5 ms·

I'd love to learn more about these botnets. I wonder about things like What's the average time that a compromised computer stays in this net. What is the typica

by josho 10y ago

I'd love to learn more about these botnets. I wonder about things like What's the average time that a compromised computer stays in this net. What is the typical computer (grandmas old PC running XP). Do the ISPs ever get involved to kill bots running on their networks?

solotronics 10y ago
for the most part ISP are not set up to defend or stop DDoS from within their network. Do you go to a road building company to stop car thieves?
- zeeZ 10y ago
  If that road building company also collects tolls and controls access to their roads you sure as hell do
  - jethro_tell 10y ago
    Well that's the state. His analogy is like saying 'why would your fiber splicer police this.'
- jethro_tell 10y ago
  no you don't because that's a bad analogy. We do however go to states and could ties to protect the infrastructures they paid the contractor to build. ISPs are uniquely situated to stop this kind of ddos because the traffic originates from IPs they don't own. The traffic has a spoofed from address. And as a rule, the ISP.should only need to send traffic out of a neighborhood from the block of IPs that is assigned to that neighborhood. You can put a filter on every switch or even every interface allowing only traffic from the IP or IPs on the other side of the link to send traffic. A company like Comcast could make it default part of account setup scripts. If everyone did that, these would disappear over night.
  - ghshephard 10y ago
    Aren't there botnets that use their actual source address when spamming a DDOS target? How do you defend against that type of attack?
    - Jweb_Guru 10y ago
      If a bot is using its actual source address, you can block its IP at the edge (and even ask the ISP to investigate). Thanks to IP spoofing, that's totally ineffective, so instead the only way to make the attack stop is to null route the host.
      - shaunol 10y ago
        How does IP spoofing even work outside of those DNS reflection attacks mentioned on Krebs' blog? [1] > "many were garbage Web attack methods that require a legitimate connection between the attacking host and the target, including SYN, GET and POST floods." I constantly see references relating to DDoS attacks about how IP spoofing is such an obvious trick to use but I've never seen any way to actually do it. Why wouldn't every device on the internet spoof their IP? [1] https://web.archive.org/web/20160922021000/http://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos https://web.archive.org/web/20160922021000/http://krebsonsec...
        Jweb_Guru 10y ago
        > Why wouldn't every device on the internet just spoof their IP if it was this obvious thing? https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php - compromise a device in one of the ASes not marked "unspoofable." Those ASes do not consistently perform packet ingress filtering. That's not to say that DDOS attacks stop being possible, but at least they become traceable.
        shaunol 10y ago
        I appreciate the response. I had no idea things were this bad.
- josho 10y ago
  Most ISPs have a clause in their Terms of Service stipulating that you won't use the service for criminal activity. I'm pretty sure a DDoS can be argued as a criminal activity. So, it is in the ISPs right to stop service to those nodes. --Yes, I understand the consumer isn't the criminal, more so they are the victim and the crime took place on their service. Further, technologists tend to be pretty good at solving problems. I know this isn't the ISPs problem, but it is a flaw in the network, I'm simply wondering if anyone is attempting to solve this problem at the network level rather than simply building bigger caching services to protect those that pay for protection.
nylsaar 10y ago
This is an interesting video examining a botnet. https://www.youtube.com/watch?v=PgDY3C8SEmY https://www.youtube.com/watch?v=PgDY3C8SEmY
yashinm92 10y ago
This was a mixed traffic botnet. There are speculations that a large chunk was from compromised IoT devices.
- matt_wulfeck 10y ago
  How many IoT devices are out on the public internet at the moment? and for the existing IOT devices, are they the same thing, or were different exploits used for different devices?
  - yashinm92 10y ago
    How many on the public internet? Too many. Here are close to 100k IP cameras on the public internet: https://www.shodan.io/search?query=ip+camera https://www.shodan.io/search?query=ip+camera Again, the speculation that it is IoT devices is unfortunately just that. However massive compromise of internet connected embedded device is not new: http://internetcensus2012.bitbucket.org/paper.html http://internetcensus2012.bitbucket.org/paper.html
- Spare_account 10y ago
  Are there any good quality articles you can link to discussing this?
  - yashinm92 10y ago
    Good quality? I'm not sure. Just speculation on this one post: https://www.hackread.com/brian-krebs-website-665-gbps-ddos-attack/ https://www.hackread.com/brian-krebs-website-665-gbps-ddos-a...
- dharma1 10y ago
  Got a source for that? Thanks
  - yashinm92 10y ago
    Just this link: https://www.hackread.com/brian-krebs-website-665-gbps-ddos-attack/ https://www.hackread.com/brian-krebs-website-665-gbps-ddos-a... I'm a bit concerned about the reliability of that report since there are no strong proofs for their claim.

by josho 10y ago

solotronics 10y ago

for the most part ISP are not set up to defend or stop DDoS from within their network. Do you go to a road building company to stop car thieves?

zeeZ 10y ago
If that road building company also collects tolls and controls access to their roads you sure as hell do
- jethro_tell 10y ago
  Well that's the state. His analogy is like saying 'why would your fiber splicer police this.'
jethro_tell 10y ago
no you don't because that's a bad analogy. We do however go to states and could ties to protect the infrastructures they paid the contractor to build. ISPs are uniquely situated to stop this kind of ddos because the traffic originates from IPs they don't own. The traffic has a spoofed from address. And as a rule, the ISP.should only need to send traffic out of a neighborhood from the block of IPs that is assigned to that neighborhood. You can put a filter on every switch or even every interface allowing only traffic from the IP or IPs on the other side of the link to send traffic. A company like Comcast could make it default part of account setup scripts. If everyone did that, these would disappear over night.
- ghshephard 10y ago
  Aren't there botnets that use their actual source address when spamming a DDOS target? How do you defend against that type of attack?
  - Jweb_Guru 10y ago
    If a bot is using its actual source address, you can block its IP at the edge (and even ask the ISP to investigate). Thanks to IP spoofing, that's totally ineffective, so instead the only way to make the attack stop is to null route the host.
    - shaunol 10y ago
      How does IP spoofing even work outside of those DNS reflection attacks mentioned on Krebs' blog? [1] > "many were garbage Web attack methods that require a legitimate connection between the attacking host and the target, including SYN, GET and POST floods." I constantly see references relating to DDoS attacks about how IP spoofing is such an obvious trick to use but I've never seen any way to actually do it. Why wouldn't every device on the internet spoof their IP? [1] https://web.archive.org/web/20160922021000/http://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos https://web.archive.org/web/20160922021000/http://krebsonsec...
      - Jweb_Guru 10y ago
        > Why wouldn't every device on the internet just spoof their IP if it was this obvious thing? https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php - compromise a device in one of the ASes not marked "unspoofable." Those ASes do not consistently perform packet ingress filtering. That's not to say that DDOS attacks stop being possible, but at least they become traceable.
        shaunol 10y ago
        I appreciate the response. I had no idea things were this bad.
josho 10y ago
Most ISPs have a clause in their Terms of Service stipulating that you won't use the service for criminal activity. I'm pretty sure a DDoS can be argued as a criminal activity. So, it is in the ISPs right to stop service to those nodes. --Yes, I understand the consumer isn't the criminal, more so they are the victim and the crime took place on their service. Further, technologists tend to be pretty good at solving problems. I know this isn't the ISPs problem, but it is a flaw in the network, I'm simply wondering if anyone is attempting to solve this problem at the network level rather than simply building bigger caching services to protect those that pay for protection.

nylsaar 10y ago

This is an interesting video examining a botnet. https://www.youtube.com/watch?v=PgDY3C8SEmY https://www.youtube.com/watch?v=PgDY3C8SEmY

yashinm92 10y ago

This was a mixed traffic botnet. There are speculations that a large chunk was from compromised IoT devices.

matt_wulfeck 10y ago
How many IoT devices are out on the public internet at the moment? and for the existing IOT devices, are they the same thing, or were different exploits used for different devices?
- yashinm92 10y ago
  How many on the public internet? Too many. Here are close to 100k IP cameras on the public internet: https://www.shodan.io/search?query=ip+camera https://www.shodan.io/search?query=ip+camera Again, the speculation that it is IoT devices is unfortunately just that. However massive compromise of internet connected embedded device is not new: http://internetcensus2012.bitbucket.org/paper.html http://internetcensus2012.bitbucket.org/paper.html
Spare_account 10y ago
Are there any good quality articles you can link to discussing this?
- yashinm92 10y ago
  Good quality? I'm not sure. Just speculation on this one post: https://www.hackread.com/brian-krebs-website-665-gbps-ddos-attack/ https://www.hackread.com/brian-krebs-website-665-gbps-ddos-a...
dharma1 10y ago
Got a source for that? Thanks
- yashinm92 10y ago
  Just this link: https://www.hackread.com/brian-krebs-website-665-gbps-ddos-attack/ https://www.hackread.com/brian-krebs-website-665-gbps-ddos-a... I'm a bit concerned about the reliability of that report since there are no strong proofs for their claim.