9 ms·
Exponential growth in DDoS attack volumes
- knorker 6y agoGoogle got sick of other services bragging about their much smaller attacks being "the biggest"?
- hobs 6y agoCloudflare also sent out an email to this effect today.
- jeffbee 6y agoAnd Cloudflare's cited packet rate from the Moobot attack is a bit higher than Google is citing in this article. Attacks approaching 1 Gpps are pretty serious and both of these companies are fighting the problem by spending tons of money. As Google says here, "sufficient capacity to absorb the largest attacks". No magic bullet.
- fizwhiz 6y agoCapacity is a necessary but not sufficient condition to mitigate something at this scale though.
- jacquesm 6y agoI read that and thought: we crossed that barrier years ago. Then I noticed the Gpps unit on your comment and realized my error. Ouch.
- strombofulous 6y agoWhat does gpps stand for? Google is surprisingly unhelpful
- oars 6y agoWhy are people switching to the gpps unit now instead of using tbps? Each packet has a different length (due to different payloads), hence now we are switching to an inconsistent unit of measurement?
- repiret 6y agoThe capacity of networking gear isn't unidimentional - most network equipment has both a maximum number of packets per second and a maximum total throughput. I'm not in the business, but I suspect that sophisticated network filtering equipment even at the high end can have its packets-per-second capacity eaten up before it hits line speed, just like low end routing equipment can. As a result, there are some people whose ability to withstand a DDoS has more to do with packets per second than bits per second, so it becomes a useful metric.
- jeffbee 6y agoYes, a 1-byte UDP packet is just about as costly as a 1000-byte UDP packet. Considering that an ordinary PC can drive a 100gbps line interface with large frames, 1tbps is really nothing at all. But 1 Gpps is orders of magnitude more than one machine can normally send or receive.
- elithrar 6y ago> As a result, there are some people whose ability to withstand a DDoS has more to do with packets per second than bits per second, so it becomes a useful metric. Right, definitely. A large sports streaming event might (easily!) do 10Tbps across a country, even more, but each GB served may only represent ~5k requests - 10e3/8 * 5e3 = 6.25M RPS, with each request being a single packet (small GET requests). That's big, but workable across enough machines for a big provider. 500M Pps is 80x that figure - you're basically DoS'ing header processing filters in your networking hardware.
- drivebycomment 6y agoPeople are not switching. Serious practitioners always distinguished between pps, bps and rps(or qps), as they measure different dimensions as explained in the article.
- toast0 6y agoIf people keep installing Windows Simple TCP/IP Services and activating the chargen server[1] on cloud machines with faster network interfaces, it's going to keep getting worse. I mean, BCP38 would be nice too, but not installing more chargen reflectors would be good enough for me. [1] I wish I were joking, but this was verifiably the source of most of the volumetric DDoS I fought at my last job.
- jiggawatts 6y agoWhat the... what? I've never seen the Simple TCP/IP services enabled anywhere, ever! It's not needed for any application that I've ever heard of. Why would anyone install this? On an Internet-facing server no less!?
- toast0 6y agoHell if I know, but you send a 0 payload UDP, and it sends a 64k payload UDP back, IP fragmented obviously. Oh, and their firewall helpfully blocks sending the first fragment... cause that's helpful.
- acdha 6y agoI want to believe you’re joking about a service I last installed during the Clinton administration - and didn’t make public even then - but we never get a break on that. Right behind this, I’ll put cloud providers who helpfully put default 0.0.0.0/0 rules in their firewalls.
- gambler 6y agoLet me guess. Instead of thinking how to solve this on protocol level the solution is to use more Google services. Reading. ... Yep. The article even includes the obligatory "try harder" bit about security.
- freehunter 6y agoExactly right. Security has been on a path of “layer more complexity over inherently insecure protocols” and it’s not going to stop any time soon because selling more products/services is worth too much money. There’s a lot of work and very little money in replacing outdated networking protocols with smarter/more secure protocols. And there’s very little punishment (from customers or regulators) for suffering from massive cyber attacks, even if you expose the sensitive information of people who never even chose to give you their information (like Equifax). There’s no punishment or reputational damages from having your network traffic rerouted from a BGP attack. The consumer pays all the cost and they don’t even change their behavior after paying that cost, so why would companies bother? Normally this is a situation where governments would step in and protect their citizens, but... well there’s just too much money on the line. So the programmers get the blame and the customers pay the price and security vendors make another $100 million and we do it all over again next month.
- gambler 6y agoI get the feeling the government will step in and regulate soon: https://www.atlanticcouncil.org/programs/scowcroft-center-for-strategy-and-security/cyber-statecraft-initiative/breaking-trust/ https://www.atlanticcouncil.org/programs/scowcroft-center-fo...
- viraptor 6y agoWhat's your proposed idea at the protocol level which solves the "I'll just saturate your pipe with garbage packets" case? That was the Mirai problem and I can't imagine a protocol solution. These are real, fully controlled endpoints. Even when we have solutions to some issues (authenticated BGP), people don't implement it and there's nothing Google can really do about that. (Apart from not accepting traffic from those ASes?)
- semi-extrinsic 6y agoLooking at that graph, there is way too much scatter / too little data in order to plot clean exponential fits like that. A linear model would likrly fit the data just as good. At least throw on some bands indicating uncertainty in the fit.
- 1propionyl 6y agoThere are three distinct series of data (indicated by color) there. Looking at each individually I have to disagree. They look like perfectly kosher (and in fact good) exponential fits. Bands would still be nice though.
- X6S1x6Okd1st 6y agoThe bits per second one doesn't have any points for the past 5 years?! It's by far the scariest one if you just look at the graph
- mediaman 6y agoI agree. It's better to cut off the line past the point where it no longer has any data to support it. In this case it's about 2.5 years of missing data that is substantiating a claim of 2x+ increase during the same time. It's reasonable to say it had an exponential function up until two years ago, and we don't know what it was since then. R squared doesn't capture that inaccuracy because there is no data to compare it against during the scary time period in question. It's just a line in a void.
- cutemonster 6y ago> cut off the line Or change to thin dashed line when no more data
- menscher 6y agoThe trend-lines were really just to guide the eye (the text gives this context), but if you really must know: the R^2 for all three fits was above 0.9, suggesting the exponential growth model is reasonable. As you say, the pps and bps don't show much curvature, so a linear fit could indeed work for them for the displayed portion of the graph. But it's non-sensical when you look further back in time... predicting negative attack volumes prior to mid-2011. ;)
- stevespang 6y agoSounds to me an awful lot like a "throw down the gaunlet" to Cloudflare . . .
- csense 6y agoWhat's the motivation for these attacks? How do attackers benefit?
- deckar01 6y agoI was the target of an email DDoS attack on my gmail account in 2017. I had to propose some motivations in my report. https://imgur.com/ksYbkEv https://imgur.com/ksYbkEv
- bob33212 6y agoTake a site offline then tell the owners that if they pay you 5 bitcoin you'll bring it back. Google wouldn't ever pay but a medium/large retail company may if they are losing 100k/hour in sales
- bluGill 6y agoFor a similar price you can pay ddos defense to a real non-criminal company and like Google ignore their threats. This is a good investment for everyone as it lowers the rewards of crime and thus gets criminals out.
- Nextgrid 6y agoWhat prevents the criminals from either increasing their firepower to the point here DDoS defense providers can't handle, or outright run/be affiliated with those defense providers?
- remus 6y agoIt's hard and expensive controlling enough machines to ddos Google. And Google wouldn't want to work with someone who was ddosing sites for the same reason or doesn't work with the Mafia.
- toast0 6y agoI would regularly see attacks of exactly 300 second duration. I imagine people were kicking the tires on DDoS services for the lolz. Almost always targetting our www servers, rather than anything useful.
- colllectorof 6y agoI don't think big tech is all that eager to actually solve this. Mitigate - yes, but not solve. What is their motivation to really fight this? They have capacity to spare and insecurity is a wonderful driver of cloud service adoption. Also, they are in a much better position than smaller companies to deal with security-related regulation if something of that sort will pass congress. IoT is a huge contributor to the DDoS problem right now, but I don't see any big names campaigning against it. It's not really seen as a threat, but as an opportunity. Many problems in security are, in fact, opportunities for big tech to consolidate power, squash smaller competitors and charge more for basic services.
- magila 6y agoThey'd take a solution if they could get it, the catch is they want one they can keep proprietary to their network.
- remus 6y agoPoorly implemented IoT devices are a big contributor, but it's possible to design high quality IoT devices that are a net win. That's why big tech companies aren't campaigning against IoT.
- bArray 6y agoFor the rps (requests per second) it doesn't seem to be exponential in their graph (as the line indicates), but actually more linear [1]. That's interesting because it suggests that most attacks are increasingly network based rather than application based. I guess we're now at the point where we can just spin up more machines to absorb attacks and use various forms of caching, but it's not really possible to do the same for networking. [1] https://storage.googleapis.com/gweb-cloudblog-publish/images/DDoS_attacks.max-1400x1400.jpg https://storage.googleapis.com/gweb-cloudblog-publish/images...
- throwaway189262 6y agoI suspect packets per second has been scaling slower than bandwidth. For instance consumer routers can push 1 gigabit but only at rather large packet sizes. This is a major selling point for commercial networking gear
- bArray 6y agoSomething I would like to see is the attacks normalized over the number of customers - are they also increasing their customer base exponentially? If so, maybe this data really isn't so interesting...
- IndexPointer 6y agoWhat's grows exponentially is the volume of individual attacks, not the total volume, so normalization is not important.
- daly 6y ago"Nice website you have running on your own hardware. It would be a shame if it was DDoSed from the cloud."
- cft 6y agoYou can defend on your own HW, using several methods: -A proxy, e.g. Cloudflare - A fat link, e.g. 100Gbps Cogent + a good hardware firewall (completely independent scenario) - Use a GPRE tunnel based mitigation, if you own your own AS number, e.g. by Verisign
- samoa42 6y agohope everyone appreciates the irony of that reply as much as i do. ie. "you can pay the muggers or build yourself a castle with a drawbridge"
- neom 6y agoPretty cool that the guy who wrote this has been doing SecOps in some form at google for over 15 years, and formed the google DDoS Security Team.
- throwaway189262 6y agoCloud providers beat the DDoS drum to convince on prem companies that they're only safe on the big cloud. I used to run something like 100 blogs for our clients. None ever DDoSed. I surmise getting DDoSed is as rare as getting hit by lightning. You can protect web apps against smaller attacks easily by just doing a SPA on a CDN and verifying tokens on your load balancer. If you use SHA token verification (signature based JWT verification is slow) your load balancers can probably reject traffic at line rate. Run a pile of servers behind 40 gig interfaces and a DDoS attack will be the data center's problem. You'll saturate their line before your service goes down. Combine that with DNS or JS client side load balancing and multiple data centers will go down before your app does.
- cutemonster 6y agoHow do you do js load balancing? Trying different hostnames via js?
- throwaway189262 6y agoYeah, api1.domain.com api2.domain.com If you've got a SPA using static files hosted on a CDN it's probably the best way to load balance. Like DNS but you have control over backend selection. You can set retry interval a lot shorter than DNS. No problems with DNS caching. And you can try secondary on HTTP errors, not just connection timeout. In my experience clouds like to fail in ways that return 500/400 instead of timing out
- deleted 6y ago[deleted]
- cutemonster 6y agoThanks. If you happen to know about any related article that you like, it'd be interesting to read
- throwaway189262 6y ago
- syspec 6y ago> In March 2014, malicious javascript injected into thousands of websites via a network man-in-the-middle attack caused hundreds of thousands of browsers to flood YouTube with requests, peaking at 2.7 Mrps (millions of requests per second). What would be the reason for leveraging this kind of attack against a target like YouTube? It seems like an odd target
- mihaic 6y agoI'm starting to think that the proliferation of DDoS protection from big cloud providers is actually driving an arms race in the scale of these attacks, and making in the end things worse for everyone except the biggest providers.