7 ms·
Mēris botnet, climbing to the record
- deleted 5y ago[deleted]
- datameta 5y agoCan someone please explain-like-I'm-not-versed-in-botnets?
- morsch 5y agoYes. That is what the article is? RPS is requests per second, 20m RPS is apparently a lot, and there's a new botnet that does it.
- datameta 5y agoOne could surmise as much, but thanks. I'm also looking for some of the 'why' perhaps moreso than the 'what'.
- FDSGSG 5y agoit make website no worky
- datameta 5y agoI understand the purpose of a botnet. I was asking for an explanation of the technical details of this apparent advancement. But apparently snide comments purposely devoid of any detail is what I'm getting here now. Cheers
- junon 5y agoIt is not clear to us which information is not clear to you.
- datameta 5y agoI would like to understand the significance of each bullet point under "Specific features of Mēris botnet".
- giantrobot 5y agoSOCKS proxy: the botnet allows tunneling non-WWW traffic through it so users of the botnet can route say BitTorrent or other P2P traffic through it. HTTP Pipelining: instead of simplistic one-request-one-resource requests to a server the botnet supports HTTP 1.1 pipelined requests. A single request can ask for multiple files meaning even more demand on target servers. Request resources not cached in memory can see the server eat up its IOPS trying to read files.
- nik41tkins 5y agoThe main point of this article seems to be to highlight the 20 million requests per second arbitrary metric. Otherwise the bullet points are about the functionality in place in the infected clients. The port is likely a detection metric for infected clients.
- michaelbuckbee 5y agoDDoS attacks like this are usually launched from large number of malware ridden personal computers. Since the attacks are coming from an IP addresses on a residential network they're very hard to differentiate from legitimate traffic. What's different about this attack is that it appears to not be PCs but network devices (routers) that are being taken over and used to launch attacks. People are much less likely to catch that this is occurring and as a result there's concerns that this botnet is going to persist as a threat for a much longer time than is typical. Additionally, network devices may have access to a greater amount of bandwidth than a PC increasing the threat. One more thing: when the botnet makes a request (attack) against a site it's using a modern performance optimization technique of "pipelining" where instead of a GET to "/index.html" just interacting with the index.html file it's holding a connection open to also then request all the other assets from the site. In normal usage this is great as it makes a site feel more responsive and reduces network overhead. However, in the context of this botnet it also increases the number of requests that each bot can make (which is bad).
- _e 5y agoGreat explanation... For anyone interested, the following jupyter notebook explains three different ways to process HTTP requests: serial requests (the baseline), pipelined requests and parallel requests with multiple connections (and without threads). https://gist.github.com/coady/f9e1be438ba8551dabad https://gist.github.com/coady/f9e1be438ba8551dabad
- ogurechny 5y ago0. There seems to be a MikroTik exploit, and all versions are vulnerable. Well, it possible that someone collected the passwords back in 2018, and used them to access updated devices this year, but I guess naaah. I wonder what should happen to that fine company to make them stop running all the potentially vulnerable system configuration services on all interfaces by default. IP > Services is one of the locations anyone should check ASAP to make sure unneeded ones are disabled, but it's actually misleading. These are just preconfigured wrappers for some components, and others, like DNS or bandwidth test server mentioned in the article, are not shown even if they are running. There isn't even a netstat-like command to check which ports are open. 1. While reaching a record number, the attack against something on the scale of Yandex and Cloudflare is more of a maximum capacity test not limited by target's connectivity, and/or an advertisement for someone's DDoS services. 2. Still, it's an application-level DDoS, so you have to have a swift application-level detection in place if you don't want to just ban IP addresses (and potentially cut legal users from HTTP(S) APIs and other services that might be shared on the server or network). 3. Some skill was demonstrated in finding no-trivial weak points to amplify the server load.
- swiftcoder 5y agoIn other words, this entire botnet can perform the work of... a few dozen decent size AWS instances? We used to push ~million request per second from each m4.10xl instance when running load tests.
- yabones 5y agoWhat makes it dangerous is that those requests aren't coming from a single source - it's a distributed denial of service attack. Anybody can push huge throughput from an XL cloud server with good networking, but it's just as easy to block that IP. Blackholing thousands of nodes is much more difficult.
- menmob 5y agoLegitimate IPs, at that. These are networks that are not hostile 99% of the time.
- junon 5y agoYes and to mitigate your puny attack I need to block a few dozen IPs. A botnet is probably coming from hundreds, if not thousands of IPs, sprinkled in with normal user requests and often with similar frequency.
- baybal2 5y ago"Connect to cloud by default" should be banned in any sensible network. It's probably even more devastating that "default password by default" if exploited successfully. A single stolen cert, or access to the device provisioning server instantly gets you "keys to the kingdom," and all of the devices online. A default password, or a vulnerable API on the device, in contract, will still need the attacked to individually find, and hack each vulnerable device.
- FrankSansC 5y agoOriginal link: https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/ https://blog.qrator.net/en/meris-botnet-climbing-to-the-reco...
- chalst 5y agoThanks for linking to this. Given the amount of misinformation in infosec, we should not be linking to intermediate sources for this kind of story.
- jcpham2 5y agoVery difficult or slow to load for me: > https://archive.is/RLkSX https://archive.is/RLkSX
- dang 5y agoChanged above from https://habr.com/ru/company/yandex/blog/577040/ https://habr.com/ru/company/yandex/blog/577040/. Thanks!
- _wldu 5y agoNow that everything is in the cloud, DDoS is no longer an availability issue, just a billing issue.
- PragmaticPulp 5y ago20 million requests per second from a single beefy AWS server is easy to detect and block. 20 million requests per second coming from a rotating list of hosts from generic IP addresses is a nightmare: > However, we suppose the number to be higher – probably more than 200 000 devices, due to the rotation and absence of will to show the "full force" attacking at once. If your site normally has 10,000 users per day and suddenly you’re flooded with 200,000 additional IP addresses hammering at your site, you have a problem. To put it in perspective, the top post on HN most of yesterday was about someone benchmarking their personal server as being able to handle about 5 million requests per day (Granted, that’s quite slow, but it will suffice for making a point). This botnet can deliver 4X that server’s total daily capacity every second.
- colejohnson66 5y agoBut how do you distinguish an abnormal traffic spike (HN hug-of-death) vs a botnet? Cloudflare’s solution is a CAPTCHA, but are there better options?
- aj3 5y agoGenerally you don't. Just be prepared to scale resources and handle everyone.
- smasher164 5y agoAn attack-resistant trust metric? Although I haven’t seen them used against denial of service attacks.
- jgrahamc 5y agoCloudflare's solution is not a CAPTCHA. We have a ton of stuff going on that detects bots. CAPTCHAs are a small part of the tools we use. https://blog.cloudflare.com/cloudflare-bot-management-machine-learning-and-more/ https://blog.cloudflare.com/cloudflare-bot-management-machin...
- colejohnson66 5y ago
- jtchang 5y agoTo block something like this you need to determine what is botnet traffic vs legit traffic. It's hard. Source IP doesn't work since it is random and changes. You need to look at things such as HTTP headers, TCP window and any odd flags that might be set. If you're lucky the botnet isn't capable of running a copy of Chrome or Safari or using a random sample template from legit traffic. Lots of botnets are made up of low power IOT devices so once these devices are capable of running a full headless chrome it will get harder. Not to mention when you do figure out how to discriminate traffic you have to code it. And the code to determine valid traffic vs invalid better run fast because you are getting hit with 100k requests per second. Oh did I mention the attacker can change their algorithm whenever they want? Hope you have a full tensorflow ML/AI pipeline that configures your hardware based ingress of choice just in time. All this while making sure your current production traffic is being served at a speedy pace and not blocking legit customers. These are some of the issues Cloudflare and companies like them have to deal with.
- aj3 5y agoThis attack was 20m requests per second, not 100k.
- _e 5y agoIntroducing javascript into the mix will not make the botnet more difficult to detect. Headless browsers have their own fingerprints which allow defenders to identify them from legitimate traffic. You can spoof the features that headless browsers don't have but that will always be a cat and mouse game.
- potamic 5y agoI think in future servers will ask clients to solve a small computation. It can be theoretically incorporated into the handshake and if it takes something like 100ms, human users would not notice but botfarms will feel the pinch. An additional benefit is that servers can monetise the computation offsetting some of their costs.
- dimitrios1 5y agowe need something like anonymized identity. Something that can prove you are human being, but without requiring your personal data.
- neonate 5y agohttp://web.archive.org/web/20210909125816/https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/ http://web.archive.org/web/20210909125816/https://blog.qrato...
- iforgotmypass 5y agoInteresting name. "Mēris" in Latvian means "plague". I wonder if it is on purpose. Too lazy to read the article or look up, though.
- kreetx 5y agoIs there anything specific Mikrotik owners can do? (other than updating their firmware)
- WarOnPrivacy 5y agoFrom the article: What to do in such a situation? Blacklists are still a thing. Since those attacks are not spoofed, every victim sees the attack origin as it is. Blocking it for a while should be enough to thwart the attack and not disturb the possible end-user. Missing from the article: Links to lists of IPs that they recommend to be blacklisted. It's the same thing that's missing from pretty much every NetSec vendor. We really need a recovery clinic for compulsive threat-data hoarders.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- HansOlo23 5y agoHere's a merisbot-detection script for real-time usage; it can filter attacks in real-time: https://github.com/craig/merisbot-detect https://github.com/craig/merisbot-detect Hope this helps.