6 ms·

How exactly was the attack mitigated when in the same sentence they confess it STOPPED _on its own_.

• tlunter 10y ago
  mit·i·gate ˈmidəˌɡāt/ verb make less severe, serious, or painful Don't think they said they solved the problem. They just made it less bad. Some DNS queries got through, but not all.
• dsp1234 10y ago
  Mitigated means "make less severe, serious, or painful.". In other words, they took steps that stopped the attack from effecting legitimate traffic. Once the attacker sees that the attack is no longer effective, the attack stops. After all, it's a denial of service attack. If the service is no longer being denied, then what is the point of continuing the attack.
  • hueving 10y ago
    To cost the company significant amounts of money. Bandwidth in those volumes isn't cheap.
    • subie 10y ago
      Wouldn't it be costing the attacker some amount of money running the C&C server? I'd think at some point if the attacker isn't getting the same results from the attack he'll wait for them to scale back then strike again. Is my thinking right here?
      • tomschlick 10y ago
        > Wouldn't it be costing the attacker some amount of money running the C&C server? Not necessarily. They could configure the C&C to run off of something like pastebin/gist where they just input a list of IPs to attack and the botnet checks a specific url every X minutes for new instructions.
        • deleted 10y ago
          [deleted]
        • subie 10y ago
          That's very cool. Wasn't aware of this technique.
        • throwanem 10y ago
          And even if it's a more complicated scheme, there's nothing to suggest the attacker has to run C&C on a host for which he's paying. I scrubbed a lot of IRC daemons off legacy shared-hosting boxes, back in my admin days.
      • alphex 10y ago
        No. each individual attacker is actually an infected "bot" of somekind. In this case, Internet of Things devices all over the world. Your "smart TV" or "Smart refridgerator" all contributed to this, over YOUR bandwdith. The average broadband user has at the least, 10Mbps/UP. If your smart appliances all started sending at least 10mbps up... you only need a million smart TV's to start causing damage. I'm guessing there's 100M Smart TV's in the USA? Each sending 10Mb/s up? There's 1GB/s of traffic. Multiply this by the next 50 nations who have smart TVs and bandwidth to spare... Then make it multiuple devices in a home. Then make it every smart device on the planet, using SOME bandwidth... it gets painful fast, and its free for the attackers, since the poor sap with a hacked smart TV is doing the work.
        • subie 10y ago
          The attacker is still spending resources giving out instructions to the bot army. Unless they are using a setup like @tomschlick mentioned or some P2P thing.
          • pixl97 10y ago
            Sending out a message to 1 million compromised devices takes almost nothing. Also, if you've compromised 1 million devices, chances are you also compromised a linux server on a fast host for command and control.
        • SteveGregory 10y ago
          That math doesn't seem right. 100M devices sending 10Mbps is 1,000,000,000Mbps = 1,000Tbps, not 1GB/s. For an attack of 1.2Tbps, you only need 120k devices at 10Mbps.
        • profmonocle 10y ago
          > Your "smart TV" or "Smart refridgerator" all contributed to this, over YOUR bandwdith. Makes me wonder when we'll start seeing reports of people getting hit with data overage charges because of hacked smart devices. I only have 4 Mbps up, but if an infected device used all of that 24/7 it would chew through my Comcast 1TB monthly cap.
    • r1ch 10y ago
      I think a lot of botnet operators are also worried about their bots being "discovered" during sustained bandwidth attacks. Your average home user isn't going to notice their internet being weirdly slow for a couple of hours every few weeks, but a sustained DDoS will have people noticing and potentially discovering / cleaning their devices. ISPs might also take notice of the sustained outbound traffic volume, identify a pattern and contact customers.
  • rasz_pl 10y ago
    Exactly my point. There was no 'dns is slow but finally works now' moment, there was total dns blackout until attack stopped.