10 ms·

The Democratization of Censorship

182 points by rfreytag 10y ago

andrewstuart2 10y ago
He's also put up a blog post about the incident. Apparently it's back up under Google's "Project Shield": https://news.ycombinator.com/item?id=12575047 https://news.ycombinator.com/item?id=12575047 https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://krebsonsecurity.com/2016/09/the-democratization-of-c...
- andrewstuart2 10y ago
  Ha. I swear this comment was on another post to begin with.
- yohui 10y ago
  You may be thinking of this discussion, "KrebsOnSecurity is now up and hosted on Google Cloud": https://news.ycombinator.com/item?id=12574428 https://news.ycombinator.com/item?id=12574428
  - andrewstuart2 10y ago
    That's exactly what I'm thinking of. And actually, that's where I meant to leave this comment. I must have had both open in two tabs for copy/pasting the URL and picked the wrong one. Much less consequential tab-tastrophe than the time I dropped a table in production because I thought I was in my Dev tab. Backups saved my job that day. And I never kept two SQL servers up at once after that day. :-D
cantagi 10y ago
Something very weird is going on - krebsonsecurity.com is resolving to 127.0.0.1 . Could this be an attempt by someone's DNS servers to make the machines in the original attacking botnet DoS themselves?
- 0xcde4c3db 10y ago
  I'm seeing the same thing. IIRC it was a mitigation measure by Akamai, perhaps to prevent new bots from joining the attack.
  - sverige 10y ago
    In the article he mentions that was done before moving from Akamai to Google Project Shield.
  - nathanielc 10y ago
    From the post: > I asked Akamai to redirect my site to 127.0.0.1 — effectively relegating all traffic destined for KrebsOnSecurity.com into a giant black hole. Since Akamai was going to drop the "shields" on the site, instead of smashing the hosting provider with the attack, DNS was pointed at localhost.
    - Senji 10y ago
      This seems like an ineffectual measure. Instead of giving the domain to the individual nodes in the DDoS. I'd resolve it once and pound the IP until it changes. With a simple script curling the page and looking at the content to check if it's pointed to the right server. Ignoring unroutable or inane IPs returned by the DNS.
- runn1ng 10y ago
  You still have the "old" (1 day old) DNS records. Try to flush your DNS cache.
  - 0xcde4c3db 10y ago
    My ISP's resolver has them too. Apparently it's somewhat common for ISP-run resolvers to impose minimum TTLs (the nominal TTL on the record I get is 5 minutes).
kyledrake 10y ago
Mirror: https://web.archive.org/web/20160925143639/https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://web.archive.org/web/20160925143639/https://krebsonse...
bogomipz 10y ago
He mentions: "There is every indication that this attack was launched with the help of a botnet that has enslaved a large number of hacked so-called “Internet of Things,” (IoT) devices — mainly routers, IP cameras and digital video recorders (DVRs) that are exposed to the Internet and protected with weak or hard-coded passwords." How was the source being compromised IoT ascertained? The only way I could imagine being able to determine that is by looking at the vendor bits on the MAC addresses of the source. But being that IoT devices are generally on a LAN on with some RFC 1918 address you wouldn't have that information. You wouldn't even have the MAC address of the default gateway that routed it. Can anyone comment on this?
- mhays 10y ago
  You can ascertain information pointing towards specific IoT devices from things like HTTP header information. I saw an blogpost a couple months ago detailing how the author ID'd an IoT DDOS botnet, which I can't find now, but here is a similar one: https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-ddos-attacks.html https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-...
- mhurron 10y ago
  > The only way I could imagine being able to determine that is by looking at the vendor bits on the MAC addresses of the source. But being that IoT devices are generally on a LAN on with some RFC 1918 address you wouldn't have that information. Your not going to have that even if the device has a public IP unless it is a public IPv6 address on a device not using privacy extensions. MAC addresses are link local only and are not transmitted beyond their local layer 2 network. There is device finger printing that you can do on the peculiarities of individual IP stack implementations, but honestly without solid proof or explanations from Krebs, they way he is holding himself out as a martyr over this leads me to not believing sensational claims he's making over the event.
jsn 10y ago
Yes, and this is old news, actually. We observed the rise of DDoS as a form of censorship in Russia roughly 10 years ago. People usually think that DDoS attacks are mostly used for extortion purposes, but in Russia it was routinely used to suppress some independent news outlets since 2006. Of course, now (since 2014) they have full-blown Internet censorship in Russia, so they don't need it anymore.
deleted 10y ago
[deleted]
runeks 10y ago
Are DDoS attacks really a problem for journalists getting out information to the public, or are they more so just a problem for journalists who want to distribute content via their own website? Wanting to run a website is reasonable, as it enables journalists to make money on ads as well, but does the inability to run your own website truly hamper free speech? This seems more like an architecture problem to me, not with regards to the Internet, but with regards to how articles are distributed: by contacting a server who responds with the article. If I really wanted to get some information out, I would upload it to: Google Drive, Dropbox, Amazon S3 and any other free/cheap hosting service I know, and spread the links out on Twitter, Facebook, HN, Reddit, etc. Would it really be possible for any attacker to take down all these services, thus preventing the information from getting out? Or is this more about distributing articles via a web app?
- wmf 10y ago
  To be protected against DDoS it sounds like you need to be hosted by Google, CloudFlare, or Akamai. Yet these companies are so influential and critical to the Internet that journalists need to feel that they are free to criticize them. AFAIK Google Drive, Dropbox, Amazon S3 etc. will drop you in a second with a "we're not getting paid enough to deal with this" error message if you bring a DDoS down on them.
  - pjscott 10y ago
    CloudFlare is saying all the right things in this relevant blog post: https://blog.cloudflare.com/cloudflare-and-free-speech/ https://blog.cloudflare.com/cloudflare-and-free-speech/ I'm fairly optimistic that they mean it -- and that if they don't, playing censor would be way more trouble for them than it could ever be worth.
  - eastdakota 10y ago
    This is such an important point. And it is exactly why, when we launched Project Galileo, CloudFlare's initiative to protect politically or artistically important work online, we decided it was critical that CloudFlare wasn't the one deciding what was "politically or artistically important." Instead we rely on the input of civil society organizations like the EFF, CDT, ACLU, Access, etc. If one of the partner organizations says something meets the criteria then we have committed to protecting it, for free and no questions asked. https://www.cloudflare.com/galileo/ https://www.cloudflare.com/galileo/ We offered to protect Brian's site under Galileo for free. Had he taken us up on our offer, which remains open, I would hope he would continue to be as critical of CloudFlare as he always has been. And I hope we've established some credibility in not abusing the position of trust we occupy. For instance, when we protected Spamhaus from a large DDoS attack years ago we specifically made it clear we'd never ask them to treat us any differently than any other organization they monitor. And we haven't. And, to this day, Spamhaus remains one of our biggest critics. And they remain a CloudFlare customer. Here's a talk I gave last year at Blackhat about the risks of ideas being suppressed on an Internet that is increasingly controlled by a small handful of providers: https://youtu.be/V-Pj0lrr168 https://youtu.be/V-Pj0lrr168 It's something we worry about all the time and I'm glad more people are beginning to discuss the risks it poses.
oliwarner 10y ago
Democracy isn't separate groups of individuals having —here— total power to take a website, datacentre, even CDN offline. What's actually happened is the consumerisation of weapons of mass destruction. Glamourising stuff like this isn't useful. Everybody involved is doing something wrong. We should be doing more at network level to remove botnets by removing (reporting then blocking) infected computers and servers. Continuing to ignore them isn't working.
- vintermann 10y ago
  Seconded. "Super-powered individuals" are the opposite of democracy, whether they are in that position because of jockeying and electioneering, or by buying malware services.
a3n 10y ago
> BCP38 is designed to filter such spoofed traffic, so that it never even traverses the network of an ISP that’s adopted the anti-spoofing measures. However, there are non-trivial economic reasons that many ISPs fail to adopt this best practice. So, it costs too much to run clean internet pipes. As the internet is a major part of the economy, as well as access to government (as well as government access to surveillance), it's probably time to regulate ISPs and related players for healthy operation, like water utilities.
- meanduck 10y ago
  No No No. There are probably ~100K of ISPs, many of them in judicially-weak countries. This will never work. ISPs are not the problem. Its fundamental oversight in routing architecture of internet. BCP38 is Best Current Practice. Not a protocol requirement. Once it becomes a requirement this will be solved in a week. The 5 RIRs[1] are the non-profit organizations that allocates IPs and regulates ASNs. I dont know how but we (or the big internet boys) should petition them to force ASNs to fix their routers. [1]: https://en.wikipedia.org/wiki/Regional_Internet_registry https://en.wikipedia.org/wiki/Regional_Internet_registry
  - a3n 10y ago
    > No No No. There are probably ~100K of ISPs, Good point. I was thinking in a US-centric way. Still, I'd like my ISPs in the US to be the internet equivalent of lead-free water.
    - pjc50 10y ago
      In the current lobbying environment you're more likely to end up with a statutory minimum of lead in your ISP (surveillance, filtering, anti-competitive measures, anti-net-neutrality, etc)
tomlock 10y ago
Kudos to Google for stepping up here! Krebs is a valuable voice of the free internet.
rasz_pl 10y ago
In other news we now know it at least ~700Gbps to shut down companies hiding behind Akamai.
tjpnz 10y ago
When I first saw the headline I thought this was going to be about YouTube Heroes.
78ytuhuyh 10y ago
Your migration is interesting, since it now censors me out because I live in Iran. So I can not read your article. Here is my browser capture, for your article, tab 2 for twitter, tab 3 for blogspot, tab 4 is sourceforge, and tab 5 is Nvidia! https://my.cloudme.com/d358b17/Capture https://my.cloudme.com/d358b17/Capture

182 points by rfreytag 10y ago

He's also put up a blog post about the incident. Apparently it's back up under Google's "Project Shield": https://news.ycombinator.com/item?id=12575047 https://news.ycombinator.com/item?id=12575047 https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://krebsonsecurity.com/2016/09/the-democratization-of-c...

andrewstuart2 10y ago
Ha. I swear this comment was on another post to begin with.
yohui 10y ago
You may be thinking of this discussion, "KrebsOnSecurity is now up and hosted on Google Cloud": https://news.ycombinator.com/item?id=12574428 https://news.ycombinator.com/item?id=12574428
- andrewstuart2 10y ago
  That's exactly what I'm thinking of. And actually, that's where I meant to leave this comment. I must have had both open in two tabs for copy/pasting the URL and picked the wrong one. Much less consequential tab-tastrophe than the time I dropped a table in production because I thought I was in my Dev tab. Backups saved my job that day. And I never kept two SQL servers up at once after that day. :-D

cantagi 10y ago

Something very weird is going on - krebsonsecurity.com is resolving to 127.0.0.1 . Could this be an attempt by someone's DNS servers to make the machines in the original attacking botnet DoS themselves?

0xcde4c3db 10y ago
I'm seeing the same thing. IIRC it was a mitigation measure by Akamai, perhaps to prevent new bots from joining the attack.
- sverige 10y ago
  In the article he mentions that was done before moving from Akamai to Google Project Shield.
- nathanielc 10y ago
  From the post: > I asked Akamai to redirect my site to 127.0.0.1 — effectively relegating all traffic destined for KrebsOnSecurity.com into a giant black hole. Since Akamai was going to drop the "shields" on the site, instead of smashing the hosting provider with the attack, DNS was pointed at localhost.
  - Senji 10y ago
    This seems like an ineffectual measure. Instead of giving the domain to the individual nodes in the DDoS. I'd resolve it once and pound the IP until it changes. With a simple script curling the page and looking at the content to check if it's pointed to the right server. Ignoring unroutable or inane IPs returned by the DNS.
runn1ng 10y ago
You still have the "old" (1 day old) DNS records. Try to flush your DNS cache.
- 0xcde4c3db 10y ago
  My ISP's resolver has them too. Apparently it's somewhat common for ISP-run resolvers to impose minimum TTLs (the nominal TTL on the record I get is 5 minutes).

kyledrake 10y ago

Mirror: https://web.archive.org/web/20160925143639/https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://web.archive.org/web/20160925143639/https://krebsonse...

bogomipz 10y ago

He mentions: "There is every indication that this attack was launched with the help of a botnet that has enslaved a large number of hacked so-called “Internet of Things,” (IoT) devices — mainly routers, IP cameras and digital video recorders (DVRs) that are exposed to the Internet and protected with weak or hard-coded passwords." How was the source being compromised IoT ascertained? The only way I could imagine being able to determine that is by looking at the vendor bits on the MAC addresses of the source. But being that IoT devices are generally on a LAN on with some RFC 1918 address you wouldn't have that information. You wouldn't even have the MAC address of the default gateway that routed it. Can anyone comment on this?

mhays 10y ago
You can ascertain information pointing towards specific IoT devices from things like HTTP header information. I saw an blogpost a couple months ago detailing how the author ID'd an IoT DDOS botnet, which I can't find now, but here is a similar one: https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-ddos-attacks.html https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-...
mhurron 10y ago
> The only way I could imagine being able to determine that is by looking at the vendor bits on the MAC addresses of the source. But being that IoT devices are generally on a LAN on with some RFC 1918 address you wouldn't have that information. Your not going to have that even if the device has a public IP unless it is a public IPv6 address on a device not using privacy extensions. MAC addresses are link local only and are not transmitted beyond their local layer 2 network. There is device finger printing that you can do on the peculiarities of individual IP stack implementations, but honestly without solid proof or explanations from Krebs, they way he is holding himself out as a martyr over this leads me to not believing sensational claims he's making over the event.

jsn 10y ago

Yes, and this is old news, actually. We observed the rise of DDoS as a form of censorship in Russia roughly 10 years ago. People usually think that DDoS attacks are mostly used for extortion purposes, but in Russia it was routinely used to suppress some independent news outlets since 2006. Of course, now (since 2014) they have full-blown Internet censorship in Russia, so they don't need it anymore.

deleted 10y ago

[deleted]

runeks 10y ago

Are DDoS attacks really a problem for journalists getting out information to the public, or are they more so just a problem for journalists who want to distribute content via their own website? Wanting to run a website is reasonable, as it enables journalists to make money on ads as well, but does the inability to run your own website truly hamper free speech? This seems more like an architecture problem to me, not with regards to the Internet, but with regards to how articles are distributed: by contacting a server who responds with the article. If I really wanted to get some information out, I would upload it to: Google Drive, Dropbox, Amazon S3 and any other free/cheap hosting service I know, and spread the links out on Twitter, Facebook, HN, Reddit, etc. Would it really be possible for any attacker to take down all these services, thus preventing the information from getting out? Or is this more about distributing articles via a web app?

wmf 10y ago
To be protected against DDoS it sounds like you need to be hosted by Google, CloudFlare, or Akamai. Yet these companies are so influential and critical to the Internet that journalists need to feel that they are free to criticize them. AFAIK Google Drive, Dropbox, Amazon S3 etc. will drop you in a second with a "we're not getting paid enough to deal with this" error message if you bring a DDoS down on them.
- pjscott 10y ago
  CloudFlare is saying all the right things in this relevant blog post: https://blog.cloudflare.com/cloudflare-and-free-speech/ https://blog.cloudflare.com/cloudflare-and-free-speech/ I'm fairly optimistic that they mean it -- and that if they don't, playing censor would be way more trouble for them than it could ever be worth.
- eastdakota 10y ago
  This is such an important point. And it is exactly why, when we launched Project Galileo, CloudFlare's initiative to protect politically or artistically important work online, we decided it was critical that CloudFlare wasn't the one deciding what was "politically or artistically important." Instead we rely on the input of civil society organizations like the EFF, CDT, ACLU, Access, etc. If one of the partner organizations says something meets the criteria then we have committed to protecting it, for free and no questions asked. https://www.cloudflare.com/galileo/ https://www.cloudflare.com/galileo/ We offered to protect Brian's site under Galileo for free. Had he taken us up on our offer, which remains open, I would hope he would continue to be as critical of CloudFlare as he always has been. And I hope we've established some credibility in not abusing the position of trust we occupy. For instance, when we protected Spamhaus from a large DDoS attack years ago we specifically made it clear we'd never ask them to treat us any differently than any other organization they monitor. And we haven't. And, to this day, Spamhaus remains one of our biggest critics. And they remain a CloudFlare customer. Here's a talk I gave last year at Blackhat about the risks of ideas being suppressed on an Internet that is increasingly controlled by a small handful of providers: https://youtu.be/V-Pj0lrr168 https://youtu.be/V-Pj0lrr168 It's something we worry about all the time and I'm glad more people are beginning to discuss the risks it poses.

oliwarner 10y ago

Democracy isn't separate groups of individuals having —here— total power to take a website, datacentre, even CDN offline. What's actually happened is the consumerisation of weapons of mass destruction. Glamourising stuff like this isn't useful. Everybody involved is doing something wrong. We should be doing more at network level to remove botnets by removing (reporting then blocking) infected computers and servers. Continuing to ignore them isn't working.

vintermann 10y ago
Seconded. "Super-powered individuals" are the opposite of democracy, whether they are in that position because of jockeying and electioneering, or by buying malware services.

a3n 10y ago

> BCP38 is designed to filter such spoofed traffic, so that it never even traverses the network of an ISP that’s adopted the anti-spoofing measures. However, there are non-trivial economic reasons that many ISPs fail to adopt this best practice. So, it costs too much to run clean internet pipes. As the internet is a major part of the economy, as well as access to government (as well as government access to surveillance), it's probably time to regulate ISPs and related players for healthy operation, like water utilities.

meanduck 10y ago
No No No. There are probably ~100K of ISPs, many of them in judicially-weak countries. This will never work. ISPs are not the problem. Its fundamental oversight in routing architecture of internet. BCP38 is Best Current Practice. Not a protocol requirement. Once it becomes a requirement this will be solved in a week. The 5 RIRs[1] are the non-profit organizations that allocates IPs and regulates ASNs. I dont know how but we (or the big internet boys) should petition them to force ASNs to fix their routers. [1]: https://en.wikipedia.org/wiki/Regional_Internet_registry https://en.wikipedia.org/wiki/Regional_Internet_registry
- a3n 10y ago
  > No No No. There are probably ~100K of ISPs, Good point. I was thinking in a US-centric way. Still, I'd like my ISPs in the US to be the internet equivalent of lead-free water.
  - pjc50 10y ago
    In the current lobbying environment you're more likely to end up with a statutory minimum of lead in your ISP (surveillance, filtering, anti-competitive measures, anti-net-neutrality, etc)

tomlock 10y ago

Kudos to Google for stepping up here! Krebs is a valuable voice of the free internet.

rasz_pl 10y ago

In other news we now know it at least ~700Gbps to shut down companies hiding behind Akamai.

tjpnz 10y ago

When I first saw the headline I thought this was going to be about YouTube Heroes.

78ytuhuyh 10y ago

Your migration is interesting, since it now censors me out because I live in Iran. So I can not read your article. Here is my browser capture, for your article, tab 2 for twitter, tab 3 for blogspot, tab 4 is sourceforge, and tab 5 is Nvidia! https://my.cloudme.com/d358b17/Capture https://my.cloudme.com/d358b17/Capture