5 ms·
As system administrator of my home network, it worries me that a device on my network might be involved in an attack like this, and I would never know. Maybe t
by nacnud 10y ago
As system administrator of my home network, it worries me that a device on my network might be involved in an attack like this, and I would never know.
Maybe the target of such an attack could gather a list of IP addresses used in the attack, then pass them to Google, who might warn on their search homepage if you browse from one of the IPs on the list? (e.g. "Some of your internet devices may be at risk, click here to find out more") I know IP addresses are a poor proxy for identity, but it could be a step in the right direction.
- ge0rg 10y agoGoogle already has a similar mechanism in place where they require captchas from IP addresses that abused Google APIs previously. The combination of that with Google Shield might actually work to inform the users, but then again users are confronted with similar warnings from abusive ad networks all the time, and probably learned to click them away fast and forget about it.
- deleted 10y ago[deleted]
- vadiml 10y agoSimply set up your firewall to drop outgoing packets with source address not belonging to your subnet. The DDOS slaves are usually sending packets with spoofed source ip addresses
- ge0rg 10y agoThis is usually only true for amplification attacks. The new 1Tbps and 600+Gbps attacks reported about are direct traffic attacks from the actual bot IP addresses.
- slig 10y ago> The DDOS slaves are usually sending packets with spoofed source ip addresses I don't understand why this works. Why doesn't my ISP simply block outgoing packages with "fake" source IPs?
- Dylan16807 10y agoPure laziness.
- hannob 10y agoMost of them do that already. It's called BCP38. ~20-30% of ISPs however don't.
- FoeNyx 10y agoTo quote Krebs [1] on that subject: > BCP38 is designed to filter such spoofed traffic, so that it never even traverses the network of an ISP that’s adopted the anti-spoofing measures. However, there are non-trivial economic reasons that many ISPs fail to adopt this best practice. This blog post [2] from the Internet Society does a good job of explaining why many ISPs ultimately decide not to implement BCP38. [1] https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://krebsonsecurity.com/2016/09/the-democratization-of-c... [2] http://www.internetsociety.org/deploy360/blog/2014/07/anti-spoofing-bcp-38-and-the-tragedy-of-the-commons/ http://www.internetsociety.org/deploy360/blog/2014/07/anti-s...
- LeifCarrotson 10y agoI read the article. The reasons are trivial. First, old (>10 years) networking hardware may be unable to support it. All new hardware can do it, but some old stuff can't, and some ISPs haven't budgeted for the update. Response: 10 years is forever in the hardware cycle. This isn't a woodworking business, where old heavy iron is a good thing. Sensible businesses budget for returns on investment and mean time between failure on shorter time scales. Second, the labor to install network hardware replacements and perform configuration updates is expensive. Response: That's literally your job, you don't get paid to sit around and collect money. Third, and most importantly, the costs of the DDOS are not felt by the ISP. It's a tragedy of the commons. Response: Regulation, obviously, is required. If your network causes damage that the industry says you should have prevented, you should pay.
- r1ch 10y agoNo home network or consumer ISP should allow spoofed source packets beyond the edge. The spoofing problems come from cheap / shady dedicated + VPS providers.
- e40 10y agoCorrect. I use # deny spoofers extinput="iptables -t filter -A INPUT -i wan" $extinput -s 127.0.0.0/8 -j REJECT $extinput -s 10.0.0.0/8 -j REJECT $extinput -s 172.16.0.0/12 -j REJECT $extinput -s 192.168.0.0/16 -j REJECT
- falcolas 10y agoIronically enough, this is a place where I think that remotely managed routers (like the OnHub) might be a fantastic solution for the average Joe. Dynamically identify problematic traffic patterns, and block them at the home router. It would be an 80% solution at best, and I wouldn't want one; but I trust Google more than I do my mom when it comes to managing the packets coming out of her network.
- fulafel 10y agoThere are home network monitoring products. Here's a roundup: http://thenextweb.com/insider/2016/01/04/4-devices-that-can-help-secure-your-homes-iot/ http://thenextweb.com/insider/2016/01/04/4-devices-that-can-... Anyone know of a good open source solution that doesn't require a huge amount of fiddling?