5 ms·
The real reason for large DDoS attacks? It's IP Spoofing, not memcached
- superkuh 9y ago>Let's take a deep breath and discuss why such large DDoS attacks are even possible on the modern internet. Because all traffic is treated at face value and not deep filtered and throttled according to some company's whims. Cloudflare wants to change this. Cloudflare wants centralization. Cloudflare wants blacklists.
- LinuxBender 9y agoThey are not suggesting centralization. They are suggesting bcp38 [0] This comes up quite often and people argue back and forth why they (the ISP's) can't or won't do this. Bcp38 simply requires ISP's to egress filter out IP traffic that does not belong to them. [0] - https://tools.ietf.org/html/bcp38 https://tools.ietf.org/html/bcp38
- deleted 9y ago[deleted]
- mehrdadn 9y agoIs egress filtering really that egregious?
- bb88 9y agoNo, it's not. It's just time consuming. If you're a large ISP with several disconnected IP subnets, then it's hard to get right.
- tonyb 9y agoThis is quite an over simplification but a large amount of the filtering, if placed close to the client, is a single line of config. "ip verify unicast source reachable-via rx" in the Cisco world.
- cryptonector 9y agoThis should be the default.
- mehrdadn 9y agoI don't follow. Seems to me that whatever program/firmware on the router knows where to send incoming packets must also be able to trivially check and filter the addresses of outgoing ones.
- Rapzid 9y agoNope, not in the age of software defined networks. It's crazy to me this is still a problem. I worked at an ISP and VPS provider years ago on a tiny engineering team. We employed anti-spoofing at multiple layers; from the hypervisor out to the edge. It's usually just an extra line in a much larger, more complicated network config. In fact, if I were ranking the networking challenges from most to least mental cycles it would be near the bottom.
- deleted 9y ago[deleted]
- r00fus 9y agoDoes it profit the ISPs to avoid/neglect egress filtering? Who stands to gain from this and how much are they willing to kickback for "looking the other way"?
- dpark 9y agoBad/undesired decisions don’t require blatant corruption. This seems a simple case of poor incentives. If an ISP does egress filtering well, essentially no one notices. If they screw it up, customers lose connectivity and some portion of those customers will likely leave for a competitor. There’s risk with no reward.
- blackflame7000 9y agoCouldn't there perhaps be a financial incentive by reducing the amount of superfluous data on their networks?
- dpark 9y agoApparently not given the lack of action. I’m not sure DDOS traffic is really significant from an egress standpoint.
- lmb 9y agoThere is so called "bulletproof" hosting which usually includes being able to spoof IP. So yes, there are economic incentives.
- deleted 9y ago[deleted]
- always_good 9y agoThe status quo already leads to centralization and gives Cloudflare a tremendous market.
- chatmasta 9y agoAre there any valid technical use-cases for IP spoofing? i.e. setting the source address of a UDP packet as one outside the originating network? For example, on the server side, BGP hijacking and anycast routing are enabled by the same bug or feature, depending how you look at it.
- AnimalMuppet 9y agoThere are probably legitimate uses. It seems to me that the abuses far outweigh the legitimate uses, though...
- mehrdadn 9y ago> Are there any valid technical use-cases for IP spoofing? Testing?
- mjevans 9y agoLocally, yes. Spoofing IPs is one way of having a multi-homed cluster always respond on a given IP. (Higher layers figure out what's really going on, and co-ordinate responses correctly to end clients.) In the sense of where bcp38 should be applied? I agree that it should be POSSIBLE, through some administrative means, to prove an entity does in fact own a given address range and to request the additional privilege of sending data as if it were from that range. This would be how a non-ISP obtains an independent entity allocation and sets up multi-homing. It's also how data-centers would allow a co-located server to do the same (and should require the same steps). At the more backbone levels it should be possible to automatically determine IF ingress packets are from authorized sources. Failure to do this, and failure to respond in a timely manor to filtering invalid ingress, should result in 1) those packets being rejected (and visible rejection notices sent back) 2) if the issue persists, the source of that address being blocked /entirely/ from the Internet, as a non-administered system. Grace time should likely depend on the severity of the issue (volume of problem traffic/load on the upstream filtering capacity).
- omribahumi 9y agoThere’s one reason I could think of. Combining two Internet lines together to get a faster connection. I blogged about this a few years back https://omri.org.il/2014/08/08/hacking-asymmetric-and-symmetric-lines-together/ https://omri.org.il/2014/08/08/hacking-asymmetric-and-symmet...
- betaby 9y agoYour incumbent won't do filtering. Your incumbent won't maintain proper 'route' objects https://www.ripe.net/manage-ips-and-asns/db/support/managing-route-objects-in-the-irr https://www.ripe.net/manage-ips-and-asns/db/support/managing... Your shoestring independent ISP won't to that either. Who is left? Tier1 ISP and some of them do BCP38 filtering sometimes on some ports.
- walterkobayashi 9y ago75% ISP's in Europe don't do IP Filtering.
- citrin_ru 9y agoAccording to CAIDA statistics much less that 75% don't filter. See map: https://spoofer.caida.org/summary.php https://spoofer.caida.org/summary.php
- grahamburger 9y agoAs someone who has been doing 'shoestring independent ISPs' for almost 15 years my impression is that nearly all upstream providers (the ones we buy service from - not always but sometimes tier 1 providers) do outgoing IP filtering. Whenever I get a new IPv4 allocation from ARIN (at least when we used to be able to do that - they're all gone now) we had to go through a process with our upstream provider so that they would allow our BGP advertisements for that block as well as allow those source addresses to route through their network.
- sathackr 9y agoThey may filter what routes you can advertise via BGP, but nearly every Tier 1(And most Tier 2) providers will accept traffic sourced from any IP address. I handle about 10 different connections and can source traffic from any IP on all of them.
- misterbowfinger 9y agoIf anyone here has run Spoofer: https://www.caida.org/projects/spoofer/ https://www.caida.org/projects/spoofer/ What was your experience?
- citrin_ru 9y agoI've run on a few my hosts - spoofing was filtered.
- hueving 9y agoThis is a refreshing change from cloudflare. Back when recursive DNS was the amplification de jour they complained about DNS instead of IP spoofing. https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-offline-and-ho/ https://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-o...
- makomk 9y agoThis is an odd change from Cloudflare. Were it not for the DDoS amplification problem it'd be perfectly reasonable to make recursive DNS servers publicly accessible, but memcached servers should never be exposed to the public internet - they're not designed to be and doing so allows everyone to exfiltrate, modify or delete the cached data which you almost certainly don't want to be possible.
- hueving 9y agoRight, exposing a memcached server is bad because memcached isn't meant to be public. However, in the context of DRDoS discussions it doesn't matter if the UDP service is good for public exposure. That's completely a distraction from the underlying IP spoofing disease that enables attacks on all connectionless protocols.