6 ms·

2.3 Tbps is (peak) ingress, but AWS Shield egress of 2.3 Tbps costs around $53k per hour. I am curious what kind of bill would you get from AWS after this is ov

2.3 Tbps is (peak) ingress, but AWS Shield egress of 2.3 Tbps costs around $53k per hour. I am curious what kind of bill would you get from AWS after this is over? Also interesting to know if the Cloudflare's price tag of $200/mo. will also cover such an attack without nullrouting or severe throttling where site becomes unusable.

bArray 6y ago
It kind of feels like this is getting into insurance territory. Never thought I would ever consider the possibility of a "DDoS insurance" in all honesty.
- txcwpalpha 6y ago
  “DDoS insurance” would almost certainly be covered under cyber security insurance, which any decently sized organization should have these days. Even without that, I wouldn’t be surprised if it’s covered by other forms of insurance, such as policies that would cover an internet or power outage. It would probably be harder to get the insurance to pay out, but if your legal team is big enough, maybe...
  - freehunter 6y ago
    Yup. I've been working in cyber security for going on 10 years now and even when I started at my first company, we already had for-pay DDoS mitigation services and cyber attack insurance. The insurance covered the cost of compensating customers for any outages that came from a successful attack (fictional example: site was down for an hour due to a DDoS so we had to reimburse millions of dollars to thousands of customers all at once). These days incident response retainers are very common, where you would pay a security firm like Mandient or Verizon or IBM a small fee every month and in exchange they guarantee that they will have an expert on site within X hours if you have a security breach. Almost every major company has a retainer like this.
    - deleted 6y ago
      [deleted]
    - jacobwilliamroy 6y ago
      Who gets the retainer fee?
      - freehunter 6y ago
        The company you pay for the retainer gets the retainer. For example a place I worked had a retainer with Verizon. Every month we paid Verizon ~$500/hr for X number of hours. If we didn't need those hours for incident response we could use them for penetration testing or consulting to improve our detection tools, etc. But when something bad happened, we had already pre-paid for their consultant to come visit and help us. The real benefit to this situation is you get to avoid haggling over price and waiting for a quote from the sales guy and running it past your legal department. All that enterprise sales nonsense is already done so when you pick up the phone it's all business with no negotiation.
        jacobwilliamroy 6y ago
        Who at verizon gets the retainer fee if the consultant is never requested? How is it distributed?
rvnx 6y ago
Cloudflare kicks you out in this case, already with a couple of Gbps you can get kicked out (so essentially the attackers win), so few Tbps, don't even think about it except if they can get really good PR out of the story.
- jgrahamc 6y ago
  What are you talking about? We don't kick people off for "a couple of Gbps". Did you see our latest report? https://blog.cloudflare.com/network-layer-ddos-attack-trends-for-q1-2020/ https://blog.cloudflare.com/network-layer-ddos-attack-trends...
  - rvnx 6y ago
    I'm referring to the cases where you get attacked and Cloudflare proxying was disabled on purpose by Cloudflare. So your account is all active, but you don't have the proxy-through-CF part. As a result all the traffic goes directly to the origin (as a side-effect, your origin IP address is revealed to the attacker). You receive the email "Sorry, CF offers limited DDoS Protection, call our Enterprise team for help". From your blog post I understand you don't do it anymore, which is good. Really, it was quite bad to see the DDoS protection failing you when you need it the most :|
    - NullPrefix 6y ago
      >Really, it was quite bad to see the DDoS protection failing you when you need it the most Could be called "A business plan upgrade moment"
    - AgentME 6y ago
      I had this experience too about 7 years ago. It was extremely frustrating because the origin IP being exposed to the DDOSers meant I had to move servers too instead of just upgrading my CF plan. To be fair, at the time I believe "DDOS protection" was a feature only explicitly listed on their $200/month plan, and I was on the $20/month plan. I think it's part of all plans for the last few years now. At my job now, we use cloudflare workers, but I'm almost hesitant to rely on them too much because I know they'd all break immediately if CF ever decided to surprise-switch our account off of the proxy-though-CF mode like I had happen before. I don't know if that move is still part of CF's playbook or not given the changes in how they handle DDOS attacks; maybe I'm being a bit irrational since the DDOS attacks were a painful experience to deal with overall. I hope this time CF will just ask us for more money if there's a problem before pulling out the rug. Other than that bad experience around that DDOS attack, CF has been one of my favorite services.
sudosysgen 6y ago
That is insanely expensive. 2.3Tbps would cost you about $100k per month, so that's a massive economic advantage for the attacker.
- fxtentacle 6y ago
  In the article it says that it only lasted 3 days.
  - sudosysgen 6y ago
    Sure but how ridiculous is it that AWS shield costs in two hours a month of bandwidth? That makes is more economical to buy 2.3Tbps for an entire month than to defend against it for three hours.
    - fxtentacle 6y ago
      Isn't it like that for all cloud offerings?
    - sieabahlpark 6y ago
      You're leaving out the cost of lost business if the site is down.
- gardenrewind 6y ago
  They charge you for _egress_ not ingress (and only for AWS Shield Advanced). Standard: free; only pay AWS egress charges. Advanced: $3K/yr + ~$0.05/GB data out So blocking 3Tbps costs nothing additional to the user.

bArray 6y ago

It kind of feels like this is getting into insurance territory. Never thought I would ever consider the possibility of a "DDoS insurance" in all honesty.

txcwpalpha 6y ago
“DDoS insurance” would almost certainly be covered under cyber security insurance, which any decently sized organization should have these days. Even without that, I wouldn’t be surprised if it’s covered by other forms of insurance, such as policies that would cover an internet or power outage. It would probably be harder to get the insurance to pay out, but if your legal team is big enough, maybe...
- freehunter 6y ago
  Yup. I've been working in cyber security for going on 10 years now and even when I started at my first company, we already had for-pay DDoS mitigation services and cyber attack insurance. The insurance covered the cost of compensating customers for any outages that came from a successful attack (fictional example: site was down for an hour due to a DDoS so we had to reimburse millions of dollars to thousands of customers all at once). These days incident response retainers are very common, where you would pay a security firm like Mandient or Verizon or IBM a small fee every month and in exchange they guarantee that they will have an expert on site within X hours if you have a security breach. Almost every major company has a retainer like this.
  - deleted 6y ago
    [deleted]
  - jacobwilliamroy 6y ago
    Who gets the retainer fee?
    - freehunter 6y ago
      The company you pay for the retainer gets the retainer. For example a place I worked had a retainer with Verizon. Every month we paid Verizon ~$500/hr for X number of hours. If we didn't need those hours for incident response we could use them for penetration testing or consulting to improve our detection tools, etc. But when something bad happened, we had already pre-paid for their consultant to come visit and help us. The real benefit to this situation is you get to avoid haggling over price and waiting for a quote from the sales guy and running it past your legal department. All that enterprise sales nonsense is already done so when you pick up the phone it's all business with no negotiation.
      - jacobwilliamroy 6y ago
        Who at verizon gets the retainer fee if the consultant is never requested? How is it distributed?

rvnx 6y ago

Cloudflare kicks you out in this case, already with a couple of Gbps you can get kicked out (so essentially the attackers win), so few Tbps, don't even think about it except if they can get really good PR out of the story.

jgrahamc 6y ago
What are you talking about? We don't kick people off for "a couple of Gbps". Did you see our latest report? https://blog.cloudflare.com/network-layer-ddos-attack-trends-for-q1-2020/ https://blog.cloudflare.com/network-layer-ddos-attack-trends...
- rvnx 6y ago
  I'm referring to the cases where you get attacked and Cloudflare proxying was disabled on purpose by Cloudflare. So your account is all active, but you don't have the proxy-through-CF part. As a result all the traffic goes directly to the origin (as a side-effect, your origin IP address is revealed to the attacker). You receive the email "Sorry, CF offers limited DDoS Protection, call our Enterprise team for help". From your blog post I understand you don't do it anymore, which is good. Really, it was quite bad to see the DDoS protection failing you when you need it the most :|
  - NullPrefix 6y ago
    >Really, it was quite bad to see the DDoS protection failing you when you need it the most Could be called "A business plan upgrade moment"
  - AgentME 6y ago
    I had this experience too about 7 years ago. It was extremely frustrating because the origin IP being exposed to the DDOSers meant I had to move servers too instead of just upgrading my CF plan. To be fair, at the time I believe "DDOS protection" was a feature only explicitly listed on their $200/month plan, and I was on the $20/month plan. I think it's part of all plans for the last few years now. At my job now, we use cloudflare workers, but I'm almost hesitant to rely on them too much because I know they'd all break immediately if CF ever decided to surprise-switch our account off of the proxy-though-CF mode like I had happen before. I don't know if that move is still part of CF's playbook or not given the changes in how they handle DDOS attacks; maybe I'm being a bit irrational since the DDOS attacks were a painful experience to deal with overall. I hope this time CF will just ask us for more money if there's a problem before pulling out the rug. Other than that bad experience around that DDOS attack, CF has been one of my favorite services.

sudosysgen 6y ago

That is insanely expensive. 2.3Tbps would cost you about $100k per month, so that's a massive economic advantage for the attacker.

fxtentacle 6y ago
In the article it says that it only lasted 3 days.
- sudosysgen 6y ago
  Sure but how ridiculous is it that AWS shield costs in two hours a month of bandwidth? That makes is more economical to buy 2.3Tbps for an entire month than to defend against it for three hours.
  - fxtentacle 6y ago
    Isn't it like that for all cloud offerings?
  - sieabahlpark 6y ago
    You're leaving out the cost of lost business if the site is down.
gardenrewind 6y ago
They charge you for _egress_ not ingress (and only for AWS Shield Advanced). Standard: free; only pay AWS egress charges. Advanced: $3K/yr + ~$0.05/GB data out So blocking 3Tbps costs nothing additional to the user.