6 ms·

Interestingly, in some ways this is a big selling point of AWS/Azure/Goog. The absolute scale they can handle is way up there. The downside of course, is that

by traskjd 10y ago

Interestingly, in some ways this is a big selling point of AWS/Azure/Goog. The absolute scale they can handle is way up there. The downside of course, is that whilst their infrastructure can likely handle it, handling the bill associated with 'just scale up your service' could be worse than the attack itself.

deegles 10y ago
That's a good point. If anything, it makes DDOS attacks more effective since you can't easily scale up your bank account :)
deleted 10y ago
[deleted]
stcredzero 10y ago
If Azure and Google would like to gain a competitive advantage over AWS, then I would suggest this: Build out a suite of tools for fighting DDOS. Enable private consultants and companies to provide this as a service. Do this in such a way, that cloud customers save money and have to worry about less. Hell, let companies jump in structured as insurance companies! Also bring in cooperation with law enforcement and use data gathering to catch and prosecute DDOS-ers.
- bogomipz 10y ago
  You can't just build a "suite of tools" and give them to a customer to fight a DDOS. The way DDOS is mitigated is by making routing changes at the network edge. This is not something you want a customer to be able to do for obvious reasons. And these in themselves are sometimes not enough and DDOS mitigation will require coordinating with transit providers, again not something you would want put in a customer console.
- capecodcarl 10y ago
  Doesn't Google already have the infrastructure to deal with an attack of this magnitude? I remember recently reading about Krebs on Security moving to Google's Project Shield service: http://www.zdnet.com/article/google-rescues-krebs-on-security-from-the-abyss/ http://www.zdnet.com/article/google-rescues-krebs-on-securit...
  - nstj 10y ago
    afaik Shield is for select journalists only, not for typical web infrastructure.
    - jtl999 10y ago
      https://support.google.com/projectshield/answer/6358116?hl=en https://support.google.com/projectshield/answer/6358116?hl=e... > My website is on Blogger, Google Sites, or Google App Engine. Am I eligible? > As Google products, these sites already have similar DDoS protection to Project Shield. Your website would not need to be set up with Project Shield. Wonder if that answer includes Compute Engine. Doubt it.
      - brazzledazzle 10y ago
        It would be interesting to try using App Engine to simply proxy traffic. I don't know enough about it to even know if it's technically feasible. I imagine the downsides would be many but it could be useful as a temporary measure while you're getting attacked.
        yannovitch 10y ago
        Some people already use App Engine as a free CDN (http://www.digitalistic.com/2008/06/09/10-easy-steps-to-use-google-app-engine-as-your-own-cdn/ http://www.digitalistic.com/2008/06/09/10-easy-steps-to-use-...) , I imagine it would be totally possible to use it as a proxy.
- atmosx 10y ago
  > Enable private consultants and companies to provide this as a service. If I am an AWS customer I expect AWS to handle/prevent DDoS, same way as they do with S3 to achieve 11 9's availability (the files are saved in multiple AZs in the same region - Glacier IIRC copy files on different regions to avoid data loss in case of physical disaster). One of the reason for choosing AWS is because AMZ has deep pockets and has the means (financial and technical) to fight against large DDoS attacks, while a smaller provider might not have to do that. Putting clients in a position to have to buy that sort of protection doesn't sound very smart to me.
  - qaq 10y ago
    "achieve 11 9's availability" is this sarcasm?
    - _adamb 10y ago
      They're referring to AWS S3's claim of 99.999999999% durability. AWS actually offers 99.99% availability.
      - qaq 10y ago
        Oh that at least could theoretically be feasible considering AWS's SLA though they might as well claim it's 99.9999999999999999999999999%
    - wcummings 10y ago
      It all depends how you measure it
  - ryanlol 10y ago
    > If I am an AWS customer I expect AWS to handle/prevent DDoS, same way as they do with S3 to achieve 11 9's availability If you are an AWS customer you should have done your due diligence and know that amazon won't do a very good job at that.
    - toomuchtodo 10y ago
- matt4077 10y ago
  Cloudflare is targeting that market pretty heavily.
atmosx 10y ago
Isn't that the meaning the having multiple AWS regions? :-) If you want HA at local level you'd go with AWS AZs but if you need real HA you need can do the same at region-level. Of course not everyone has the money/need to go down that route, but it's possible and even advised for some AWS services.
JshWright 10y ago
Yup until this morning, AWS was using Dyn as the sole provider of nameservers for the us-east-1 zone. So this attack did have a pretty substantial impact on some AWS services until they updated us-east-1 to use the more diverse set of nameservers their other datacenters use.
unexistance 10y ago
so it will be eventually Cloud VS DDoS eh, both can scale indefinitely so the limit is money, which makes the DDoS guys wins, they practically stole CPU/RAM/NET where cloud providers need to buy hardware as usual Unless we can somehow secure every net-connected devices, ha (I don't know whether to cry or laugh right now)
- losteverything 10y ago
  Can you third grade down your comment please? I find your language to be of high interest like you had a "dUH" moment - which I am ignorant to get myself. The Sons rays meat
  - cheepin 10y ago
    DDOS usually occurs via a botnet of infected networked devices. Thus, the attacker is getting their resources for "free" since their host is unknowingly wasting CPU and bandwidth during the attack, while the defender is paying for theirs.
    - kpil 10y ago
      Until Google starts serving pages from our phones...
    - losteverything 10y ago
      Thanks Is this analogy accurate? I have one road to get home. It got blocked so I create 2 more roads. I now have 3 Roads to get home. All 3 become blocked. So now I have to make another road. More roads is redundancy and requires capital. The roads become unblocked but I now must expect future road blocks.
benmac 10y ago
AWS has considerable defenses against DDOS attacks of all types - here's the video from Reinvent 2015 which introduces many of Amazon's defenses as well as best practices - https://www.youtube.com/watch?v=Ys0gG1koqJA https://www.youtube.com/watch?v=Ys0gG1koqJA Interestingly, the presenter notes that Amazon had seen a drop in DNS as an attack vector in 2015. I asked the presenter (Product Manager) why they hadn't productized the DDoS attack dashboard so you could be aware if you were being attacked (and it was being absorbed by AWS) and his response was that there was insufficient demand at that point to justify the developer staffing. He gave me his card and asked to request the feature so he could us it to make the case internally. Does anyone here have stories of being successfully DDoS'd on AWS (other than by their own staff :) ?

by traskjd 10y ago

deegles 10y ago

That's a good point. If anything, it makes DDOS attacks more effective since you can't easily scale up your bank account :)

deleted 10y ago

[deleted]

stcredzero 10y ago

If Azure and Google would like to gain a competitive advantage over AWS, then I would suggest this: Build out a suite of tools for fighting DDOS. Enable private consultants and companies to provide this as a service. Do this in such a way, that cloud customers save money and have to worry about less. Hell, let companies jump in structured as insurance companies! Also bring in cooperation with law enforcement and use data gathering to catch and prosecute DDOS-ers.

bogomipz 10y ago
You can't just build a "suite of tools" and give them to a customer to fight a DDOS. The way DDOS is mitigated is by making routing changes at the network edge. This is not something you want a customer to be able to do for obvious reasons. And these in themselves are sometimes not enough and DDOS mitigation will require coordinating with transit providers, again not something you would want put in a customer console.
capecodcarl 10y ago
Doesn't Google already have the infrastructure to deal with an attack of this magnitude? I remember recently reading about Krebs on Security moving to Google's Project Shield service: http://www.zdnet.com/article/google-rescues-krebs-on-security-from-the-abyss/ http://www.zdnet.com/article/google-rescues-krebs-on-securit...
- nstj 10y ago
  afaik Shield is for select journalists only, not for typical web infrastructure.
  - jtl999 10y ago
    https://support.google.com/projectshield/answer/6358116?hl=en https://support.google.com/projectshield/answer/6358116?hl=e... > My website is on Blogger, Google Sites, or Google App Engine. Am I eligible? > As Google products, these sites already have similar DDoS protection to Project Shield. Your website would not need to be set up with Project Shield. Wonder if that answer includes Compute Engine. Doubt it.
    - brazzledazzle 10y ago
      It would be interesting to try using App Engine to simply proxy traffic. I don't know enough about it to even know if it's technically feasible. I imagine the downsides would be many but it could be useful as a temporary measure while you're getting attacked.
      - yannovitch 10y ago
        Some people already use App Engine as a free CDN (http://www.digitalistic.com/2008/06/09/10-easy-steps-to-use-google-app-engine-as-your-own-cdn/ http://www.digitalistic.com/2008/06/09/10-easy-steps-to-use-...) , I imagine it would be totally possible to use it as a proxy.
atmosx 10y ago
> Enable private consultants and companies to provide this as a service. If I am an AWS customer I expect AWS to handle/prevent DDoS, same way as they do with S3 to achieve 11 9's availability (the files are saved in multiple AZs in the same region - Glacier IIRC copy files on different regions to avoid data loss in case of physical disaster). One of the reason for choosing AWS is because AMZ has deep pockets and has the means (financial and technical) to fight against large DDoS attacks, while a smaller provider might not have to do that. Putting clients in a position to have to buy that sort of protection doesn't sound very smart to me.
- qaq 10y ago
  "achieve 11 9's availability" is this sarcasm?
  - _adamb 10y ago
    They're referring to AWS S3's claim of 99.999999999% durability. AWS actually offers 99.99% availability.
    - qaq 10y ago
      Oh that at least could theoretically be feasible considering AWS's SLA though they might as well claim it's 99.9999999999999999999999999%
  - wcummings 10y ago
    It all depends how you measure it
- ryanlol 10y ago
  > If I am an AWS customer I expect AWS to handle/prevent DDoS, same way as they do with S3 to achieve 11 9's availability If you are an AWS customer you should have done your due diligence and know that amazon won't do a very good job at that.
  - toomuchtodo 10y ago
matt4077 10y ago
Cloudflare is targeting that market pretty heavily.

atmosx 10y ago

Isn't that the meaning the having multiple AWS regions? :-) If you want HA at local level you'd go with AWS AZs but if you need real HA you need can do the same at region-level. Of course not everyone has the money/need to go down that route, but it's possible and even advised for some AWS services.

JshWright 10y ago

Yup until this morning, AWS was using Dyn as the sole provider of nameservers for the us-east-1 zone. So this attack did have a pretty substantial impact on some AWS services until they updated us-east-1 to use the more diverse set of nameservers their other datacenters use.

unexistance 10y ago

so it will be eventually Cloud VS DDoS eh, both can scale indefinitely so the limit is money, which makes the DDoS guys wins, they practically stole CPU/RAM/NET where cloud providers need to buy hardware as usual Unless we can somehow secure every net-connected devices, ha (I don't know whether to cry or laugh right now)

losteverything 10y ago
Can you third grade down your comment please? I find your language to be of high interest like you had a "dUH" moment - which I am ignorant to get myself. The Sons rays meat
- cheepin 10y ago
  DDOS usually occurs via a botnet of infected networked devices. Thus, the attacker is getting their resources for "free" since their host is unknowingly wasting CPU and bandwidth during the attack, while the defender is paying for theirs.
  - kpil 10y ago
    Until Google starts serving pages from our phones...
  - losteverything 10y ago
    Thanks Is this analogy accurate? I have one road to get home. It got blocked so I create 2 more roads. I now have 3 Roads to get home. All 3 become blocked. So now I have to make another road. More roads is redundancy and requires capital. The roads become unblocked but I now must expect future road blocks.

benmac 10y ago

AWS has considerable defenses against DDOS attacks of all types - here's the video from Reinvent 2015 which introduces many of Amazon's defenses as well as best practices - https://www.youtube.com/watch?v=Ys0gG1koqJA https://www.youtube.com/watch?v=Ys0gG1koqJA Interestingly, the presenter notes that Amazon had seen a drop in DNS as an attack vector in 2015. I asked the presenter (Product Manager) why they hadn't productized the DDoS attack dashboard so you could be aware if you were being attacked (and it was being absorbed by AWS) and his response was that there was insufficient demand at that point to justify the developer staffing. He gave me his card and asked to request the feature so he could us it to make the case internally. Does anyone here have stories of being successfully DDoS'd on AWS (other than by their own staff :) ?