default ntpd in daemon mode, is also a NTP server and responds to NTP requests. And so many of the two bit home routers run ntpd. But the reality is, that no one is even reporting DDoSes right now. I work at an ISP, and I haven't seen a DDoS report in the past year. We pro-actively scan for open DNS and open NTP services. But many DDoS attacks just use regular HTTP/HTTPS, are hard to detect at the individual network connection level. Do you think Akamai sent out a single notice to any ISPs, saying "The following X IPs are sending excessive traffic to site Y, and are suspected to be part of a botnet"?
ninja-wannabe-7 10y ago
Should've used CloudFlare.
saganus 10y ago
So if Akamai can't hold an attack of this size, who can? Or is it that they actually can hold it off but it costs too much money?
- jedisct1 10y ago
  Cloudflare and OVH (that got a 1.1 Tb attack around the same time, the biggest in history) certainly have the capacity to hold attacks of that size. Akamai may also have the capacity, but bandwidth is not free.
headmelted 10y ago
Still not a good move for Akamai, though. I get him speaking out for them about the hosting having been free, but Akamai is now the CDN that got bullied into kicking someone of their service against their own will. Terrible PR, and that mud will stick in tech circles. Akamai folds under pressure. I know it's a crude comparison, but we don't negotiate with terrorists for a reason.
- dangero 10y ago
  I agree and I could see them reversing their stance now with the press around it. More than likely a middle manager approved the pro bono usage and once it got expensive that manager found him/herself in hot water over the resources being consumed. A few apologetic emails to Krebs from that middle manager, but saying he had to go, and boom we find ourselves here.
- lsc 10y ago
  I would bet money that the attack was truly epic... to the point where it was impacting (or was about to impact) other Akamai customers. Because you are right, this is terrible PR, and Akamai knows it. DDoS mitigation is fundamentally a problem of "who has more bandwidth?" - if the attacker has more bandwidth than you (and how much bandwidth you have depends on "to where" ) - it's over. The problem is that the economics, right now, are heavily tipped in favor of the attacker.
  - masklinn 10y ago
    > I would bet money that the attack was truly epic... Seems like it not only was one of the most expensive attacks so far (and by far the biggest one to have ever hit Prolexic, according to them), it also made little use of reflection of amplification making it much harder to mitigate. > to the point where it was impacting (or was about to impact) other Akamai customers. That's exactly the scale it had reached, and Akamai provided free service to Krebs, which was nice of them but only to the extent that it wasn't significantly impacting customers.
    - lsc 10y ago
snowy 10y ago
krebsonsecurity.com is now resolving to localhost. I guess he doesn't want to give the DDoSers a target.....
sfifs 10y ago
I'm wondering if the rising scale of these attacks & the seeming ease with which sites can be taken down will ultimately result in an "authenticated" internet - ie. you can't even connect without identity verification. We already see publishing through FB Instant Articles etc. moving in that land on top of the current internet, to combat these types of firehose attacks, the only solution may be to take authentication one level deeper into the connection level. That of course sounds good to security agencies as that's the end of anonymity online.
- x1798DE 10y ago
  I doubt it. I think a lot of these attacks (though possibly not this one) would not even be possible if ISPs did egress filtering of packets with spoofed IPs, and yet ISPs don't seem to be implementing even this feature. It seems unlikely that they would leap frog this and start requiring some sort of identity verification, just to solve DDoS problems. Additionally, in situations that don't make heavy use of amplification (where egress filtering doesn't help much), the way it's usually accomplished is by compromising a bunch of hosts - home computers, routers, etc, and assembling a botnet. In those cases, if your device is compromised, it would authenticate as you anyway, so such a scheme would solve nothing.
  - sfifs 10y ago
    >>In those cases, if your device is compromised, it would authenticate as you anyway, so such a scheme would solve nothing. But if you had authenticated access, you could find exactly which C&C server controlled that botnet node and then who controlled that C&C server right? All these attacks depend on some form if amplification - if only to go from C&C servers to botnet. If just being on the network required authentication, you could trace back network connections and ID the controller even if attack was by a botnet.
    - x1798DE 10y ago
      I don't think the imperfect mapping between IP and user is the real problem with tracking down botnet controllers. You have a network of compromised hosts, and you can disguise yourself as one of them. There are lots of schemes for this sort of thing when you have a whole bunch of compromised machines under your control. For example, even if you made it illegal to run a Tor node, you could still just have your compromised network of hosts start running their own Tor (are you going to arrest all the people who just got a virus that starts a Tor network?) and you deliver commands from a hidden service. That's a huge effort on the part of society (banning Tor, implementing that, etc) that's easily circumvented. In any case, like I said, you can't even get ISPs to do egress filtering of spoofed IPs, so even if it were going to solve DDoS, I don't think you'll get them on board for all the complications of implementing the protocols necessary and buying the equipment necessary to log all the traffic necessary to track down botnet controllers (who may be in a country where knowing who they are won't help you much anyway).
akamaisucks 10y ago
Where from can we get more information about the attack? I'm sure Brian Krebs will have some, but I'm guessing it will take some time until his blog is back online.
yAnonymous 10y ago
Time to use Github pages.
EJTH 10y ago
Too bad, I had some nice reads on his website. Hopefully this will only be temporarily...
mirekrusin 10y ago
It's funny how my mom after reading "record cyberattack" would be wondering how many poor people died but what it means is that somebody was downloading images from website many times.
csomar 10y ago
I'm really interested to read his blog now. Any way I can find a readable version for his blog posts?
- daveloyall 10y ago
  https://web.archive.org/web/20160922124922/http://krebsonsecurity.com/ https://web.archive.org/web/20160922124922/http://krebsonsec...
Futurebot 10y ago
Something about the platform-centric world we're in now is that this sort of attack doesn't have the blocking power it once did: you can mirror your content on Twitter, FB, G+, etc. and cross-link so people can still read your stuff. This makes the "denial" part pretty watered down; it's a wonder people even bother with these sorts of attacks anymore for non-services (i.e., for regular media material like text, photos, etc.) Of course, maybe the goal is to deny someone ad revenue, but that seems awfully low-status for such a high-profile attack: "Yeah, we really got 'em! Denied 'em AD REVENUE for a whole week!"
codedokode 10y ago
Such attacks are possible because Internet is decentralized. There is no way to tell peers that you don't want to get traffic from some AS. And investigation is difficult because attacking nodes might be in different countries, in some of which DDOS attacks are not illegal. Maybe it is time to start building international firewalls to protect local infrastructure?
- 24gttghh 10y ago
  That would be quite the Great Firewall...
jsjohnst 10y ago
There are a number of factors that go into play (did the site use custom SSL, what edge locations were they providing caching in, etc), but had Kreb been a normal paying customer, this could easily have been a over a million dollar bill (if it was sustained long enough to alter his 95th percentile bracket) in the cheapest case. If things like custom SSL are in the mix (which Akamai charges absurdly high prices for), or lots of traffic from more expensive POPs, or lack of already having pricing commiserate with high volume traffic commitments, the bill could've been 5-10x that amount or more.
owenversteeg 10y ago
The first thing a lot of people are thinking (and saying) is "switch to Cloudflare". But there's another name I think needs to be said - OVH. OVH can withstand a Tbps scale attack as far as I know, and it provides this to pretty much anyone. They have a pretty good interface and some of their plans are extremely cheap. They're also great at standing up for free speech, which I really appreciate.
- driverdan 10y ago
  OVH got hit with record attacks yesterday too: https://twitter.com/olesovhcom/status/778019962036314112 https://twitter.com/olesovhcom/status/778019962036314112
  - onestone 10y ago
    Also, they claim to (soon) be able to filter up to 5 Tbps attacks: https://twitter.com/olesovhcom/status/778831449206231041 https://twitter.com/olesovhcom/status/778831449206231041
  - ultramancool 10y ago
    Yes, and my cheap $20 Kimsufi (OVH's ultra-cheap brand) still didn't drop off the internet.
- thaeli 10y ago
  Yeah, been quite happy with their DDoS protection myself for hosting game servers. And short of drawing the massive ire of organized crime and/or nation states, that's about the biggest DDoS bullseye you can paint on your back. Krebs also hasn't publicly criticized OVH like he has CloudFlare, so I could see that working out well. Would be great press for them, too.
shshhdhs 10y ago
So the attackers win..
VertexRed 10y ago
These 'attackers' give Krebs' more publicity than he would ever be able to generate himself. It's also useful to point out that Krebs' hasn't been the only target as half a dozen other large targets were attacked http://www.webhostingtalk.com/showthread.php?t=1599694 http://www.webhostingtalk.com/showthread.php?t=1599694
marmot777 10y ago
Brian Krebs is a hero. Are Akamai executives cowards for dumping him? I'd like to add that law enforcement are heroes. And it's honorable he wants to meet Fly in person, recognizing him as a human being. I haven't read it yet but I'm assuming the reference to 12-step hints that Fly's having some post alcohol binge regrets. I'm sure alcohol makes it easier to hurt other human beings, which is why violent people are often drunk. I'd be ashamed of myself if I woke up realizing that I'd spent my life actively trying to harm other human beings for money, feeling no remorse until Karma (here defined as law enforcement officials) finally caught up with me.
- marmot777 10y ago
  After looking into this more I see that even Krebs himself does not blame Akamai for dumping him so I regret that part of my post.
atombath 10y ago
It's kind of stupid to me that the massive and advanced cdn of akamai protect something as non-important as a blog against such a major ddos attack. If they were doing it pro-bono wouldn't the prudent action be to mitigate ddos's until a certain treshold and then actually assess the value of what you are protecting? A good lesson to have learned, I believe. But no, they'll drop this client which had to have continually given good referrals.
dmix 10y ago
If you're curious what the source of the DDOS attacks are from, here is a recent one that hit OVH: > This botnet with 145607 cameras/dvr (1-30Mbps per IP) is able to send >1.5Tbps DDoS. Type: tcp/ack, tcp/ack+psh, tcp/syn. https://twitter.com/olesovhcom/status/779297257199964160 https://twitter.com/olesovhcom/status/779297257199964160 This is much higher than the Akamai attack on Krebs too. Welcome to the wonderful side-effects of the totally insecure firmware of IoT...
Igalze 10y ago
Unbelievable, they enjoyed year of free publicity from association with him, and this is how they repay him. Its bad enough that they couldn't handle the attack, despite all the bragging about their multi-Tbps capacity...
Igalze 10y ago
Unbelievable, they enjoyed year of free publicity from association with him, and this is how they repay him. Its bad enough that they couldn't handle the attack, despite all the bragging about their multi-Tbps capacity...

658 points by bishnu 10y ago

I would like to see stats from Tier1/Tier2/IX for that. Krebs claims it's 665Gbit/s https://twitter.com/briankrebs/status/778404352285405188 https://twitter.com/briankrebs/status/778404352285405188 Such attack must be visible in many places, however not a single major ISP reported that in mailing list. Previous smaller attacks were reported 'slowing down' some regional ISPs. Perhaps ISPs got better.

solotronics 10y ago
theoretically if it was a well distributed bot net then it could be a few megs from a TON of different sources.. and since akami had their own ASN it could just be jamming up Akami and not other AS
Gelob 10y ago
I've seen the graphs from prolexic, the claims are legit
morecoffee 10y ago
In a world of 10 and 40 gigabit NICs, why is 665 considered big?
- Jweb_Guru 10y ago
  Because you have to classify and filter out the spam packets before they reach the intended host and content, which is really hard to do at line rate, especially if you also plan to serve useful traffic.
  - tdy721 10y ago
    I really like this comment. I think you're saying that moving data is easy, while computing the data hasn't kept up? Then again, I could be reading into this too much, and the computing part has always been a bottleneck at backbone level.
    - alkjshdkfjasdf 10y ago
      It seems to me that he's saying in order to move data at volume, you have to compute on it. Computation is tricky. Per-bit, if you can handle the network input, you're probably able to fire packets up to the OS layer. But when you need to run stats on the incoming data, e.g. an ML classifier of "bad/not bad" or "stop/passthrough", you might be O(n^2) or worse. Moore's can't hang.
      - dharma1 10y ago
        Interesting. What ML algos are used to classify packets against DDoS?
        violentvinyl 10y ago
        I think that's the secret sauce for these quys. I'd be surprised if you can find out a lot about current techniques without signing an NDA and leaving your mobile phone in a box at security.
        windowsworkstoo 10y ago
        None, really. It's mostly filters against common types of attacks at L3/L4, then OODA. Variations from normal get looked at and custom filters applied as appropriate. And of course, there's lots of NOC to NOC back channel comms around this stuff constantly to stay relatively on top of things.
        maksimum 10y ago
        Not sure if this applies to DDoS, but a baseline ML method for security is outlier detection. For example, (1) you get a dataset that is mostly "good" data, with some "bad" data (2) you cluster it using something fast like k-means (3) data points are labelled as outliers if they fall further than some threshold from a cluster center.
    - dredmorbius 10y ago
      Linespeed is pretty fast, and there's a lot moving through. Routers are a bit like GNU grep -- they way to be fast is to not touch most of the data. The more you have to touch, and the deeper you have to touch it, the more expensive it gets. The real trick is figuring out what's good, what's evil, and downrating the latter whilst allowing the good. Given peering relations, BGP routing, and the sorry state of much of those protocols, tracing problems to their source, quickly, and getting a useful response, is difficult.
  - morecoffee 10y ago
    I still don't get it. Why not just absorb it? Serving static HTML and related data is fast. A single rack in a datacenter could easily serve this with out breaking a sweat. Sure, this costs Akamai money they don't want to spend, but is such an attack noteworthy? Eh.
    - noselasd 10y ago
      You'd still be filling the pipe. And possibly filling many small(er) pipes at interconnection points. The last meters of pipes into a rack isn't where the issues are.
    - Retr0spectrum 10y ago
      If the tiny "GET" requests are flooding in at 1Tbps, then the responses are going to be orders of magnitude larger, maybe somewhere around 500Tbps
    - Jweb_Guru 10y ago
      I'm curious, what sort of datacenter racks do you run that can serve 665 Gbps of traffic? For instance, Google's ToR switches (in its own datacenters) as of Jupiter (2012) were 16x40G, which is just 640 Gbps. Obviously, all of Google can serve a lot more than that, and you can get absurd stuff like 640-port Infiniband etc., but you seem to have pretty unrealistic ideas about network capacity. And, as another comment pointed out, that's just the input for this attack... the output would be a lot larger.
- lsc 10y ago
  you need 665 gigabits of idle capacity to... wherever the attacker is coming from. If the attacker can send five gigabits from some town in vermont, and your provider(s) can't get five gigabits plus normal traffic from that town in Vermont to your scrubbers, then legitimate users within those networks will be denied service, even if users on other networks are just fine. Essentially, it comes down to the fact that getting packets from point a to point b requires a lot of cooperation, and cooperation is difficult. Yes, yes, if you bought me the fiber, I could build you a 665 gigabit network, on the kind of money that a nerd could come up with, (not counting the fiber) but interconnecting that network with other people's networks? yeah, that's gonna cost you. Settlement-free peering is a thing, but it is really difficult to set up and maintain those relationships.
- rkangel 10y ago
  The limitation isn't the NIC, it's the processor (and possibly storage). The 10 and 40 Gigabit NICs exist but processing them on a conventional PC is hard. It is, just about, possible to perform actions on every packet in a 10Gb stream on an x86 machine. You have to use a userspace stack, handle packets across multiple cores, and be VERY careful with what you are doing so you don't do cache misses. At 10Gb/s you're talking only a few hundred clock cycles per packet - anything that doesn't work as planned causes massive backlog. Now try serving (dynamic) HTTP to that.
- tgpc 10y ago
  Because 665 is a bigger number than 10 and 40 :-)
lossolo 10y ago
Akamai has ~140 000 servers around the world. Attack was probably spread around many locations that's why you don't see any report on mailing lists.

ckdarby 10y ago

The ddos attacks seem to be getting larger these days. I've recently seen a ~200 Gbit/s hit us. Does anyone have good resources around mitigation? I was looking at the BGP flowspec but was hopefully that someone might have come across other tactics?

betaby 10y ago
Yes, here is a very good described by OVH http://media.frnog.org/FRnOG_24/FRnOG_24-3.pdf http://media.frnog.org/FRnOG_24/FRnOG_24-3.pdf
blhack 10y ago
>The ddos attacks seem to be getting larger these days. Consumer bandwidth is increasing.
jedisct1 10y ago
Take a look at FastNetmon: https://fastnetmon.com/ https://fastnetmon.com/

pitaj 10y ago

tl;dr Akamai was hosting his site pro bono. His site was being DDOSed, which cost Akamai a ton of money, so they kicked him off since they were literally only losing money on the deal.

benmarks 10y ago
Yes, courteously and graciously verified by him on Twitter: "Before everyone beats up on Akamai/Prolexic too much, they were providing me service pro bono. So, as I said, I don't fault them at all." https://twitter.com/briankrebs/status/779111614226239488 https://twitter.com/briankrebs/status/779111614226239488
Confusion 10y ago
Why would it cost Akamai a ton of money? If they already have the infrastructure and automation in place to mitigate such attacks, it wouldn't be a lot of work and would not require additional resources to mitigate this attack? And as others have said: isn't this bad PR?
- rasz_pl 10y ago
  all those botnets ddossing Krebs = less DOSses for the rest of us = less new clients for Akamai ;)
- ejcx 10y ago
  You still have to pay for bandwidth and if the attack began impacting SLAs and paying customers, that's bad for business.
dingaling 10y ago
> tl;dr Akamai was hosting his site pro bono Let us not permit companies to co-opt language for their benefit. If it was genuinely pro bono ( lit: for the public good ) then they would have taken all steps possible to keep the site online since the public good was served more by having Mr Krebs online than not. However, in this case they were hosting him free-of-charge because it was good publicity for them. That's a very different scenario.

redorb 10y ago

Cloudflare should pick up the site for good advertising..

bdcravens 10y ago
Cached version where Krebs paints picture of Cloudflare supporting DDoS: http://webcache.googleusercontent.com/search?q=cache:0uf9RIu0ZswJ:krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu...

zx2c4 10y ago

Isn't this the point at which Cloudflare is supposed to gain a handful of PR points for putting him back online, pro bono, and then doing a write up on how effortlessly they handled the bandwidth with eBPF?

Jweb_Guru 10y ago
Unfortunately, Krebs has (correctly) repeatedly attacked Cloudflare for sheltering most of the most prolific DDOS attackers. I doubt that's going to happen.
- zx2c4 10y ago
  Care to fill in the details for me? Do you mean to say the most prolific DDoS attackers work for Cloudflare? Or that their network somehow (?) shelters them? What do you mean exactly? This sounds interesting.
  - Jweb_Guru 10y ago
    There's another comment that links to one of his posts about it (http://webcache.googleusercontent.com/search?q=cache:0uf9RIu0ZswJ:krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:0uf9RIu...).
  - invokestatic 10y ago
    Cloudflare hilariously acts as a reverse proxy for booters and does not respond to abuse reports against them.
    - kyledrake 10y ago
      I can confirm that this is true. "Hilarious" is not the word I would use to describe it, "potentially criminal" I think is closer to correct.
      - 10y ago

reustle 10y ago

It would be interesting to try out some of these new p2p website technologies like IPFS/WebTorrent with these high profile sites who are frequently attacked.

vmp 10y ago
+1 for IPFS Hosting static blogs is really easy on IPFS (and if you absolutely can't live without comments: use disqus) but the URL's are cryptic and you either need a public IPFS gateway to access the site - which could get DDoS'ed - or run your own. Another alternative is ZeroNet but you still need to run the client to access the site.
- whyrusleeping 10y ago
  IPFS team member here: If the URLs are cryptic, you can use dns to make them look nicer. Take a look at the TXT record for ipfs.io, as well as the TXT record for _dnslink.ipld.io Both of those websites are hosted through ipfs and have A (or CNAME) records pointing to our gateways. You can also access this locally if you happen to be running an ipfs daemon at http://localhost:8080/ipns/ipfs.io http://localhost:8080/ipns/ipfs.io
  - phunehehe0 10y ago
    A little hard to find, but this is well described in https://github.com/ipfs/examples/blob/5d77470eb5ae944aa540934e5eeb71a9d862877f/examples/websites/README.md https://github.com/ipfs/examples/blob/5d77470eb5ae944aa54093....
    - vmp 10y ago
      That's awesome, not sure if this was around last time I tried but it is still hard to find, thanks! :)

Globz 10y ago

At this scale it must also cost a ton of money to carry out this attack, I wonder if there's a vulnerability that we don't know about that let them do this so easily?

toomuchtodo 10y ago
> At this scale it must also cost a ton of money to carry out this attack It doesn't; you're using compromised machines to initiate the attacks, which is free to you.
- derefr 10y ago
  You're almost never using machines you compromised. Instead, you're using someone else's compromised machines: a botnet-backed DDoS-ing service, which you rented on the open (black) market, at the going rate. Bigger attacks still cost more in such setups—whether or not the botnet nodes were free to acquire, the resulting network is still a scarce resource whose price rises with demand. (Of course, in the very special case of Krebs, the people he is reporting on frequently are the owners of the botnets, who can of course use their own botnets freely.)
kev009 10y ago
Well, no, if you are committing crime you can just use illegally pwned computers.

parshimers 10y ago

Quite impressive. You know your blog is good when folks will try to take down a CDN to supress what's on it. He's also had heroin mailed to him in combination with a swatting attempt before: http://webcache.googleusercontent.com/search?q=cache:gEjqPfcbtlgJ:krebsonsecurity.com/2015/10/hacker-who-sent-me-heroin-faces-charges-in-u-s/&num=1&hl=en&gl=us&strip=1&vwsrc=0 http://webcache.googleusercontent.com/search?q=cache:gEjqPfc...

gnarbarian 10y ago
holy shit. that is terrifying.
- ddorian43 10y ago
  Normal game streamers get swatted and sending heroin would be easy with the silkroad-alternative market online.
  - untog 10y ago
    Does that in any way negate the fact that it is terrifying?
    - ddorian43 10y ago
      No.
- 1ris 10y ago
  Could have been child porn.
  - BinaryIdiot 10y ago
    An almost horrible, related story: When I was in middle school and the internet was still fairly new (we had just gotten it) a classmate of mine hatched a terrible plan to get rid of a teacher he hated. He waited until the teacher was out sick one day then during the substitute's typical teaching pattern of having us "read these 3 chapters, answer questions then keep your head down until class is over" he jumped on the teacher's computer. After reassuring the substitute that he was allowed to he tried desperately to find child porn. His plan was to save it into semi hidden folders onto the computer then later on turn the teacher in for having child porn. Fortunately this classmate wasn't able to find any and eventually gave up. But I've always remembered his plan. It's terrifyingly believable that if someone managed to get into your computer and download child porn, there is likely little recourse or way to prove you did not do it.

panic 10y ago

This recent talk about DDoS attacks is worth a watch if you're curious about why it's a hard problem to solve: https://www.youtube.com/watch?v=79u7bURE6Ss https://www.youtube.com/watch?v=79u7bURE6Ss

dtnewman 10y ago
Starting watching this and he gives a great explanation of the issue. Thanks for sharing.

geofft 10y ago

https://twitter.com/briankrebs/status/779111614226239488 https://twitter.com/briankrebs/status/779111614226239488 "Before everyone beats up on Akamai/Prolexic too much, they were providing me service pro bono. So, as I said, I don't fault them at all."

xarope 10y ago

I tried to get to an article on Krebs' site from a Bruce Schneier blog post, and couldn't, then bumped into this post in HN. It's a pity Akamai booted him off; on the one hand, I can understand that it would significantly impact on their SLAs to other customers, but on the other hand it's a shame they don't have a lower impact network to re-host him on, and use this as a learning lesson on how to better mitigate such DDoSs...

known 10y ago

Is it according to terms/conditions of Akamai?

mmel 10y ago
What is 'it' that you are referring to?
Twirrim 10y ago
Akamai were providing him hosting free of charge, but the size of the attack will have had not insignificant financial impact on them, and on their customers. It's completely understandable that they've chosen to terminate their hosting agreement at this time. https://twitter.com/briankrebs/status/779111614226239488 https://twitter.com/briankrebs/status/779111614226239488 https://twitter.com/briankrebs/status/779062433902170112 https://twitter.com/briankrebs/status/779062433902170112

exolymph 10y ago

It would be interesting if he started writing on Medium (not saying technically advisable, just interesting). I wonder if he'd ever consider trying that.

okwhatthe2 10y ago
Why would it be interesting?
- exolymph 10y ago
  To see how Medium would deal with massive DDoS attacks and whether they'd kick Krebs off.
angry-hacker 10y ago
Why would he give away advertising dollars? Also, medium is bad. Everyone now thinks if you publish something on medium, the writing is suddenly a masterpiece.

dragonbonheur 10y ago

Who profits from this attack?

wmf 10y ago
Someone's ego.
- joshmn 10y ago
  LOL LOOK WE TOOK HIM OFFLINE HAHAHA HIS LIFE IS OVER
  - kevingadd 10y ago
    Well, if your site needs to be online and processing payments so your company can pay salaries and rent, a week (or month) long DDOS would basically end things for you... Everywhere I've worked, a DDOS like this would basically be an emergency.
    - pbarnes_1 10y ago
      Not many companies can go a week (let alone a month) without revenue.
  - sctb 10y ago
    Please don't post unsubstantive comments like this on Hacker News. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

josho 10y ago

I'd love to learn more about these botnets. I wonder about things like What's the average time that a compromised computer stays in this net. What is the typical computer (grandmas old PC running XP). Do the ISPs ever get involved to kill bots running on their networks?

solotronics 10y ago
for the most part ISP are not set up to defend or stop DDoS from within their network. Do you go to a road building company to stop car thieves?
- zeeZ 10y ago
  If that road building company also collects tolls and controls access to their roads you sure as hell do
  - jethro_tell 10y ago
    Well that's the state. His analogy is like saying 'why would your fiber splicer police this.'
- jethro_tell 10y ago
  no you don't because that's a bad analogy. We do however go to states and could ties to protect the infrastructures they paid the contractor to build. ISPs are uniquely situated to stop this kind of ddos because the traffic originates from IPs they don't own. The traffic has a spoofed from address. And as a rule, the ISP.should only need to send traffic out of a neighborhood from the block of IPs that is assigned to that neighborhood. You can put a filter on every switch or even every interface allowing only traffic from the IP or IPs on the other side of the link to send traffic. A company like Comcast could make it default part of account setup scripts. If everyone did that, these would disappear over night.
  - ghshephard 10y ago
    Aren't there botnets that use their actual source address when spamming a DDOS target? How do you defend against that type of attack?

dragonbonheur 10y ago

Are there web servers or software that blacklist IP addresses that disconnects after a short time and redirects them to a static page?

samplonius 10y ago
Yes, but they can be flooded as well. Every system is going to have a finite capacity. And if the capacity is exceeded, the system will slow. If the capacity is significantly exceeded, it will become unreachable itself. So if the capacity of your system is X Gbps, then it will start to have problems if the attacker sends X + 1 Gbps. And will probably be completely unreachable if the attacker sends X * 2 Gbps.

flashman 10y ago

> “I likely cost them a ton of money today.” But more specifically, whoever launched the attack cost them that money. Also, ha: PING krebsonsecurity.com (127.0.0.1): 56 data bytes

guessmyname 10y ago
I would say that is a clever move, but to be honest that is the most he can do now. https://twitter.com/briankrebs/status/779144394360381440 https://twitter.com/briankrebs/status/779144394360381440 @ 123 IN SOA ns1.prolexic.net. hostmaster.prolexic.com. 2016092204 86400 900 1209600 3600 @ 900 IN NS ns1.prolexic.net. @ 900 IN NS ns2.prolexic.net. *@ 300 IN A 127.0.0.1 @ 300 IN MX 10 smtp.krebsonsecurity.com. @ 300 IN TXT "v=spf1 ip4:... ip4:... ip6:... a mx ?all" m 300 IN CNAME krebsonsecurity.mobify.me. smtp 900 IN A 198.251.81.28 *www 300 IN A 127.0.0.1
kijin 10y ago
It might be more useful to return the IP address of whoever made the DNS query. This could trick the computers that make up the botnet to either attack themselves on the public interface (more resource-intensive than trying to DDoS your own loopback), or even better, their ISP's resolvers (it would force the ISP to do something about it).
- staticfloat 10y ago
  With the recursive nature of DNS, I imagine that could get a little hairy as the DDoS'ers would then be targeting whichever DNS servers they were using.
DCoder 10y ago
> PING krebsonsecurity.com (127.0.0.1): 56 data bytes Reminds me of: https://twitter.com/troyhunt/status/716408697266679808 https://twitter.com/troyhunt/status/716408697266679808

zaidf 10y ago

He should get a Facebook page and publish a copy of all his posts on it.

Jupe 10y ago
Interesting idea, but probably doesn't go far enough... Perhaps he should re-post his blog articles everywhere: Facebook, flickr, tumbler, watpad, wordpress, various feedback forums, etc. Combat a DDoS attack with a DPD (distributed publishing defense - just made that up)
- nikcub 10y ago
  That would harm his business model, which is advertising. It could work with Facebook Instant Articles, he may even be better off using it since they source the advertising and have been out trying to poach and source quality content.
sandGorgon 10y ago
I was going to say a different version of this. Real men mirror. Krebsonsecurity deserves to be on git and use something like Jekyll. Mirror it instantly in a hundred different places.
- GFK_of_xmaspast 10y ago
  Why do you have to bring gender norms into this.
  - sandGorgon 10y ago
    I'm sorry if it came off that way .. I thought the reference was well known. http://quotes.yourdictionary.com/author/linus-torvalds/190296 http://quotes.yourdictionary.com/author/linus-torvalds/19029...
    - GFK_of_xmaspast 10y ago

mirekrusin 10y ago

Isn't this whole thing a bit silly? I mean what's the point? They just spend time on making him the best marketing, he'll double his audience/readers, no?

Arcsech 10y ago
The point isn't to cost Krebs readers most likely. It's to show off how awesome this bonnet is. I'd guess the DDoSer is jumping with joy over this news actually, because now the DDoSer can advertise his service with "I DDoSed Krebs so hard Akamai had to drop him!"
codedokode 10y ago
They have shown who is stronger and probably got some PR for their DDOS services.

ttam 10y ago

so long for using a CDN to protect from DDOS attacks...

caryhartline 10y ago
There are different tiers. Some people can get away with using a CDN because they aren't that big of a target.
brazzledazzle 10y ago
This was prolexic, a ddos protection service purchased by Akamai.

desireco42 10y ago

I understand that this is burning bandwidth for Akamai, but seriously, taking into account what is at stake here, I think they need to do their share and continue to support Brian.

EGreg 10y ago

Why don't we switch to a distributed network with a DHT like freenet? So many benefits, including not being able to take down content via DDOS.

JamesLeonis 10y ago
The DHT can still be attacked. Here's three methods: 1: Take out the bootstrap nodes. These are several nodes that bootstrap a new client into the DHT system. BitTorrent, Inc. keeps a couple such nodes. On first boot, the client registers it's DHT address and collects a few from the bootstrapping node. The client could then can traverse the network itself. By knocking out these nodes, newly started clients now have to browse the whole IP space for possible DHT clients, which is not feasible. 2: Attack the peers themselves. A malicious program could traverse the network searching for DHT peers in the same way. At first, it would only collect a large number of DHT addresses and their corresponding nodes. Once a sufficient mass is gained, each is targeted with a low level DDOS to knock them offline to further requests. Most of these peers will be homes and local ISPs, which can't effectively deal with DDOS traffic themselves. Others trying to connect to a down client will eventually remove them from their own address space for later queries. 3: Poison DHT peers. This is probably the hardest, but once complete could poison an entire network with a switch. On each of your compromised Bot machines, you make a valid DHT node. Make a LOT of these (like a Botnet). For the most part, participate correctly with the DHT network. Collect as many valid/real DHT user and content addresses as you can and host them in your nodes. When it's time to attack, prevent these valid DHT addresses from resolving on inquiry. Even better, make them go in the wrong direction and infinitely pass around requests to other poisoned bots in your ring to prevent resolution but not hang the process. This is especially useful for content attacks because it attacks the content addresses themselves.
- Dylan16807 10y ago
  1a. A system could be made for bootstrap links that have the addresses of a few nodes in them. 1b. When you have 10 million nodes like torrents, you can go searching random IPs. As long as many nodes bind to the same ports. 2. Sure, if you have comparable bandwidth to the entire network you can take it down. But that's a lot harder than overwhelming a single target. Nobody can send 20mbps each to millions of IPs. 3. This is the method that takes the least resources, but pretty good countermeasures can be made.

rabboRubble 10y ago

Here's a link to the last post from his website. Google did not appear to have this cached: https://archive.fo/t94ve https://archive.fo/t94ve

anotheryou 10y ago
relevant quote from that: ››Many readers have been asking whether this attack was in retaliation for my recent series on the takedown of the DDoS-for-hire service vDOS, which coincided with the arrests of two young men named in my original report as founders of the service. I can’t say for sure, but it seems likely related: Some of the POST request attacks that came in last night as part of this 620 Gbps attack included the string “freeapplej4ck,” a reference to the nickname used by one of the vDOS co-owners.‹‹
- 24gttghh 10y ago
  I'd err on the side of caution and consider that string a Red Herring without more evidence to corroborate the claim. It is a nice coincidence though...
  - anotheryou 10y ago
    I'm just here for the popcorn :)

deleted 10y ago

[deleted]

WhitneyLand 10y ago

This is bad PR for Akamai and a tactical error for them to boot Krebs even if they were providing free service. To some, the implication would will be "they couldn't handle it" so why should I trust the DDOS they are heavily promoting on their site? At minimum they should comment on the situation, at best restore his service and learn how deal with high profile clients.

cft 10y ago
Even if they tried to mitigate and quietly semi failed (like 30% packet loss) the PR would have been better. It could be that such attack takes down their entire network hard. Verisign said a year ago to us they could mitigate 2Tbps for comparison.
- pbarnes_1 10y ago
  Akamai can easily mitigate this. They just don't want to provide it for free. And pretty much no one can afford to use their services @ 655Gb/s for that long unless they had billions of $.
  - cft 10y ago
    Well a single 48 hr mitigation costs 12k/yr contact. Unlimited mitigations probably cost about 130k/yr. Either this negative PR is worth 12-100k in savings for them or they would drop any paying customer if the attack is over a certain threshold?
    - 4ad 10y ago
      They might bill you that money, but on average it costs them less to provide that service to you, otherwise they wouldn't make any money. Because we don't know the operating margins and the distribution of DDoS costs per customer, we can't infer how much this particular attack would cost Akamai.
- krzyk 10y ago
  According to Kerbs (https://twitter.com/briankrebs/status/778398865619836928 https://twitter.com/briankrebs/status/778398865619836928) Akamai did mitigate this DDOS, they kicked him of after the attack, not during.

nodesocket 10y ago

Brian Krebs' wasn't a paying customer right? Akamai provided the service pro-bono. Perfectly acceptable for them to suspend service if it becomes more than trivial in terms of cost or it puts their paying customers at risk.

ChuckMcM 10y ago

Wow, I figured that everyone that had hired vDOS would be irritated but that is pretty impressive. Still it says a lot for how effective he has been at rooting out this stuff, not like the TierN infrastructure folks have managed to track this stuff down with their resources.

nodesocket 10y ago

I've always wondered if your domain is under a http DDoS attack, couldn't you in theory update your DNS A record to another ip and take other servers down (maliciously)?

Jweb_Guru 10y ago
Most DDOS attacks are launched directly against the IP, so it wouldn't really help.

xarope 10y ago

Here's a "philosophical" question with regards to the internet, and perhaps even it's future. Given that a currently anonymous attacker, and likely not a "state" player (i.e. not a governmental entity with almost unlimited resources) has managed to DDoS a single website, does this portend that unless there are significant changes to the way the internet infrastructure works, we are seeing the demise of the WWW? Kind of like a reverse wild-wild-west evolution, where the previously carefully cultivated academic and company site presence, gradually degenerates into misclick-hell? And the non-technical, non-IT savvy masses, in a bid to escape this all, end up in a facebook-style future where media is curated and presented for consumption (or perhaps in future, facebook-type entities end up with their own wild-wild-west hell)? I have a strange feeling that we are seeing the decline of a city/civilisation; once you used to feel safe walking out at night, knew everybody in the neighbourhood, could leave your doors unlocked... and now, you don't dare to go down the lane to the left in case you pick up a nasty virus, and if you hear a knock on the door at night/email from DHL, you don't dare to even look through the peephole/preview the JPG!

tdy721 10y ago
Perhaps its the government? Lots of people think all these NSA programs are evil surveillance, could be it's just the glue that has saved us from just this. I'm personally amazed that people don't get hacked more often TBH... I can't think of any instances where non-technical people have been pwned in my own life. I personally have a pa55word that I use for sites I don't trust, but the accounts never seem to fall or even falter. It's amazing really.
- kardos 10y ago
  There's too many people in the general population to target them one by one, but > I'm personally amazed that people don't get hacked more often ... the machines participating in the DDOS are (almost entirely) hacked, yes?
samplonius 10y ago
You are not the first to come up with this idea. This same thought has been posted every year for the past 20 or so years in mailing lists, forums or Usenet (thought lately, not too often to Usenet). I think prevention should be emphasized. If there wasn't so much garbage plugged into the Internet, there wouldn't be huge botnets to send DDoSes. There are few groups that scan the Internet for vulnerable systems, and rather than compromise them, send notices to the ISPs. In Canada, the CCIRC does this. But they only check IP blocks assigned to Canadian ISPs and enterprises. Plus, why do so many ISPs still allow spoofing of IPs? It isn't 1999 anymore. We should start a grass roots group to talk to everyone they meet, and get people to update their OSes, devices, and get rid of crap.

tuna-piano 10y ago

Some are guessing the DDOS was because of this recent post of his, about a large DDOS network. http://webcache.googleusercontent.com/search?q=cache:kaymYsbcGc8J:krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/+&cd=1&hl=en&ct=clnk&gl=us http://webcache.googleusercontent.com/search?q=cache:kaymYsb...

hetfeld 10y ago

You'll be redirected in... never redirected.

rasz_pl 10y ago

I think its time for some serious financial incentives for ISPs to start getting serious about routing (or rather not routing) garbage. Financial fines for every DOS originating from your AS, or blacklisting if you are a repeated offender.

samplonius 10y ago
There is an incentive: it is the cost of transit. However, there usually are not a lot of zombies per single ISP for the access level ISP to even see any abnormal traffic. The best thing is that access ISPs need to implement BCP38 (https://tools.ietf.org/html/bcp38 https://tools.ietf.org/html/bcp38). And shutdown all open recursive DNS servers. It would be great if Microsoft didn't ship such a retarded DNS server too. I would say that most ISPs do not do this. NTP really should be replaced with something better. There are still large numbers of NTP amplification attacks going on. The big issue with NTP today, is that by default ntpd in daemon mode, is also a NTP server and responds to NTP requests. And so many of the two bit home routers run ntpd. But the reality is, that no one is even reporting DDoSes right now. I work at an ISP, and I haven't seen a DDoS report in the past year. We pro-actively scan for open DNS and open NTP services. But many DDoS attacks just use regular HTTP/HTTPS, are hard to detect at the individual network connection level. Do you think Akamai sent out a single notice to any ISPs, saying "The following X IPs are sending excessive traffic to site Y, and are suspected to be part of a botnet"?

ninja-wannabe-7 10y ago

Should've used CloudFlare.

saganus 10y ago

So if Akamai can't hold an attack of this size, who can? Or is it that they actually can hold it off but it costs too much money?

jedisct1 10y ago
Cloudflare and OVH (that got a 1.1 Tb attack around the same time, the biggest in history) certainly have the capacity to hold attacks of that size. Akamai may also have the capacity, but bandwidth is not free.

headmelted 10y ago

Still not a good move for Akamai, though. I get him speaking out for them about the hosting having been free, but Akamai is now the CDN that got bullied into kicking someone of their service against their own will. Terrible PR, and that mud will stick in tech circles. Akamai folds under pressure. I know it's a crude comparison, but we don't negotiate with terrorists for a reason.

dangero 10y ago
I agree and I could see them reversing their stance now with the press around it. More than likely a middle manager approved the pro bono usage and once it got expensive that manager found him/herself in hot water over the resources being consumed. A few apologetic emails to Krebs from that middle manager, but saying he had to go, and boom we find ourselves here.
lsc 10y ago
I would bet money that the attack was truly epic... to the point where it was impacting (or was about to impact) other Akamai customers. Because you are right, this is terrible PR, and Akamai knows it. DDoS mitigation is fundamentally a problem of "who has more bandwidth?" - if the attacker has more bandwidth than you (and how much bandwidth you have depends on "to where" ) - it's over. The problem is that the economics, right now, are heavily tipped in favor of the attacker.
- masklinn 10y ago
  > I would bet money that the attack was truly epic... Seems like it not only was one of the most expensive attacks so far (and by far the biggest one to have ever hit Prolexic, according to them), it also made little use of reflection of amplification making it much harder to mitigate. > to the point where it was impacting (or was about to impact) other Akamai customers. That's exactly the scale it had reached, and Akamai provided free service to Krebs, which was nice of them but only to the extent that it wasn't significantly impacting customers.
  - lsc 10y ago

snowy 10y ago

krebsonsecurity.com is now resolving to localhost. I guess he doesn't want to give the DDoSers a target.....

sfifs 10y ago

I'm wondering if the rising scale of these attacks & the seeming ease with which sites can be taken down will ultimately result in an "authenticated" internet - ie. you can't even connect without identity verification. We already see publishing through FB Instant Articles etc. moving in that land on top of the current internet, to combat these types of firehose attacks, the only solution may be to take authentication one level deeper into the connection level. That of course sounds good to security agencies as that's the end of anonymity online.

x1798DE 10y ago
I doubt it. I think a lot of these attacks (though possibly not this one) would not even be possible if ISPs did egress filtering of packets with spoofed IPs, and yet ISPs don't seem to be implementing even this feature. It seems unlikely that they would leap frog this and start requiring some sort of identity verification, just to solve DDoS problems. Additionally, in situations that don't make heavy use of amplification (where egress filtering doesn't help much), the way it's usually accomplished is by compromising a bunch of hosts - home computers, routers, etc, and assembling a botnet. In those cases, if your device is compromised, it would authenticate as you anyway, so such a scheme would solve nothing.
- sfifs 10y ago
  >>In those cases, if your device is compromised, it would authenticate as you anyway, so such a scheme would solve nothing. But if you had authenticated access, you could find exactly which C&C server controlled that botnet node and then who controlled that C&C server right? All these attacks depend on some form if amplification - if only to go from C&C servers to botnet. If just being on the network required authentication, you could trace back network connections and ID the controller even if attack was by a botnet.
  - x1798DE 10y ago
    I don't think the imperfect mapping between IP and user is the real problem with tracking down botnet controllers. You have a network of compromised hosts, and you can disguise yourself as one of them. There are lots of schemes for this sort of thing when you have a whole bunch of compromised machines under your control. For example, even if you made it illegal to run a Tor node, you could still just have your compromised network of hosts start running their own Tor (are you going to arrest all the people who just got a virus that starts a Tor network?) and you deliver commands from a hidden service. That's a huge effort on the part of society (banning Tor, implementing that, etc) that's easily circumvented. In any case, like I said, you can't even get ISPs to do egress filtering of spoofed IPs, so even if it were going to solve DDoS, I don't think you'll get them on board for all the complications of implementing the protocols necessary and buying the equipment necessary to log all the traffic necessary to track down botnet controllers (who may be in a country where knowing who they are won't help you much anyway).

akamaisucks 10y ago

Where from can we get more information about the attack? I'm sure Brian Krebs will have some, but I'm guessing it will take some time until his blog is back online.

yAnonymous 10y ago

Time to use Github pages.

EJTH 10y ago

Too bad, I had some nice reads on his website. Hopefully this will only be temporarily...

mirekrusin 10y ago

It's funny how my mom after reading "record cyberattack" would be wondering how many poor people died but what it means is that somebody was downloading images from website many times.

csomar 10y ago

I'm really interested to read his blog now. Any way I can find a readable version for his blog posts?

daveloyall 10y ago
https://web.archive.org/web/20160922124922/http://krebsonsecurity.com/ https://web.archive.org/web/20160922124922/http://krebsonsec...

Futurebot 10y ago

Something about the platform-centric world we're in now is that this sort of attack doesn't have the blocking power it once did: you can mirror your content on Twitter, FB, G+, etc. and cross-link so people can still read your stuff. This makes the "denial" part pretty watered down; it's a wonder people even bother with these sorts of attacks anymore for non-services (i.e., for regular media material like text, photos, etc.) Of course, maybe the goal is to deny someone ad revenue, but that seems awfully low-status for such a high-profile attack: "Yeah, we really got 'em! Denied 'em AD REVENUE for a whole week!"

codedokode 10y ago

Such attacks are possible because Internet is decentralized. There is no way to tell peers that you don't want to get traffic from some AS. And investigation is difficult because attacking nodes might be in different countries, in some of which DDOS attacks are not illegal. Maybe it is time to start building international firewalls to protect local infrastructure?

24gttghh 10y ago
That would be quite the Great Firewall...

jsjohnst 10y ago

There are a number of factors that go into play (did the site use custom SSL, what edge locations were they providing caching in, etc), but had Kreb been a normal paying customer, this could easily have been a over a million dollar bill (if it was sustained long enough to alter his 95th percentile bracket) in the cheapest case. If things like custom SSL are in the mix (which Akamai charges absurdly high prices for), or lots of traffic from more expensive POPs, or lack of already having pricing commiserate with high volume traffic commitments, the bill could've been 5-10x that amount or more.

owenversteeg 10y ago

The first thing a lot of people are thinking (and saying) is "switch to Cloudflare". But there's another name I think needs to be said - OVH. OVH can withstand a Tbps scale attack as far as I know, and it provides this to pretty much anyone. They have a pretty good interface and some of their plans are extremely cheap. They're also great at standing up for free speech, which I really appreciate.

driverdan 10y ago
OVH got hit with record attacks yesterday too: https://twitter.com/olesovhcom/status/778019962036314112 https://twitter.com/olesovhcom/status/778019962036314112
- onestone 10y ago
  Also, they claim to (soon) be able to filter up to 5 Tbps attacks: https://twitter.com/olesovhcom/status/778831449206231041 https://twitter.com/olesovhcom/status/778831449206231041
- ultramancool 10y ago
  Yes, and my cheap $20 Kimsufi (OVH's ultra-cheap brand) still didn't drop off the internet.
thaeli 10y ago
Yeah, been quite happy with their DDoS protection myself for hosting game servers. And short of drawing the massive ire of organized crime and/or nation states, that's about the biggest DDoS bullseye you can paint on your back. Krebs also hasn't publicly criticized OVH like he has CloudFlare, so I could see that working out well. Would be great press for them, too.

shshhdhs 10y ago

So the attackers win..

VertexRed 10y ago

These 'attackers' give Krebs' more publicity than he would ever be able to generate himself. It's also useful to point out that Krebs' hasn't been the only target as half a dozen other large targets were attacked http://www.webhostingtalk.com/showthread.php?t=1599694 http://www.webhostingtalk.com/showthread.php?t=1599694

marmot777 10y ago

Brian Krebs is a hero. Are Akamai executives cowards for dumping him? I'd like to add that law enforcement are heroes. And it's honorable he wants to meet Fly in person, recognizing him as a human being. I haven't read it yet but I'm assuming the reference to 12-step hints that Fly's having some post alcohol binge regrets. I'm sure alcohol makes it easier to hurt other human beings, which is why violent people are often drunk. I'd be ashamed of myself if I woke up realizing that I'd spent my life actively trying to harm other human beings for money, feeling no remorse until Karma (here defined as law enforcement officials) finally caught up with me.

marmot777 10y ago
After looking into this more I see that even Krebs himself does not blame Akamai for dumping him so I regret that part of my post.

atombath 10y ago

It's kind of stupid to me that the massive and advanced cdn of akamai protect something as non-important as a blog against such a major ddos attack. If they were doing it pro-bono wouldn't the prudent action be to mitigate ddos's until a certain treshold and then actually assess the value of what you are protecting? A good lesson to have learned, I believe. But no, they'll drop this client which had to have continually given good referrals.

dmix 10y ago

If you're curious what the source of the DDOS attacks are from, here is a recent one that hit OVH: > This botnet with 145607 cameras/dvr (1-30Mbps per IP) is able to send >1.5Tbps DDoS. Type: tcp/ack, tcp/ack+psh, tcp/syn. https://twitter.com/olesovhcom/status/779297257199964160 https://twitter.com/olesovhcom/status/779297257199964160 This is much higher than the Akamai attack on Krebs too. Welcome to the wonderful side-effects of the totally insecure firmware of IoT...

Igalze 10y ago

Unbelievable, they enjoyed year of free publicity from association with him, and this is how they repay him. Its bad enough that they couldn't handle the attack, despite all the bragging about their multi-Tbps capacity...

Igalze 10y ago