5 ms·
QUIC will also usher in a new era of volumetric DDoS attacks. No longer can content providers use upstream ACLs to block udp garbage and fragments. The only opt
by scurvy 8y ago
QUIC will also usher in a new era of volumetric DDoS attacks. No longer can content providers use upstream ACLs to block udp garbage and fragments. The only option will be to use Fastly, AWS, or Cloudflare to ride out attacks.
QUIC is the tool to bring about the next phase of Internet centralization by the mega players.
- lclarkmichalek 8y agoQUIC actually requires that request packets must be larger than the responses, until a handshake has been performed, in order to prevent reflection attacks.
- skybrian 8y agoDo you mean larger or smaller? I thought the problem was amplification.
- lclarkmichalek 8y agoWoops, fixed, thanks :)
- scurvy 8y agoDoes QUIC allow for UDP fragments? If so, we're screwed since most traffic is still IPv4.
- mcpherrinm 8y agoThe previous post's point is not that QUIC can be used for reflection attacks. It is that it uses UDP, which means UDP cannot be blocked by simple ACLs. Blocking all UDP is a simple technique for avoiding other protocols that allow for reflection DDoS attacks. I haven't got experience with how effective blocking UDP is as a mechanism for avoiding DDoS, but it does sound pretty simple and easy to deploy.
- londons_explore 8y agoIt's mostly DNS amplification attacks your provider will be filtering out on UDP. They can still filter UDP port 53 to do that.
- scurvy 8y agoFragments are still fragments. If QUIC allows for IPv4 router based fragmentation, you're still susceptible to attack. V4 frags don't carry port information (there's no header). IPv6 is better since there is no fragmentation. Maybe QUIC/http3 should be IPv6 only?