4 ms·

Wouldn't it be possible to make the economics of DDoS symmetrical by enforcing repercussions at the ISP level? If 10,000 IPs are syn flooding, all out of one I

by ajamesm 10y ago

Wouldn't it be possible to make the economics of DDoS symmetrical by enforcing repercussions at the ISP level? If 10,000 IPs are syn flooding, all out of one ISP, their peers can stop routing that ISP's traffic until that ISP starts mitigating. I imagine the biggest impracticality is that ISPs are monopolistic, so if you stop routing someone like Comcast, all of a sudden half of America is offline. Perhaps we COULD let the internet be the Wild West, if we had a fair selection of providers, or if they effectively self-regulated.

nickpsecurity 10y ago
Yes. Such things were in my recommendations. You could ensure stuff can always be traced to source (at transport level), filtered, and/or rate-limited. DDOS's get rate-limited automatically by ISP endpoint or middleboxes with costly penalties for this happening. Simultaneously, supply side starts offering all kinds of options to prevent that which are cheaper than being declared digital version of a public nuisance. The Tier 1-3's mostly don't care since they're paid primarily to provide the line plus have regulators in their pockets. There's certainly work in these to reduce DDOS a bit for competitiveness but they avoid a simple solution like mine out of greed. ;)
- pavel_lishin 10y ago
  > DDOS's get rate-limited automatically by ISP endpoint or middleboxes with costly penalties for this happening. Who would pay? My name is Serhei, and I'm in Ukraine, and I just unleashed a 100k-strong botnet of smartbulbs and babycams. It's spread somewhat evenly across American households, and mostly among their ISPs. I still pay nothing.
  - nickpsecurity 10y ago
    The people who connect products or configurations with shit security to the Internet. Bad security has to cost them something before the demand for good security is generated. Just headaches right now but loss of money or Internet is more severe. Then, with a demand, either the hardware/software market or the regulators will start doing something from there. They're already doing something where numerous products exist that were all created by relatively small companies or teams. They'll do a lot more.
13of40 10y ago
> the biggest impracticality is that ISPs are monopolistic I reckon the biggest problem would be that you could DoS an entire ISP simply by doing a SYN flood attack from inside it.
- AnimalMuppet 10y ago
  Sure, until that ISP learned to not let you do that (or at least not to pass it on to the outside world).

by ajamesm 10y ago

nickpsecurity 10y ago

Yes. Such things were in my recommendations. You could ensure stuff can always be traced to source (at transport level), filtered, and/or rate-limited. DDOS's get rate-limited automatically by ISP endpoint or middleboxes with costly penalties for this happening. Simultaneously, supply side starts offering all kinds of options to prevent that which are cheaper than being declared digital version of a public nuisance. The Tier 1-3's mostly don't care since they're paid primarily to provide the line plus have regulators in their pockets. There's certainly work in these to reduce DDOS a bit for competitiveness but they avoid a simple solution like mine out of greed. ;)

pavel_lishin 10y ago
> DDOS's get rate-limited automatically by ISP endpoint or middleboxes with costly penalties for this happening. Who would pay? My name is Serhei, and I'm in Ukraine, and I just unleashed a 100k-strong botnet of smartbulbs and babycams. It's spread somewhat evenly across American households, and mostly among their ISPs. I still pay nothing.
- nickpsecurity 10y ago
  The people who connect products or configurations with shit security to the Internet. Bad security has to cost them something before the demand for good security is generated. Just headaches right now but loss of money or Internet is more severe. Then, with a demand, either the hardware/software market or the regulators will start doing something from there. They're already doing something where numerous products exist that were all created by relatively small companies or teams. They'll do a lot more.

13of40 10y ago

> the biggest impracticality is that ISPs are monopolistic I reckon the biggest problem would be that you could DoS an entire ISP simply by doing a SYN flood attack from inside it.

AnimalMuppet 10y ago
Sure, until that ISP learned to not let you do that (or at least not to pass it on to the outside world).