4 ms·

"Historically, all state actor-sized DDoS (200-400 Gb/s of junk) we experienced coincided in time with protests in Hong Kong (coordinated on @telegram). This ca

"Historically, all state actor-sized DDoS (200-400 Gb/s of junk) we experienced coincided in time with protests in Hong Kong (coordinated on @telegram). This case was not an exception." At a certain point, you have to declare the correlation is actually a causation. https://twitter.com/durov/status/1138942773430804480?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1138942773430804480&ref_url=https%3A%2F%2Fwww.theverge.com%2F2019%2F6%2F13%2F18677282%2Ftelegram-ddos-attack-china-hong-kong-protest-pavel-durov-state-actor-sized-cyberattack https://twitter.com/durov/status/1138942773430804480?ref_src...

FDSGSG 7y ago
That doesn't really change anything I said, pointing out the correlation is very different from tracing the attacks. A better headline for this story would've been "Telegram Faces Cyber Attack During Hong Kong Protests" FWIW 200-400Gb/s is mildly sophisticated teenager-sized, but perhaps that's who the state actors are paying.
- leavjenn 7y ago
  Correct me if I'm wrong: Telegram has been blocked in China mainland. So if normal Chinese botnets want to DDOS Telegram, they will be blocked by GFW first. So how these botnets succeeded? Does that mean they are "special"?
  - FDSGSG 7y ago
    GFW has many ways of blocking things, I would assume that they just aren't blocking all traffic to telegram IPs.
    - parsadotsh 7y ago
      Pretty sure they are.
      - FDSGSG 7y ago
        Are they actually blocking outgoing packets to the IPs or injecting RSTs or blocking incoming packets from those IPs? I don't have a Chinese connection to test from right now.
        brianpgordon 7y ago
        My understanding is that it's a heterogeneous system that does different things for different people at different times. Looks like Wikipedia has some technical details- https://en.wikipedia.org/wiki/Great_Firewall#Blocking_methods https://en.wikipedia.org/wiki/Great_Firewall#Blocking_method...

FDSGSG 7y ago

That doesn't really change anything I said, pointing out the correlation is very different from tracing the attacks. A better headline for this story would've been "Telegram Faces Cyber Attack During Hong Kong Protests" FWIW 200-400Gb/s is mildly sophisticated teenager-sized, but perhaps that's who the state actors are paying.

leavjenn 7y ago
Correct me if I'm wrong: Telegram has been blocked in China mainland. So if normal Chinese botnets want to DDOS Telegram, they will be blocked by GFW first. So how these botnets succeeded? Does that mean they are "special"?
- FDSGSG 7y ago
  GFW has many ways of blocking things, I would assume that they just aren't blocking all traffic to telegram IPs.
  - parsadotsh 7y ago
    Pretty sure they are.
    - FDSGSG 7y ago
      Are they actually blocking outgoing packets to the IPs or injecting RSTs or blocking incoming packets from those IPs? I don't have a Chinese connection to test from right now.
      - brianpgordon 7y ago
        My understanding is that it's a heterogeneous system that does different things for different people at different times. Looks like Wikipedia has some technical details- https://en.wikipedia.org/wiki/Great_Firewall#Blocking_methods https://en.wikipedia.org/wiki/Great_Firewall#Blocking_method...