6 ms·

But who are the attackers, and why? What is the motivation / objective? Is there an economically positive criminal activity that involves DDoSing an AWS-hosted

But who are the attackers, and why? What is the motivation / objective? Is there an economically positive criminal activity that involves DDoSing an AWS-hosted UDP service (probably video calls... probably like Zoom)?

tonydiv 6y ago
I'd assume something sinister... There has to be a reason :)
api 6y ago
I would suspect extortion. Pay us or we DDOS you offline.
- antpls 6y ago
  I believe that sort of attack can't be achieved repeatedly. These attacks leave traces and clues behind them, and investigators are able to better pinpoint and protect for the next one. I heard they also can't be sustained for a long time. I believe they are more like an attempt to discover limits in the network or some targeted systems. Some systems are also vulnerable while they reboot, so attackers only need a one-time reboot.
  - Red_Leaves_Flyy 6y ago
    Not an authority or expert in any fields of discussion itt From what I've been told, you're right. DDOS attacks can routinely expose information through failure modes the ops team never prepared for. What happens when your failsafes fail? If they didn't test for it and put mitigations in place then it's rather likely that sensitive error messages or service details, or whatever, is being exposed over the wire. So aws mitigated this attack. Does aws know for a certainty that they revealed nothing sensitive in the process? Maybe, maybe not. If the attacker is good, and 2.3tbps is pretty fing good, then could the victim even be positioned to know what to look for? In uncharted territories the attacked is always down from the attacker.
  - elorant 6y ago
    I heard they also can't be sustained for a long time. That used to be the case, but with the popularity and widespread use of IoT devices it won't hold true for long. If you can hack home appliances you could hold an attack for hours, if not days.
- leksak 6y ago
  Or shorting the stock of the target? The instant your DDOS topples the target that is. Or going long after the DDOS if you believe it'll recuperate.
- user5994461 6y ago
  Yep, seen that in person at a startup. The company was receiving regular threats to pay some bitcoins or be DDoS'ed. History has, the company used to be DDoS'ed regularly, sometimes offline for days, before moving to cloudflare.
woofcat 6y ago
Zoom I believe is on Oracle cloud: https://interconnected.blog/why-zoom-chose-oracle/ https://interconnected.blog/why-zoom-chose-oracle/ See previous HN thread here: https://news.ycombinator.com/item?id=23032029 https://news.ycombinator.com/item?id=23032029
- txcwpalpha 6y ago
  Zoom is primarily on AWS and some Azure. That recent story re: Oracle is talking about an expansion into OCI, but AFAIK they aren’t there yet. https://www.datacenterdynamics.com/en/news/most-zoom-runs-aws-not-oracle-says-aws/ https://www.datacenterdynamics.com/en/news/most-zoom-runs-aw...
gen3 6y ago
Baddies will sometimes do big DDOS’s of a public site to showoff their botnet’s capability. That clout is then used as proof to sell their service to customers. I could see this being an instance of such a thing.
deleted 6y ago
[deleted]
bArray 6y ago
Sometimes it's accidental (but probably not in this case). One time a customer came to us and asked us to PenTest their server, checking it stands up to a DDoS. They said they owned the server and it was their network, so we said "we can run a small one for you which should give us an idea of some pain points". We run the "mini" DDoS against the server, it takes a little more to sink the server than expected, but we just ramp up a few more connections and it is fine. We lift off on the test attack, but customer site doesn't come back up. We contact them and they say they will contact the VPS host. * Heart sinking moment * We test other websites running on their cloud from a different connection - we had taken out their entire cloud infrastructure (this was a small provider). After a short while they were back up, but not before another few conversations with the customer. I really don't even want to know how badly positioned we were legally that day. Lesson learned: Always double check.
- celicaraptor 6y ago
  Did you try to contact the provider to provide(heh) an explanation?
  - bArray 6y ago
    I believe they were contacted yeah, but at that point I washed my hands of the project.
- technion 6y ago
  I won't forget having a pentester nmap a local network - it hard locked every single phone handset corporation wide. People had to walk around pulling the power out and putting it back in every single desk in multiple buildings.
  - bArray 6y ago
    Wow haha, I wonder what caused them to fail so badly?
    - technion 6y ago

tonydiv 6y ago

I'd assume something sinister... There has to be a reason :)

api 6y ago

I would suspect extortion. Pay us or we DDOS you offline.

antpls 6y ago
I believe that sort of attack can't be achieved repeatedly. These attacks leave traces and clues behind them, and investigators are able to better pinpoint and protect for the next one. I heard they also can't be sustained for a long time. I believe they are more like an attempt to discover limits in the network or some targeted systems. Some systems are also vulnerable while they reboot, so attackers only need a one-time reboot.
- Red_Leaves_Flyy 6y ago
  Not an authority or expert in any fields of discussion itt From what I've been told, you're right. DDOS attacks can routinely expose information through failure modes the ops team never prepared for. What happens when your failsafes fail? If they didn't test for it and put mitigations in place then it's rather likely that sensitive error messages or service details, or whatever, is being exposed over the wire. So aws mitigated this attack. Does aws know for a certainty that they revealed nothing sensitive in the process? Maybe, maybe not. If the attacker is good, and 2.3tbps is pretty fing good, then could the victim even be positioned to know what to look for? In uncharted territories the attacked is always down from the attacker.
- elorant 6y ago
  I heard they also can't be sustained for a long time. That used to be the case, but with the popularity and widespread use of IoT devices it won't hold true for long. If you can hack home appliances you could hold an attack for hours, if not days.
leksak 6y ago
Or shorting the stock of the target? The instant your DDOS topples the target that is. Or going long after the DDOS if you believe it'll recuperate.
user5994461 6y ago
Yep, seen that in person at a startup. The company was receiving regular threats to pay some bitcoins or be DDoS'ed. History has, the company used to be DDoS'ed regularly, sometimes offline for days, before moving to cloudflare.

woofcat 6y ago

Zoom I believe is on Oracle cloud: https://interconnected.blog/why-zoom-chose-oracle/ https://interconnected.blog/why-zoom-chose-oracle/ See previous HN thread here: https://news.ycombinator.com/item?id=23032029 https://news.ycombinator.com/item?id=23032029

txcwpalpha 6y ago
Zoom is primarily on AWS and some Azure. That recent story re: Oracle is talking about an expansion into OCI, but AFAIK they aren’t there yet. https://www.datacenterdynamics.com/en/news/most-zoom-runs-aws-not-oracle-says-aws/ https://www.datacenterdynamics.com/en/news/most-zoom-runs-aw...

gen3 6y ago

Baddies will sometimes do big DDOS’s of a public site to showoff their botnet’s capability. That clout is then used as proof to sell their service to customers. I could see this being an instance of such a thing.

deleted 6y ago

[deleted]

bArray 6y ago

Sometimes it's accidental (but probably not in this case). One time a customer came to us and asked us to PenTest their server, checking it stands up to a DDoS. They said they owned the server and it was their network, so we said "we can run a small one for you which should give us an idea of some pain points". We run the "mini" DDoS against the server, it takes a little more to sink the server than expected, but we just ramp up a few more connections and it is fine. We lift off on the test attack, but customer site doesn't come back up. We contact them and they say they will contact the VPS host. * Heart sinking moment * We test other websites running on their cloud from a different connection - we had taken out their entire cloud infrastructure (this was a small provider). After a short while they were back up, but not before another few conversations with the customer. I really don't even want to know how badly positioned we were legally that day. Lesson learned: Always double check.

celicaraptor 6y ago
Did you try to contact the provider to provide(heh) an explanation?
- bArray 6y ago
  I believe they were contacted yeah, but at that point I washed my hands of the project.
technion 6y ago
I won't forget having a pentester nmap a local network - it hard locked every single phone handset corporation wide. People had to walk around pulling the power out and putting it back in every single desk in multiple buildings.
- bArray 6y ago
  Wow haha, I wonder what caused them to fail so badly?
  - technion 6y ago