7 ms·

The Daily DDoS: Ten Days of Massive Attacks

67 points by jgrahamc 10y ago

blakesterz 10y ago
"The attacks are also highly concentrated in a small number of locations mostly on the US west coast." Does that mean the attacks are against a small number of locations on the west coast or originate from those locations? I suppose if they are originating from a small number of locations (is a location a single IP?) then it's easier to defend? It's hard for me to wrap my head around attacks of this scale.
- jgrahamc 10y ago
  Arrive at our PoPs on the US west coast and elsewhere.
- xmichael99 10y ago
  Cloudflare uses BGP Anycast, I think what that indicates is the sources are all / mostly systems on the US West coast and when using anycast you tend to end up at the nearest data center.
EvanAnderson 10y ago
"...very large L3/L4 floods aimed at the TCP protocol." If these attacks aren't simple floods of bogus TCP segments (SYN floods, etc) and they're actually completing the TCP handshake then tracing their source should be trivial (since, by definition, they couldn't use forged source addresses). I'm assuming that they are just floods of bogus TCP segments w/ forged source addresses, which seems like a simple-enough "upgrade" that could have been deployed to existing botnets.
- throwwatgku 10y ago
  Anyone not using syn cookies is foolish these days. With the modified handshake a regular machine can handle 1Gbps+ of these packets
  - majke 10y ago
    Right. Assuming it was SYN floods, and spoofed IP addresses, do you imply that Cloudflare should send back 400gbps of SYN+ACK syn cookies packets to the wide internet?
gondo 10y ago
isn't this because the attack is originating from office work computers? people come to office in the morning, turn on the pc = attack starts. at the end of the day they simply switch off their computer = attach stops.
- jerf 10y ago
  If this was the result of many thousands of such machines, you'd see a much more gradual ramp up and shut down because they wouldn't be in such good sync with each other, plus the ceiling wouldn't necessarily be so sharp either. This is especially true once you consider timezones, and the fact that botnets are not generally confined to a single timezone. While this may be a lot of machines, the relative sharpness of the bandwidth graphs suggests a single control source turning things on and off, even though the attack itself may be using an arbitrary number of machines. (Note the fact that it isn't perfectly sharp doesn't mean it isn't a single source... it takes time to command and control thousands of machines over the internet.)
thinkMOAR 10y ago
I'm getting quite fed up with CloudFlare using HN as marketing tool. Their maffia style feature up-sales (oh you want the features that matter, start paying 8k a month), lack of responsibility flowing through their infrastructure, 'we do not host anything so we are not responsible' attitude... If i use that mentality or reasoning when stolen or other illegal goods flow through my house or shed, the police will not accept that as an excuse.... facilitating criminals.
- Klathmon 10y ago
  Well I quite enjoy them, they tend to offer insight into a scale that I can only dream of working on. >oh you want the features that matter, start paying 8k a month What's your alternative? Should they offer nothing for free, or should they somehow offer everything for free?
  - thinkMOAR 10y ago
    For the amount of traffic information they leech from your visitors, yes they should consider offering this for free, you are already paying with the privacy of your users. And i'll give example, you can create forced browser checks for countries you select. You want to block the country completely? Only available for enterprise. While imho, the first requires the exact check to determine if a forced browser check should happen, but a block of the country requires an enterprise grade service? Bull shit. You go to mcdonalds, order a burger without cheese and get charged more then when you order a burger with cheese where you ask the cheese to be checked before it gets applied to the burger, more work. Is this metaphor simple enough?
    - Klathmon 10y ago
      Well just because they have access to some data doesn't mean they use it. Your ISP gets all of this data and more, and if you want you can setup CF to have anything really secure pass through their servers encrypted so they can't see it, and there are a variety of options for less-secure stuff (including a scenario where CF can inspect SSL encrypted information without needing direct access to the private keys so you can only allow them to inspect specific things). But how do you run a service like cloudflare without having access to the data? Short of efficient fully homomorphic encryption it's not possible. And from your analogy it sounds like you have issue with what they are putting behind the "paywall" not that they are doing it? If this is the case I understand where you are coming from, but I still don't really agree. The web and the physical world aren't analogous, forced "checking" and blocking are 2 completely different things, and treating them as separate features doesn't set off any alarm bells in my head.
SomeStupidPoint 10y ago
Could this be people trialing cyberweapons/defnses? (Not necessarily a state actor, though not excluding that possibility either.) "If using x% of our resources CF is degraded/loaded y%, then there is z% chance they'll be disabled by W cyberattack." I've never been sure how scientific red team is, particularly blackhat ones.

67 points by jgrahamc 10y ago

"The attacks are also highly concentrated in a small number of locations mostly on the US west coast." Does that mean the attacks are against a small number of locations on the west coast or originate from those locations? I suppose if they are originating from a small number of locations (is a location a single IP?) then it's easier to defend? It's hard for me to wrap my head around attacks of this scale.

jgrahamc 10y ago
Arrive at our PoPs on the US west coast and elsewhere.
xmichael99 10y ago
Cloudflare uses BGP Anycast, I think what that indicates is the sources are all / mostly systems on the US West coast and when using anycast you tend to end up at the nearest data center.

EvanAnderson 10y ago

"...very large L3/L4 floods aimed at the TCP protocol." If these attacks aren't simple floods of bogus TCP segments (SYN floods, etc) and they're actually completing the TCP handshake then tracing their source should be trivial (since, by definition, they couldn't use forged source addresses). I'm assuming that they are just floods of bogus TCP segments w/ forged source addresses, which seems like a simple-enough "upgrade" that could have been deployed to existing botnets.

throwwatgku 10y ago
Anyone not using syn cookies is foolish these days. With the modified handshake a regular machine can handle 1Gbps+ of these packets
- majke 10y ago
  Right. Assuming it was SYN floods, and spoofed IP addresses, do you imply that Cloudflare should send back 400gbps of SYN+ACK syn cookies packets to the wide internet?

gondo 10y ago

isn't this because the attack is originating from office work computers? people come to office in the morning, turn on the pc = attack starts. at the end of the day they simply switch off their computer = attach stops.

jerf 10y ago
If this was the result of many thousands of such machines, you'd see a much more gradual ramp up and shut down because they wouldn't be in such good sync with each other, plus the ceiling wouldn't necessarily be so sharp either. This is especially true once you consider timezones, and the fact that botnets are not generally confined to a single timezone. While this may be a lot of machines, the relative sharpness of the bandwidth graphs suggests a single control source turning things on and off, even though the attack itself may be using an arbitrary number of machines. (Note the fact that it isn't perfectly sharp doesn't mean it isn't a single source... it takes time to command and control thousands of machines over the internet.)

thinkMOAR 10y ago

I'm getting quite fed up with CloudFlare using HN as marketing tool. Their maffia style feature up-sales (oh you want the features that matter, start paying 8k a month), lack of responsibility flowing through their infrastructure, 'we do not host anything so we are not responsible' attitude... If i use that mentality or reasoning when stolen or other illegal goods flow through my house or shed, the police will not accept that as an excuse.... facilitating criminals.

Klathmon 10y ago
Well I quite enjoy them, they tend to offer insight into a scale that I can only dream of working on. >oh you want the features that matter, start paying 8k a month What's your alternative? Should they offer nothing for free, or should they somehow offer everything for free?
- thinkMOAR 10y ago
  For the amount of traffic information they leech from your visitors, yes they should consider offering this for free, you are already paying with the privacy of your users. And i'll give example, you can create forced browser checks for countries you select. You want to block the country completely? Only available for enterprise. While imho, the first requires the exact check to determine if a forced browser check should happen, but a block of the country requires an enterprise grade service? Bull shit. You go to mcdonalds, order a burger without cheese and get charged more then when you order a burger with cheese where you ask the cheese to be checked before it gets applied to the burger, more work. Is this metaphor simple enough?
  - Klathmon 10y ago
    Well just because they have access to some data doesn't mean they use it. Your ISP gets all of this data and more, and if you want you can setup CF to have anything really secure pass through their servers encrypted so they can't see it, and there are a variety of options for less-secure stuff (including a scenario where CF can inspect SSL encrypted information without needing direct access to the private keys so you can only allow them to inspect specific things). But how do you run a service like cloudflare without having access to the data? Short of efficient fully homomorphic encryption it's not possible. And from your analogy it sounds like you have issue with what they are putting behind the "paywall" not that they are doing it? If this is the case I understand where you are coming from, but I still don't really agree. The web and the physical world aren't analogous, forced "checking" and blocking are 2 completely different things, and treating them as separate features doesn't set off any alarm bells in my head.

SomeStupidPoint 10y ago

Could this be people trialing cyberweapons/defnses? (Not necessarily a state actor, though not excluding that possibility either.) "If using x% of our resources CF is degraded/loaded y%, then there is z% chance they'll be disabled by W cyberattack." I've never been sure how scientific red team is, particularly blackhat ones.