4 ms·

When Anonymous attacked Visa and Mastercard via DDoS (in retaliation to them cutting off Wikileaks donations), Anonymous did actually succeed in stopping the on

by cryptoz 15y ago

When Anonymous attacked Visa and Mastercard via DDoS (in retaliation to them cutting off Wikileaks donations), Anonymous did actually succeed in stopping the online verification systems for both companies (SecureCode, or something, and Verified by Visa). In that case, the DDoS attacks did more than just take the site down; they financially hurt their target, which was probably the aim to begin with. I'm not justifying the attacks and I agree that they are the wrong way to go about this business, but it would be naive to suggest that the DDoS attacks are a minor inconvenience.

ojilles 15y ago
DDoS's have a monetary impact, yes. However, what the parent is saying is that all infrastructure has limits in terms of bandwidth, etc. The point is that it's not the same class of "attack" vs. finding an exploit. The latter is more in line with the "strive for more secure sites". The former, not so much.
- mentat 15y ago
  Then we need to fix the infrastructure so that the current generation of attacks don't work. To just say, "oh, well bandwidth is limited so there's always going to be an attack" is not useful. Think of ways you can structure the infrastructure so that it can do filtering further out, or detected spoofed connections, or detect anomalous request patterns. There are solutions, we need to find them and implement them, not just tell people not to do it or claim it's a "weak" attack. It's a strong attack if it takes minimal effort to cause maximal damage. In the real world, that's what matters. There's the idea that we're playing a game and that there are behaviors that are good form or bad form. However, when it comes down to it, what works is what works.
  - migrantgeek 15y ago
    They can certainly protect against this but it's not a good idea. I pay US taxes and I don't want the cia.gov site to be on the same type of hardware as say Google just to be DDoS "proof". They shouldn't be connected with a 33.6 modem but to ask all sites to upgrade everything to prevent DDoS is insane. Who could afford to start a web site if they had to lay out all of that cost?
    - chriserin 15y ago
      Might that be another advantage of cloud computing? To spread the cost of DDoS defense infrastructure across many websites?
      - bxr 15y ago
        You'd still have to pay for all the computing time to remain available during the attack. Its probably not worth it to try to stay up in that kind of storm.
  - ojilles 15y ago
    mentat, I wasn't saying don't protect ourselves against this. However, harnessing a big enough bot network you can always overcome these measures. Finding an exploit is different, and especially for financial institutions inexcusable to a certain level.
nextparadigms 15y ago
It also led to Paypal allowing Wikileaks to retrieve the money they already had before they suspended their account.
- phillijw 15y ago
  I was not aware of this. Can you cite a source?
- jules 15y ago
  Is phillijw another false positive of HN spam detectors?
  - sorbus 15y ago
    Maybe. Look back through his(?) comment history, and you'll see that the point where he was autokilled/hellbanned (around nine pages back) was, while a very downvoted (and nonsensical) comment, not actually malicious. Before that, he had a few comments which were downvoted maybe two or three times (you can tell by the color). It's probable that he was autokilled/hellbanned because those caused his average comment karma to drop too far, as well as making his karma negative, though I am not aware of the exact criteria. At this point, he seems like a false positive based on his recent comments. It's a pity that there's no real procedure for being unhellbanned, even if the user discovers that they are, other than starting a new account.
    - jules 15y ago
      Even starting a new account doesn't work (at least it didn't in a previous instance where I notified a false positive). You also need to use a proxy. So to phillijw, email PG or start a new account using a proxy :)

by cryptoz 15y ago

ojilles 15y ago

DDoS's have a monetary impact, yes. However, what the parent is saying is that all infrastructure has limits in terms of bandwidth, etc. The point is that it's not the same class of "attack" vs. finding an exploit. The latter is more in line with the "strive for more secure sites". The former, not so much.

mentat 15y ago
Then we need to fix the infrastructure so that the current generation of attacks don't work. To just say, "oh, well bandwidth is limited so there's always going to be an attack" is not useful. Think of ways you can structure the infrastructure so that it can do filtering further out, or detected spoofed connections, or detect anomalous request patterns. There are solutions, we need to find them and implement them, not just tell people not to do it or claim it's a "weak" attack. It's a strong attack if it takes minimal effort to cause maximal damage. In the real world, that's what matters. There's the idea that we're playing a game and that there are behaviors that are good form or bad form. However, when it comes down to it, what works is what works.
- migrantgeek 15y ago
  They can certainly protect against this but it's not a good idea. I pay US taxes and I don't want the cia.gov site to be on the same type of hardware as say Google just to be DDoS "proof". They shouldn't be connected with a 33.6 modem but to ask all sites to upgrade everything to prevent DDoS is insane. Who could afford to start a web site if they had to lay out all of that cost?
  - chriserin 15y ago
    Might that be another advantage of cloud computing? To spread the cost of DDoS defense infrastructure across many websites?
    - bxr 15y ago
      You'd still have to pay for all the computing time to remain available during the attack. Its probably not worth it to try to stay up in that kind of storm.
- ojilles 15y ago
  mentat, I wasn't saying don't protect ourselves against this. However, harnessing a big enough bot network you can always overcome these measures. Finding an exploit is different, and especially for financial institutions inexcusable to a certain level.

nextparadigms 15y ago

It also led to Paypal allowing Wikileaks to retrieve the money they already had before they suspended their account.

phillijw 15y ago
I was not aware of this. Can you cite a source?
jules 15y ago
Is phillijw another false positive of HN spam detectors?
- sorbus 15y ago
  Maybe. Look back through his(?) comment history, and you'll see that the point where he was autokilled/hellbanned (around nine pages back) was, while a very downvoted (and nonsensical) comment, not actually malicious. Before that, he had a few comments which were downvoted maybe two or three times (you can tell by the color). It's probable that he was autokilled/hellbanned because those caused his average comment karma to drop too far, as well as making his karma negative, though I am not aware of the exact criteria. At this point, he seems like a false positive based on his recent comments. It's a pity that there's no real procedure for being unhellbanned, even if the user discovers that they are, other than starting a new account.
  - jules 15y ago
    Even starting a new account doesn't work (at least it didn't in a previous instance where I notified a false positive). You also need to use a proxy. So to phillijw, email PG or start a new account using a proxy :)