6 ms·

I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers (http://blog.z

by mrb 10y ago

I will never understand why some people disregard IP spoofing as a real risk. For example when I reported a vulnerability to the nginx developers (http://blog.zorinaq.com/nginx-resolver-vulns/ http://blog.zorinaq.com/nginx-resolver-vulns/) about their DNS stub resolver using predictable transaction IDs, they refused to consider it a vulnerability, effectively saying no one could exploit it because spoofing the IP of the DNS server can't be done on the Internet. And yet https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php shows ~25% of network prefixes can be spoofed... sigh

hueving 10y ago
It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing capable, 100,000 node botnet (or the bitcoin required to rent on) with or without reflection capabilities is going to be able to saturate 40gb links. Name and shame ISPs that allow spoofing, stop wasting developers' time with this crap.
- majke 10y ago
  This is precisely the point of this article. The only real long term solution to stop large DDoS is to stop spoofing. The only way to stop IP spoofing is to shame misconfigured networks. For that you need attribution.
  - silverwind 10y ago
    Recent HTTP DDoS attacks have shown that there is no dependency on spoofing. The problem will be there as long as there's insecure hardware out there.
    - paulddraper 10y ago
      Currently DDoS requires insecure hardware. If it didn't, we're one step closer to fixing it.
      - x0rx0r 10y ago
        This statement is simply not true.
        paulddraper 10y ago
        Sorry, missing word. Currently, DDoS doesn't require compromised hardware, because of spoofing. But if there were no spoofing, compromised hardware would be a requirement, and we're one step closer.
    - hueving 10y ago
      Once spoofing is solved, you have attribution. Once you have attribution, you can use blacklists, notify ISPs, etc. Cleaning up or isolating infected machines becomes tractable at that point.
      - dogma1138 10y ago
        Blacklists and attribution do not hold that much value. Blacklists are only useful to stop only a few DDoS attacks mainly amplified ones like the ones that abuse open DNS resolvers which should be cleaned up on their own, in which case you want to be blacklisting the resolvers not the machines that use IP spoofing since they do not attack you directly. Many (heck most) DDoS attacks do not use IP spoofing, the recent and largest recorded in history just used 145,000 IP enabled cameras, and this isn't even remotely the largest botnet out there, blacklisting an entire botnet is effectively DDoSing yourself since many of those machines can be on a network with 100's or 1000's of other computers behind the same IP which many of them would be legitimate users of your service. Notifying ISP's also doesn't help, some ISP's can do some preventative measures but what often they do is simply kill routes to your service, again it would work if you are dealing with some ISP in Slovakia if you aren't serving any customers there (granted they actually respond to you in due time) but if you are dealing with large ISP's there is little they could do and cutting them off isn't an option. And as for as cleaning and isolating these machines this is laughable, you aren't going to be tracking down customers, even the ISP won't do that for you, and even if it did what would it do send and email that would likely be ignored? Even if you identify customer the IP belongs to it doesn't tell you anything about the device, not to mention that the customer would likely have no capability of cleaning up their machines to begin with. IP spoofing is a problem because there are currently ways to abuse IP spoofing to amplify the attacks, if you aren't amplifying your attack using UDP protocols you will usually not going to be using IP spoofing in the first place, and automatically banning IP addresses might sound like a good tactic until you are hit with DDoS from a big botnet within your market region at which point you can't use that any more, you might ban a few IP's that seem to have access to excessive bandwidth but even that might be problematic since it can affect legitimate users.
  - mjevans 10y ago
    You need to go one step beyond attribution. You need to make BCP 38 and other 'behave nicely' protocols /requirements/; and to block any ISP that isn't following them.
- erichocean 10y ago
  > the crusade to end useful UDP protocols is successful What? What crusade? I love UDP, use it every chance I get. Who is "crusading" to end UDP on the Internet?
  - w8rbt 10y ago
    All the orgs suffering from amplification attacks from services using UDP. DNS, NTP, chargen, etc.
    - openasocket 10y ago
      ... do people still use chargen? Are there seriously still chargen servers in the world?
      - x0 10y ago
        Oh man they are rare but they are definitely still out there. Think printers from the 90's that came with chargen & usually telnet enabled by default, and for some reason are publicly accessible.
    - toast0 10y ago
      Is udp/chargen really a useful publically exposed protocol? Does it provide a benefit over tcp/chargen? Most of the fine people running chargen servers seem to be running the server from Microsoft services for UNIX package which is configured to send giant fragmented responses, and then they have a firewall that drops the first fragment. Thanks a lot guys.
    - hueving 10y ago
      Those organizations are unfortunately confused and are not directing their frustrations towards the real cause (ISPs which allow spoofing).
  - collinmanderson 10y ago
    It's fine to have a public UDP server on the internet. Just make sure it can't be used to amplify/mirror attacks. QUIC uses tokens for example. https://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblHd_L2f5LTaDUDwvZ5L6g/edit https://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblH...
- zAy0LfpBZLC8mAC 10y ago
  > It's a form of victim blaming. 1. Victim blaming is when you excuse someone's bad behaviour with the justification that the person(s) negatively affected by it could have protected/tried to protect themselves against it. That doesn't have anything to do with the question whether you should try to protect yourself, or whether you might have some obligation to try and protect others. 2. Based on your logic, what you are doing would be victim blaming: Incompetent ISPs don't perform DDoS attacks, and yet you seem to see some sort of obligation on their part to implement BCP 38 to protect others from that bad behavior of others. The ISP is just as much a victim in a position where they can help and protect others as people running UDP services.
  - oldmanjay 10y ago
    Using this definition, another example of victim blaming is telling children to look both ways before crossing the street.
    - hueving 10y ago
      No, the equivalent would be telling children they can't have toys because someone might steal a toy gun from them and use it to hold up a bank.
    - joombaga 10y ago
      No, it's telling a child that has been hit by a car repeatedly to look both ways next time, when you know it would definitely reduce their chance of getting hit. Performing edge ingress traffic filtering of known-trunked node addresses (i.e. BCP 38) has a high likelihood of reducing the effectiveness of DDoS attacks.
  - hueving 10y ago
    Services used in amplification attacks are victims because their services are being DoS'ed as well and their IPs are the ones that end up on flowspec block lists. They are also victims from the second order effects of idiots in prominent places claiming that their services are the source of the Internet's woes (e.g. Cloudflare's ridiculing of dns resolver operators). Your entire second point is nonsensical because they aren't impacted by DoS attacks. They aren't 'victims' in any sense. Also, people running UDP services cannot stop source spoofed DDoS attacks. You can block the entire UDP protocol today and the problem of untraceable attacks will be just as prevalent tomorrow. The largest attack observed (>1tbps didn't use amplifying UDP services at all). BCP 38 would end this problem, full stop. ISPs complicit in what amounts to fraud deserve no sympathy. On most routers, ingress filtering is a one line option. Yet people like you promote breaking changes to UDP protocols as a half-baked solution that doesn't do anything to actually stop source spoofed DDoS attacks. It baffles me.
- Sanddancer 10y ago
  The problem needs fixed from both ends. Developers that write and maintain programs with bad defaults should be named and shamed as well. Their software has a security flaw that allows these problems to be exploited. Back in the 90s, the default configuration for most mail servers was to allow relaying from all and sundry, until the spam problem made people realize that an open relay was a bad thing that would be abused by malicious actors. Saying developers' time shouldn't be "wasted" on this is like saying automakers' time shouldn't be wasted on airbags and people should just drive better.
  - hueving 10y ago
    No, this is a completely false equivalence (the spam comparison). An open relay is the equivalent to ISPs allowing people to put whatever IP they want in the header. People are operating completely sane services and anti-UDP warriors suggesting they change them because they appeared in a ddos is idiotic and harmful to the Internet. You can completely eliminate all UDP services and the untraceable DDoS problem won't go away, you've just eliminated some amplification avenues. The 1.5tbps attack didn't even use UDP so this "solution" is dead in the water and whoever is pushing it is misinformed. Do you realize that every public DNS server in the world (root servers, recursive revolvers, Google.com NS servers, etc) can be used in an amplification attack? According to you we should name and shame every DNS developer, domain name owner, and operator. We essentially couldn't have functioning DNS if we operated under your plan to 'fix this from both ends'. I suggest you read up on amplification attacks because I think you misunderstand how they actually work and think there is a way to 'configure' your way out of them. This problem absolutely should not be "fixed from both ends". The right hand side (eliminate all amplifying UDP protocols) is massively disruptive (bye bye DNS) and doesn't actually fix the root issue (attackers just spoof TCP instead with a reduced amplification factor). The left hand side (BCP 38) requires fewer participants (ISPs vs server operators) and it completely solves the problem even without the slightest adoption of the stupidity on the right hand solution. If you have ever suggested that a dns operator disable recursive resolving, you are perpetuating the problem by making people participate in an idiotic ritual that does almost nothing to improve the security of the Internet. It's the equivalent of restaurants not serving glasses of water to reduce the water shortage while farmers grow rice patties in a desert with essentially unlimited water rights.
- deleted 10y ago
  [deleted]
- ryanlol 10y ago
  > Someone with a spoofing capable, 100,000 node botnet Does not exist and if it did, it's the unspoofed traffic you should be worried about.
micro_softy 10y ago
The author argues DDoS causes centralization because it's "just too easy to knock unprotected websites offline" and so they need to pay some organization that makes money from centralization for "protection". This assumes that the centralized topology and usage of the internet as it is implemented will never change, despite the fact that by design an internet can be decentralized and therefore resilient. Isn't that what Paul Baran thought made it a useful idea? Imagine for a moment that the internet really was like a mesh net instead of several lengths of heavy rope frayed at the ends. Imagine it looked like Paul Baran's sketches. True or false: If there was not such reliance on "backbones" and "ISPs" then knocking some endpoint offline would not necessarily threaten the connections of others and would not be costly to anyone except the target. DDoS would only affect a small portion of the network mesh. There would be multiple ways for point A to reach point C besides going through B. True or false: If internet users demanded peer-to-peer connections instead of accepting firewalled, calf-cow access to "websites" then there would be no need for DDoS protection, because knocking a website offline would not stop people from getting the served content from other endpoints. The attacker would have to knock offline every supernode that an endpoint could possibly access or every node listed in a distributed hash table.

by mrb 10y ago

hueving 10y ago

It's a form of victim blaming. We have hoards of people chasing down any developers that have written a fast response UDP protocol and any operators running them. Yet the cause is incompetent ISPs that fail to implement BCP 38. Even if the crusade to end useful UDP protocols is successful, all of that short-sighted behavior is for nothing because untraceable DDoS attacks are still a problem. Someone with a spoofing capable, 100,000 node botnet (or the bitcoin required to rent on) with or without reflection capabilities is going to be able to saturate 40gb links. Name and shame ISPs that allow spoofing, stop wasting developers' time with this crap.

majke 10y ago
This is precisely the point of this article. The only real long term solution to stop large DDoS is to stop spoofing. The only way to stop IP spoofing is to shame misconfigured networks. For that you need attribution.
- silverwind 10y ago
  Recent HTTP DDoS attacks have shown that there is no dependency on spoofing. The problem will be there as long as there's insecure hardware out there.
  - paulddraper 10y ago
    Currently DDoS requires insecure hardware. If it didn't, we're one step closer to fixing it.
    - x0rx0r 10y ago
      This statement is simply not true.
      - paulddraper 10y ago
        Sorry, missing word. Currently, DDoS doesn't require compromised hardware, because of spoofing. But if there were no spoofing, compromised hardware would be a requirement, and we're one step closer.
  - hueving 10y ago
    Once spoofing is solved, you have attribution. Once you have attribution, you can use blacklists, notify ISPs, etc. Cleaning up or isolating infected machines becomes tractable at that point.
    - dogma1138 10y ago
      Blacklists and attribution do not hold that much value. Blacklists are only useful to stop only a few DDoS attacks mainly amplified ones like the ones that abuse open DNS resolvers which should be cleaned up on their own, in which case you want to be blacklisting the resolvers not the machines that use IP spoofing since they do not attack you directly. Many (heck most) DDoS attacks do not use IP spoofing, the recent and largest recorded in history just used 145,000 IP enabled cameras, and this isn't even remotely the largest botnet out there, blacklisting an entire botnet is effectively DDoSing yourself since many of those machines can be on a network with 100's or 1000's of other computers behind the same IP which many of them would be legitimate users of your service. Notifying ISP's also doesn't help, some ISP's can do some preventative measures but what often they do is simply kill routes to your service, again it would work if you are dealing with some ISP in Slovakia if you aren't serving any customers there (granted they actually respond to you in due time) but if you are dealing with large ISP's there is little they could do and cutting them off isn't an option. And as for as cleaning and isolating these machines this is laughable, you aren't going to be tracking down customers, even the ISP won't do that for you, and even if it did what would it do send and email that would likely be ignored? Even if you identify customer the IP belongs to it doesn't tell you anything about the device, not to mention that the customer would likely have no capability of cleaning up their machines to begin with. IP spoofing is a problem because there are currently ways to abuse IP spoofing to amplify the attacks, if you aren't amplifying your attack using UDP protocols you will usually not going to be using IP spoofing in the first place, and automatically banning IP addresses might sound like a good tactic until you are hit with DDoS from a big botnet within your market region at which point you can't use that any more, you might ban a few IP's that seem to have access to excessive bandwidth but even that might be problematic since it can affect legitimate users.
- mjevans 10y ago
  You need to go one step beyond attribution. You need to make BCP 38 and other 'behave nicely' protocols /requirements/; and to block any ISP that isn't following them.
erichocean 10y ago
> the crusade to end useful UDP protocols is successful What? What crusade? I love UDP, use it every chance I get. Who is "crusading" to end UDP on the Internet?
- w8rbt 10y ago
  All the orgs suffering from amplification attacks from services using UDP. DNS, NTP, chargen, etc.
  - openasocket 10y ago
    ... do people still use chargen? Are there seriously still chargen servers in the world?
    - x0 10y ago
      Oh man they are rare but they are definitely still out there. Think printers from the 90's that came with chargen & usually telnet enabled by default, and for some reason are publicly accessible.
  - toast0 10y ago
    Is udp/chargen really a useful publically exposed protocol? Does it provide a benefit over tcp/chargen? Most of the fine people running chargen servers seem to be running the server from Microsoft services for UNIX package which is configured to send giant fragmented responses, and then they have a firewall that drops the first fragment. Thanks a lot guys.
  - hueving 10y ago
    Those organizations are unfortunately confused and are not directing their frustrations towards the real cause (ISPs which allow spoofing).
- collinmanderson 10y ago
  It's fine to have a public UDP server on the internet. Just make sure it can't be used to amplify/mirror attacks. QUIC uses tokens for example. https://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblHd_L2f5LTaDUDwvZ5L6g/edit https://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblH...
zAy0LfpBZLC8mAC 10y ago
> It's a form of victim blaming. 1. Victim blaming is when you excuse someone's bad behaviour with the justification that the person(s) negatively affected by it could have protected/tried to protect themselves against it. That doesn't have anything to do with the question whether you should try to protect yourself, or whether you might have some obligation to try and protect others. 2. Based on your logic, what you are doing would be victim blaming: Incompetent ISPs don't perform DDoS attacks, and yet you seem to see some sort of obligation on their part to implement BCP 38 to protect others from that bad behavior of others. The ISP is just as much a victim in a position where they can help and protect others as people running UDP services.
- oldmanjay 10y ago
  Using this definition, another example of victim blaming is telling children to look both ways before crossing the street.
  - hueving 10y ago
    No, the equivalent would be telling children they can't have toys because someone might steal a toy gun from them and use it to hold up a bank.
  - joombaga 10y ago
    No, it's telling a child that has been hit by a car repeatedly to look both ways next time, when you know it would definitely reduce their chance of getting hit. Performing edge ingress traffic filtering of known-trunked node addresses (i.e. BCP 38) has a high likelihood of reducing the effectiveness of DDoS attacks.
- hueving 10y ago
  Services used in amplification attacks are victims because their services are being DoS'ed as well and their IPs are the ones that end up on flowspec block lists. They are also victims from the second order effects of idiots in prominent places claiming that their services are the source of the Internet's woes (e.g. Cloudflare's ridiculing of dns resolver operators). Your entire second point is nonsensical because they aren't impacted by DoS attacks. They aren't 'victims' in any sense. Also, people running UDP services cannot stop source spoofed DDoS attacks. You can block the entire UDP protocol today and the problem of untraceable attacks will be just as prevalent tomorrow. The largest attack observed (>1tbps didn't use amplifying UDP services at all). BCP 38 would end this problem, full stop. ISPs complicit in what amounts to fraud deserve no sympathy. On most routers, ingress filtering is a one line option. Yet people like you promote breaking changes to UDP protocols as a half-baked solution that doesn't do anything to actually stop source spoofed DDoS attacks. It baffles me.
Sanddancer 10y ago
The problem needs fixed from both ends. Developers that write and maintain programs with bad defaults should be named and shamed as well. Their software has a security flaw that allows these problems to be exploited. Back in the 90s, the default configuration for most mail servers was to allow relaying from all and sundry, until the spam problem made people realize that an open relay was a bad thing that would be abused by malicious actors. Saying developers' time shouldn't be "wasted" on this is like saying automakers' time shouldn't be wasted on airbags and people should just drive better.
- hueving 10y ago
  No, this is a completely false equivalence (the spam comparison). An open relay is the equivalent to ISPs allowing people to put whatever IP they want in the header. People are operating completely sane services and anti-UDP warriors suggesting they change them because they appeared in a ddos is idiotic and harmful to the Internet. You can completely eliminate all UDP services and the untraceable DDoS problem won't go away, you've just eliminated some amplification avenues. The 1.5tbps attack didn't even use UDP so this "solution" is dead in the water and whoever is pushing it is misinformed. Do you realize that every public DNS server in the world (root servers, recursive revolvers, Google.com NS servers, etc) can be used in an amplification attack? According to you we should name and shame every DNS developer, domain name owner, and operator. We essentially couldn't have functioning DNS if we operated under your plan to 'fix this from both ends'. I suggest you read up on amplification attacks because I think you misunderstand how they actually work and think there is a way to 'configure' your way out of them. This problem absolutely should not be "fixed from both ends". The right hand side (eliminate all amplifying UDP protocols) is massively disruptive (bye bye DNS) and doesn't actually fix the root issue (attackers just spoof TCP instead with a reduced amplification factor). The left hand side (BCP 38) requires fewer participants (ISPs vs server operators) and it completely solves the problem even without the slightest adoption of the stupidity on the right hand solution. If you have ever suggested that a dns operator disable recursive resolving, you are perpetuating the problem by making people participate in an idiotic ritual that does almost nothing to improve the security of the Internet. It's the equivalent of restaurants not serving glasses of water to reduce the water shortage while farmers grow rice patties in a desert with essentially unlimited water rights.
deleted 10y ago
[deleted]
ryanlol 10y ago
> Someone with a spoofing capable, 100,000 node botnet Does not exist and if it did, it's the unspoofed traffic you should be worried about.

micro_softy 10y ago

The author argues DDoS causes centralization because it's "just too easy to knock unprotected websites offline" and so they need to pay some organization that makes money from centralization for "protection". This assumes that the centralized topology and usage of the internet as it is implemented will never change, despite the fact that by design an internet can be decentralized and therefore resilient. Isn't that what Paul Baran thought made it a useful idea? Imagine for a moment that the internet really was like a mesh net instead of several lengths of heavy rope frayed at the ends. Imagine it looked like Paul Baran's sketches. True or false: If there was not such reliance on "backbones" and "ISPs" then knocking some endpoint offline would not necessarily threaten the connections of others and would not be costly to anyone except the target. DDoS would only affect a small portion of the network mesh. There would be multiple ways for point A to reach point C besides going through B. True or false: If internet users demanded peer-to-peer connections instead of accepting firewalled, calf-cow access to "websites" then there would be no need for DDoS protection, because knocking a website offline would not stop people from getting the served content from other endpoints. The attacker would have to knock offline every supernode that an endpoint could possibly access or every node listed in a distributed hash table.