3 ms·

We're not trying to fight it at a legislative level. For example, ISPs could mitigate DDoS attacks through various means [1]. Sadly they just don't want to do t

We're not trying to fight it at a legislative level. For example, ISPs could mitigate DDoS attacks through various means [1]. Sadly they just don't want to do the few day worth of labor (maybe more if they haven't properly automated their infrastructure over the last few years). Now look at Congress, they haven't required that. They haven't used the power of the Constitution to regulate interstate commerce, definitionally what happens when you buy things online, to require that ISPs must do reasonable things to limit the affect of such attacks. 1 - https://tools.ietf.org/html/rfc2827 https://tools.ietf.org/html/rfc2827

sanderjd 9y ago
I don't think the attitude that it's "a few days worth of work or oh I guess maybe a few more if they don't have everything automated yet..." is very helpful. It diminishes the problem and is incredibly unrealistic. While I don't have experience running an ISP, it's huge infrastructure, which is inevitably incredibly complex and it is almost certainly expensive, time consuming, and extremely risky to roll out major changes. But I don't disagree with you! This is even more of a reason that we need help from regulators on this front. Things that are prohibitively costly for private entities to do but must be done for society to function the way we want it to are the sweet spot for regulation. I keep hearing that the government is taking cyber security seriously, but I see no evidence. Where is the DHS funded formal verification tool or subsidized penetration testing for critical infrastructure? I'm not saying these are the right ideas, but I don't see anything at all. Perhaps I just don't know of the programs that already exist though - looking forward to being educated here!
- throwaway2048 9y ago
  Ingress filtering really is not a big deal, and has been supported by all routing edge hardware/software for 15 or 20 years now. The fact it isn't implemented is down to apathy, ignorance and people making excuses. I don't think throwing your hands up and saying "oh this is probably hard" is very constructive on this front. Stop making excuses for people whos lack of action puts everyone else is danger. http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page
  - sanderjd 9y ago
    I think you're misunderstanding me. It's hard because doing anything is hard at scale. But I'm not saying it shouldn't be done because it's hard. Big companies do this sort of hard stuff all the time. But resources are limited and lots of efforts are competing to be the priority. It is natural that the things that will make or save money for the organization will take priority over things that are just general nice-to-haves. So the question is: how would this affect the bottom line of an ISP? If it wouldn't move the needle much, or would move it in the wrong direction, it's unlikely to get done. This is why I'm saying we need regulatory support - to shift the incentives. A possibility I recently heard about and thought sounded interesting would be requiring certain kinds of companies hold security insurance, and allowing damages for things like DDoS attacks. Then, if the insurance is functioning properly, doing things like this would decrease premiums. Mostly though, I'm just bummed that I don't seem to hear much about any ideas for how to actually attack the problem after things like WannaCry or big data leaks happen. This is clearly a systemic problem, and nobody really seems to be attacking it at that level.
ehnto 9y ago
It would take a global effort. An ISP level DDoS mitigation doesn't help me access my servers in the UK from Australia while they are being attacked from a wordlwide botnet. It also raises concerns about traffic control. What if my entirely legitimate but small service in Australia is blocked by US DDoS mitigation? They have no reason to care and I may have no legal or monetarily reasonable recourse.
lcw 9y ago
What would legislation look like for DDoS on an ISP level? You make DDoS mitigation sound easy, but most of what I would call successful attacks are from traffic that looks real at the ISP level and are relatively low bandwidth. Attackers achieve success through locking some aspect of their victims architecture. Most websites are not prepared for large fluctuations relative to their normal traffic, which look like a drop in the bucket when you are at an ISP level. I don't blame websites for this because mitigation at this level can be expensive. I think legislation for something like this would be a mess, because it's not simple and it has a technical solution.
- throwaway2048 9y ago
  The vast majority of DDOS these days is due to IP spoofing, which is what is possible if you don't ingress filter. It's a simple and 100% effective technique against IP spoofing, the problem is everyone on the internet needs to do it... And something like 90%+ of IP endpoints have, that last remaining percentages is a real bitch though http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page
  - pixl97 9y ago
    >The vast majority of DDOS these days is due to IP spoofin Um, no. Amplification attacks, and direct attacks from compromised hosts, such as IoT, are the majority of the traffic. BCP38 at the edge doesn't protect against devices spoofing their internal network address from someone else in their same subnet/routing block.
    - virmundi 9y ago
      How often do those kinds of attacks occur? I'm actually curious. From my research it's more common that DDoS are intersubnet rather than intra. If this is the case, why not make Comcast prevent spoofing within its own network? They're at a good place to know legit IPs. If I'm correct, we're going to need this sooner rather than later. As IoT gets rolled out (had to remove my new AC from the WiFi since it was just easier to let the install hook it up than explaining why it's a bad idea), we need to have someone be accountable for security. IoT manufactures should be on the hook, but so to the network admins.

sanderjd 9y ago

I don't think the attitude that it's "a few days worth of work or oh I guess maybe a few more if they don't have everything automated yet..." is very helpful. It diminishes the problem and is incredibly unrealistic. While I don't have experience running an ISP, it's huge infrastructure, which is inevitably incredibly complex and it is almost certainly expensive, time consuming, and extremely risky to roll out major changes. But I don't disagree with you! This is even more of a reason that we need help from regulators on this front. Things that are prohibitively costly for private entities to do but must be done for society to function the way we want it to are the sweet spot for regulation. I keep hearing that the government is taking cyber security seriously, but I see no evidence. Where is the DHS funded formal verification tool or subsidized penetration testing for critical infrastructure? I'm not saying these are the right ideas, but I don't see anything at all. Perhaps I just don't know of the programs that already exist though - looking forward to being educated here!

throwaway2048 9y ago
Ingress filtering really is not a big deal, and has been supported by all routing edge hardware/software for 15 or 20 years now. The fact it isn't implemented is down to apathy, ignorance and people making excuses. I don't think throwing your hands up and saying "oh this is probably hard" is very constructive on this front. Stop making excuses for people whos lack of action puts everyone else is danger. http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page
- sanderjd 9y ago
  I think you're misunderstanding me. It's hard because doing anything is hard at scale. But I'm not saying it shouldn't be done because it's hard. Big companies do this sort of hard stuff all the time. But resources are limited and lots of efforts are competing to be the priority. It is natural that the things that will make or save money for the organization will take priority over things that are just general nice-to-haves. So the question is: how would this affect the bottom line of an ISP? If it wouldn't move the needle much, or would move it in the wrong direction, it's unlikely to get done. This is why I'm saying we need regulatory support - to shift the incentives. A possibility I recently heard about and thought sounded interesting would be requiring certain kinds of companies hold security insurance, and allowing damages for things like DDoS attacks. Then, if the insurance is functioning properly, doing things like this would decrease premiums. Mostly though, I'm just bummed that I don't seem to hear much about any ideas for how to actually attack the problem after things like WannaCry or big data leaks happen. This is clearly a systemic problem, and nobody really seems to be attacking it at that level.

ehnto 9y ago

It would take a global effort. An ISP level DDoS mitigation doesn't help me access my servers in the UK from Australia while they are being attacked from a wordlwide botnet. It also raises concerns about traffic control. What if my entirely legitimate but small service in Australia is blocked by US DDoS mitigation? They have no reason to care and I may have no legal or monetarily reasonable recourse.

lcw 9y ago

What would legislation look like for DDoS on an ISP level? You make DDoS mitigation sound easy, but most of what I would call successful attacks are from traffic that looks real at the ISP level and are relatively low bandwidth. Attackers achieve success through locking some aspect of their victims architecture. Most websites are not prepared for large fluctuations relative to their normal traffic, which look like a drop in the bucket when you are at an ISP level. I don't blame websites for this because mitigation at this level can be expensive. I think legislation for something like this would be a mess, because it's not simple and it has a technical solution.

throwaway2048 9y ago
The vast majority of DDOS these days is due to IP spoofing, which is what is possible if you don't ingress filter. It's a simple and 100% effective technique against IP spoofing, the problem is everyone on the internet needs to do it... And something like 90%+ of IP endpoints have, that last remaining percentages is a real bitch though http://www.bcp38.info/index.php/Main_Page http://www.bcp38.info/index.php/Main_Page
- pixl97 9y ago
  >The vast majority of DDOS these days is due to IP spoofin Um, no. Amplification attacks, and direct attacks from compromised hosts, such as IoT, are the majority of the traffic. BCP38 at the edge doesn't protect against devices spoofing their internal network address from someone else in their same subnet/routing block.
  - virmundi 9y ago
    How often do those kinds of attacks occur? I'm actually curious. From my research it's more common that DDoS are intersubnet rather than intra. If this is the case, why not make Comcast prevent spoofing within its own network? They're at a good place to know legit IPs. If I'm correct, we're going to need this sooner rather than later. As IoT gets rolled out (had to remove my new AC from the WiFi since it was just easier to let the install hook it up than explaining why it's a bad idea), we need to have someone be accountable for security. IoT manufactures should be on the hook, but so to the network admins.