4 ms·

GitHub fought the largest ever recorded ddos using Akamai Prolexic. At least according to Wired. https://www.wired.com/story/github-ddos-memcached https://www.w

GitHub fought the largest ever recorded ddos using Akamai Prolexic. At least according to Wired. https://www.wired.com/story/github-ddos-memcached https://www.wired.com/story/github-ddos-memcached I think protonmail is experiencing the same type of attack (memcached amplified)

sillysaurus3 9y ago
Akamai's Prolexic platform was able to mitigate the attack by filtering all traffic sourced from UDP port 11211, the default port used by memcached. Interesting. The impressive part is that their platform correctly identified the attack and automatically applied the solution within 20 minutes. I wonder how? Possibly a team of smart sysadmins on standby? It's easy to detect when you're being attacked, but hard to mitigate. So whenever you get attacked, set up your site to automatically forward over to this service, and their clever humans take it from there. Some of the most impactful tech projects are just mechanical turks, so it wouldn't be surprising. But I wonder what the truth is.
- protonstatus 9y ago
  you monitor netflow for anomalies - when they occurred you change the routing via BPG to prolexic (e.g. the attacked /24) - they have huge amount of available bandwidth and hardware to filter out unwanted traffic - if you get a known attack like in this case, it's completely automated in case you want it... - your traffic is forwarded to the original destination via GRE
FreeFull 9y ago
After the Github attack, there was a larger, 1.7Tbps DDoS against an unnamed client of Arbor Networks using the same memcached tactic. I hope someone is working on getting all those open memcached servers secured..
- sp332 9y ago
  Victor Gevers, co-founder and chairman of the GDI Foundation, says there are already substantially fewer vulnerable servers. https://mobile.twitter.com/0xDUDE/status/971515743589322752 https://mobile.twitter.com/0xDUDE/status/971515743589322752
- tomschlick 9y ago
  That's going to be hard. More than likely the solution will come from ISPs blocking port 11211 on public networks.

sillysaurus3 9y ago

Akamai's Prolexic platform was able to mitigate the attack by filtering all traffic sourced from UDP port 11211, the default port used by memcached. Interesting. The impressive part is that their platform correctly identified the attack and automatically applied the solution within 20 minutes. I wonder how? Possibly a team of smart sysadmins on standby? It's easy to detect when you're being attacked, but hard to mitigate. So whenever you get attacked, set up your site to automatically forward over to this service, and their clever humans take it from there. Some of the most impactful tech projects are just mechanical turks, so it wouldn't be surprising. But I wonder what the truth is.

protonstatus 9y ago
you monitor netflow for anomalies - when they occurred you change the routing via BPG to prolexic (e.g. the attacked /24) - they have huge amount of available bandwidth and hardware to filter out unwanted traffic - if you get a known attack like in this case, it's completely automated in case you want it... - your traffic is forwarded to the original destination via GRE

FreeFull 9y ago

After the Github attack, there was a larger, 1.7Tbps DDoS against an unnamed client of Arbor Networks using the same memcached tactic. I hope someone is working on getting all those open memcached servers secured..

sp332 9y ago
Victor Gevers, co-founder and chairman of the GDI Foundation, says there are already substantially fewer vulnerable servers. https://mobile.twitter.com/0xDUDE/status/971515743589322752 https://mobile.twitter.com/0xDUDE/status/971515743589322752
tomschlick 9y ago
That's going to be hard. More than likely the solution will come from ISPs blocking port 11211 on public networks.