16 ms·

Are there often significant issues that arise while Cloudflare is mitigating an attack? I've often wondered why people would conduct attacks if the attacks don

Are there often significant issues that arise while Cloudflare is mitigating an attack? I've often wondered why people would conduct attacks if the attacks don't actually end up doing anything. The fact that somebody is protected by a DDoS mitigation service should be evident to most of the people capable of conducting an attack.

eloff 8y ago
I'm curious about this too, but at least in some cases the reason is the sites don't start off with DDoS protection, they signup with Cloudflare to mitigate the attack in progress.
mirashii 8y ago
> I've often wondered why people would conduct attacks if the attacks don't actually end up doing anything. Here's one good reason: to test their tooling and botnet. If you've been hitting smaller targets and taking them offline reliably, you might not even max out the bandwidth of your botnet. You have to have something that can handle the traffic to measure how high you can go. Even if not, you might just want to continue testing. It's going to be important if you're selling DDOSes.
- jgrahamc 8y ago
  At one time we considered publishing real-time DDoS information but decided against it to stop people using us to test the power of their DDoS botnets.
Laforet 8y ago
It really depends. A lot of people, myself included, use their free tier service which is excellent for the grand price of zero, however it does not really come with much real DDoS protection. Script kiddies might give up after seeing an IP address belonging to CF, but the more experienced and determined attackers will keep ramping up bandwidth until Cloudflare takes notice and cut you off because you are now more trouble than worth. Free tier breaks only with a little bit of traffic, whereas paid users have some headroom but it is not infinite. From their point of view it's still preferable to lose you as a customer than having every other customer's site lagging because of you. Apparently even business tier is not immune, Brian Krebs' security blog was DDoS'ed off Akamai after the then-ongoing mitigation cost ended up being far more than they could agree on, and it took him days to find another provider[0]. [0]:https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://krebsonsecurity.com/2016/09/the-democratization-of-c...
- flarex 8y ago
  All Cloudflare plans have unmetered DDoS protection. Where did you get the idea that they would cut you off if you were on the free tier?
  - DanielDent 8y ago
    Until late last year that was their policy: https://blog.cloudflare.com/unmetered-mitigation/ https://blog.cloudflare.com/unmetered-mitigation/ Also they specifically refer to volumetric mitigation' as the thing which everyone gets. The harder to deal with attacks are probably the application aware resource attacks.
  - Laforet 8y ago
    I've seen it happen multiple times. Besides, "unmetered" is almost always marketing hype whenever you see it. If your website uses >10TB of non-DDoS traffic per day on CF you are likely to get a call from their sales team soon asking you to upgrade to a pro or business account. A brief DDoS was (not sure if still is) a common method to expose the real IP because the CDN edge servers could often be easily spooked by a brief surge in traffic and start redirecting DNS back to origin. I suspect this is the kind of "protection" they were really offering: your site will still be down, but at least the backend is never revealed to the world.
    - flarex 8y ago
      They've publically stated that they do not drop traffic for any plans (at least as of 2017) no matter the size. So whatever you have seen is likely no longer the case. Unless you have sources that they are still doing this?
      - Laforet 8y ago
        This is simply not true. I can't help it if you choose to believe marketing material than first hand experience. Have a nice day.
toast0 8y ago
Most of these attacks are pretty short, around 10 minutes on the graphs. Some people are just doing this for the lols. Cloudflare is pretty open about their tech stack, so if there were significant issues, I would expect them to do mitigation work and then blog about it. I used to see a bunch of DDoS against my work servers, it tended to be exactly 90 seconds, plus or minus a bit of clock skew in the generators. The time frames seemed to be about the same regardless of if the attack was successful or not, although when the attacks weren't successful, I am less likely to have noticed. Usually, but not always, our www servers were targetted, and not the servers actually doing useful work, presumably because it's cooler to attack www servers. I have to say, sometimes pretty dumb DDoS would crush our servers, but it was always fun to look at the sampled tcpdumps and fix the bottlenecks. There are a lot of DDoS for hire sites out there, so it takes less skill to get it done than checking host records.
- deadbunny 8y ago
  > presumably because it's cooler to attack www servers Why would you have anything other than web servers directly accessible on the internet?
  - toast0 8y ago
    The internet is more than just web servers. Web servers are more than just www. I work for a chat service, the servers doing the actual work of the service were rarely attacked, we even have a couple other http(s) endpoints that are public, but not www, and those were rarely attacked as well.
zaarn 8y ago
To quote a description of the Joker; "Some people just want to see the world burn." They do it for "the lulz", for fame, for glory, for breaking in their new botnet, for the brief chance of taking down someone's website... etc. You sorta have to live with this when you host on the internet.

eloff 8y ago

I'm curious about this too, but at least in some cases the reason is the sites don't start off with DDoS protection, they signup with Cloudflare to mitigate the attack in progress.

mirashii 8y ago

> I've often wondered why people would conduct attacks if the attacks don't actually end up doing anything. Here's one good reason: to test their tooling and botnet. If you've been hitting smaller targets and taking them offline reliably, you might not even max out the bandwidth of your botnet. You have to have something that can handle the traffic to measure how high you can go. Even if not, you might just want to continue testing. It's going to be important if you're selling DDOSes.

jgrahamc 8y ago
At one time we considered publishing real-time DDoS information but decided against it to stop people using us to test the power of their DDoS botnets.

Laforet 8y ago

It really depends. A lot of people, myself included, use their free tier service which is excellent for the grand price of zero, however it does not really come with much real DDoS protection. Script kiddies might give up after seeing an IP address belonging to CF, but the more experienced and determined attackers will keep ramping up bandwidth until Cloudflare takes notice and cut you off because you are now more trouble than worth. Free tier breaks only with a little bit of traffic, whereas paid users have some headroom but it is not infinite. From their point of view it's still preferable to lose you as a customer than having every other customer's site lagging because of you. Apparently even business tier is not immune, Brian Krebs' security blog was DDoS'ed off Akamai after the then-ongoing mitigation cost ended up being far more than they could agree on, and it took him days to find another provider[0]. [0]:https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/ https://krebsonsecurity.com/2016/09/the-democratization-of-c...

flarex 8y ago
All Cloudflare plans have unmetered DDoS protection. Where did you get the idea that they would cut you off if you were on the free tier?
- DanielDent 8y ago
  Until late last year that was their policy: https://blog.cloudflare.com/unmetered-mitigation/ https://blog.cloudflare.com/unmetered-mitigation/ Also they specifically refer to volumetric mitigation' as the thing which everyone gets. The harder to deal with attacks are probably the application aware resource attacks.
- Laforet 8y ago
  I've seen it happen multiple times. Besides, "unmetered" is almost always marketing hype whenever you see it. If your website uses >10TB of non-DDoS traffic per day on CF you are likely to get a call from their sales team soon asking you to upgrade to a pro or business account. A brief DDoS was (not sure if still is) a common method to expose the real IP because the CDN edge servers could often be easily spooked by a brief surge in traffic and start redirecting DNS back to origin. I suspect this is the kind of "protection" they were really offering: your site will still be down, but at least the backend is never revealed to the world.
  - flarex 8y ago
    They've publically stated that they do not drop traffic for any plans (at least as of 2017) no matter the size. So whatever you have seen is likely no longer the case. Unless you have sources that they are still doing this?
    - Laforet 8y ago
      This is simply not true. I can't help it if you choose to believe marketing material than first hand experience. Have a nice day.

toast0 8y ago

Most of these attacks are pretty short, around 10 minutes on the graphs. Some people are just doing this for the lols. Cloudflare is pretty open about their tech stack, so if there were significant issues, I would expect them to do mitigation work and then blog about it. I used to see a bunch of DDoS against my work servers, it tended to be exactly 90 seconds, plus or minus a bit of clock skew in the generators. The time frames seemed to be about the same regardless of if the attack was successful or not, although when the attacks weren't successful, I am less likely to have noticed. Usually, but not always, our www servers were targetted, and not the servers actually doing useful work, presumably because it's cooler to attack www servers. I have to say, sometimes pretty dumb DDoS would crush our servers, but it was always fun to look at the sampled tcpdumps and fix the bottlenecks. There are a lot of DDoS for hire sites out there, so it takes less skill to get it done than checking host records.

deadbunny 8y ago
> presumably because it's cooler to attack www servers Why would you have anything other than web servers directly accessible on the internet?
- toast0 8y ago
  The internet is more than just web servers. Web servers are more than just www. I work for a chat service, the servers doing the actual work of the service were rarely attacked, we even have a couple other http(s) endpoints that are public, but not www, and those were rarely attacked as well.

zaarn 8y ago

To quote a description of the Joker; "Some people just want to see the world burn." They do it for "the lulz", for fame, for glory, for breaking in their new botnet, for the brief chance of taking down someone's website... etc. You sorta have to live with this when you host on the internet.