11 ms·

Since this is HN, it’s 2021 and DDoS’es are still a thing: why are they still a thing? Is there some fundamental “anonymity” to the Internet that makes it impo

Since this is HN, it’s 2021 and DDoS’es are still a thing: why are they still a thing? Is there some fundamental “anonymity” to the Internet that makes it impossible to structurally prevent DDoS attacks? Apart from CloudFlare-like approaches, are there any R&D in the pipeline that may kill this type of attack once and for all? To me it’s incredibly infuriating to see the damage that still happens with these extremely simple techniques. Will it ever end? Edit: to elaborate, I know that there are tons of insecure Internet devices and whatnot. I’m more interested in standards, and core protocol improvements that can fundamentally rid the world of these types of attacks.

foobiekr 5y ago
DDOS events typically use distributed botnets. Unless you analyze the CNC you’re probably asking for wide deployment of acls (flow spec or otherwise); and such agreements happen occasionally, as they operationally brutal but are slow (otherwise they would be subject to abuse). You, right now, may be participating in a DDOS attack without knowing it. Should your ISP cut you off based on information from some Belgian ISP?
spenczar5 5y ago
DDoSes come from asymmetries in the difficulty of making a request and providing a response. For example, a classic is the SYN flood. In this, the attacker makes many requests to open TCP connections (with a SYN packet) but does none of the rest of the handshaking. The server does the initial bookkeeping for setting up TCP connections, before eventually timing out and freeing the resources. The SYN packets are very cheap and easy to form (and the attacker can immediately free all the resources after firing them away), but the connection state information is a little bigger. This asymmetry builds up, making the server overloaded. I believe that asymmetries in resource consumption are, at some point, unavoidable. You also asked: > are there any R&D in the pipeline that may kill this type of attack once and for all? Note that DDoS attacks are a class of attacks. They're a description for a broad genre. It's kind of like how "bronchitis" actually just means "enflamed bronchial tubes" - it's a symptom, not a cause. Even if we permanently defeat SYN floods, there are a gazillion other DDoS-type attacks (UDP flooding, messing with ARP tables - its an almost endless list).
- ma2rten 5y ago
  Yes, but these attacks are actually easy to detect if they all come from the same IP. Sending packages from a lot of different IPs actually is expensive.
  - menmob 5y ago
    That’s.. not what a Distributed Denial of Service does. They come from thousands of IPs.
  - bravetraveler 5y ago
    That's the first 'D' in DDoS - distributed. Most robots participating in this are unwitting. It's incredibly unlikely someone is paying... even with stolen funds. Often a sort of malware that more or less sits dormant until command/control sends a target to attack edit: To the individual machine, not a lot. The sum total is where the denial of service comes in - everything has a tipping point.
    - Gigachad 5y ago
      These days even peoples iot washing machines are being found to be participating in ddos attacks.
  - oneplane 5y ago
    It's not expensive if you have a botnet, reflective attacks or L7 attacks. It's also not just one type of attack (overloading the target), the only thing in common is that it's a denial of service, and if you distribute it amongst many sources it's a distributed denial of service. Distributed can mean different things, especially if you can spoof addresses, in which case you can do fake distribution (causing src based filtering to be useless). If you know it's just a single bad AS that is doing it, then you can block the AS, but if it's distributed amongst multiple AS'es that's harder. Same with reflective attacks, the source of the traffic might not be the source of the attack and might be a legitimate source which you cannot block because your internet wouldn't work anymore (i.e. when it's DNS servers or NTP servers doing the reflection, or a GCN address which would completely take an ISP's section offline). It's not as simple as sending a large volumetric load from A to B. It used to be that way a decade ago and it can be effective today, but it's not the only way it's happening.
lend000 5y ago
With DDoS the problem is that botnets come from a bunch of random devices that were compromised (for example, your un-updated smart TV or old router could be contributing to the DDoS without your knowledge.) With spam calls, ransomware, and most other forms of cybercrime, the problem is that Russia/China and many 3rd world countries don't extradite/cooperate or have the resources to work with international authorities. I sometimes wonder how much safer the internet would be if China and Russia were cut off. Wouldn't be so great for the already poor state of liberty in either country, but the rest of the world would certainly benefit.
- ChuckNorris89 5y ago
  >Wouldn't be so great for the already poor state of liberty in either country, but the rest of the world would certainly benefit. That's a pretty closed minded way of looking at things.
  - google234123 5y ago
    They are already doing it themselves...
  - lend000 5y ago
    How so? To me, closed-mindedness is shooting down an idea without a reason or alternative.
- deleted 5y ago
  [deleted]
- Andrew_nenakhov 5y ago
  Cutting off countries will do very little. Compromised devices are spread evenly across the globe, and even if their puppeteers sit in China or Russia, you wouldn't be able to block them from issuing orders to botnets.
- spenczar5 5y ago
  It's true that they often use botnets, but amplification attacks are more and more common, and an important component here. In these, the attacker sends crafted requests to an unwitting third party, and that third party then floods the victim with traffic. DNS amplification is probably the best known, here, since DNS is (usually) over UDP which has no persistent connection for replies: - Send a DNS query to a DNS server, using your victim's IP address as the "source IP" for the query. Make the query something with a huge response, like using "ANY". - DNS server responds to the victim's IP address, sending many big UDP packets with the response. After all, it can't know any better - it must* just trust the claimed source IP! - Victim gets a huge flood of UDP traffic, overwhelming IP-level infrastructure like routers and switches. This lets a relatively small attacker multiply ("amplify") their impact - and they do it while traversing a third party, making them more hidden. --- * If course, there actually are mitigations for this; it's possible to detect this spoofing. But this is how DNS operators have worked in the past.
jjeaff 5y ago
Most/all ddos attacks come from unwitting people whose computers or iot devices have been taken over on the order of tens or hundreds of thousands of devices. So there isn't much that can be done beyond filtering or having a large enough pipeline to absorb the traffic. Even if you had a central authority cutting off access from ip addresses, do you cut off whole university campuses because someone's "smart" coffee machine is participating in a ddos or entire businesses because there is a computer in a closet somewhere that is infected?
- mrweasel 5y ago
  We talked about this problem when I worked at a telco. The problem isn't necessarily cutting of the devices that are part of the attack, it's dealing with the aftermatch. As sad as it is, most people won't understand that their device have been effected, and the telcos won't be responsible, financially, for paying to do the cleanup or verification.
- toxik 5y ago
  I feel like home router makers could intervene here and let their owners know when they’ve likely been hacked. Maybe even a regulation type deal?
  - logifail 5y ago
    > home router makers could intervene here and let their owners know when they’ve likely been hacked How? A couple of years ago I had an email from our ISP telling me that "common port X is open on your router" (forwarded to a box exactly as I set it up) and asking if I could "fix the problem". Except it wasn't a mistake or a configuration error, I deliberately set it up that way.
  - foxfluff 5y ago
    I don't see how this would be feasible without giving them a backdoor to snoop around in my home network. No thanks.
  - MertsA 5y ago
    That's never going to work but it very well could lead to ISPs very strongly herding customers to use their own managed routers. They already push for that for customer support purposes, using this to start automatically snooping on "malicious" traffic within a customer's network would be a big step in the wrong direction. You could make a compromise here and require ISPs and network vendors to support a common notification protocol to identify devices sourcing malicious traffic. Most ISPs already have systems in place to send notification messages to customers that are sending botnet traffic. You could mandate it for all of them and let the customer decide if they want their router configured to automatically block a device they were notified about or just record the MAC address and send the ISP a URL the user can visit to view the device sending the traffic. You could make it friendly to the unwashed masses and still put detection on the ISPs and not give them privileged access inside every customer's network.
Arnt 5y ago
It's not that simple. Collecting 250Gbps of uplink is not that simple. The attack vectors are simple in principle, but carrying it out... Here's next year's fine vector: You write a nice iphone or android app and persuade fifty million people to download it. But unknown to the owners of those mobile phones, it also has a hidden evil feature: If the phone has the screen off, is charging and is on a WLAN, then it can participate in a DDoS if you direct them to. The phone's owner won't notice, but if enough phones are charging and each can contribute 2Mbps of upload, you could collect 250Gbps at the target. And tracing it back to that app will be very difficult.
- jonplackett 5y ago
  Why would it be so hard to trace back?
  - johnklos 5y ago
    It wouldn't be hard. If you can examine traffic on a network from which attacking traffic originates, you can see that it's coming from a phone. Then you could see which app by either limiting or deleting apps one at a time, or you'd need two sources, then just see which apps the two sources have in common. When you have 250 Gbps, it'd be simple to capture a fraction of a second's worth of traffic, then write a script to fire off emails to network admins of every IP involved and ask them to look in to it. Out of hundreds or thousands of messages, you'll get a few humans who'd look in to it and would be helpful. I should know, because I've done this very thing.
  - Arnt 5y ago
    If your nontechnical neighbour's ISP calls and says "you're participating in a DDoS, will you please find out which device behind your NAT is sending the traffic and fix whatever the problem is", do you think your neighbour can fix it in five minutes?
    - edoceo 5y ago
      They could remote stop the router?
ancarda 5y ago
As far as I know, a lot of DDoS attacks use UDP amplification, which can be prevented if every ISP implements BCP 38; i.e. drop UDP traffic at the edge of their network that has a source that cannot have come from within their network. EDIT: To clarify, this won't stop layer-7 based DDoS attacks, or anything that uses TCP (like SYN flooding). Just UDP amplification.
- woutifier 5y ago
  BCP 38 would stop SYN flooding if it is using source address spoofing. It won't stop any attack not based on IP spoofing though.
- MertsA 5y ago
  >or anything that uses TCP (like SYN flooding) Plenty of SYN floods spoof IP as well. If you don't need to get the response, and you're behind an ISP that doesn't bother blocking IP spoofing, why would you use your actual IP? It'll make it much harder to actually trace an attack to the actual device doing it. It won't work on devices behind NAT but neither will reflected UDP attacks.
hirako2000 5y ago
The issue is: bot nets. The attacks come from multiple sources worldwide. No anonymity, rather a swarm of legitimate hosts sending mass;requests. Research and development? Network connections come in, one way or another some devices have to filter them in or out. AFAIK it's an arm race. Large bot nets on one side, and hardware optimised to filter out certain requests on the other. It's a simple technique but requires compromising enough networked resources to make the attack effective. Cloudflare and other providers having large capacities are well armed to deflect DDoS that can't overwhelmed them, but even then, they aren't safe from a larger bot net than what their network resource can handle. If someone knows more than I do, maybe they could elaborate on technologies I'm not aware of.
johnklos 5y ago
Simple - egress filtering: https://en.wikipedia.org/wiki/Egress_filtering https://en.wikipedia.org/wiki/Egress_filtering If every large network operator did this, then shutting down abusive hosts used to generate the kind of traffic needed for attacks like these would be possible. You'd make a list of all the IPs for each large provider from which excess traffic is coming, and you'd send them to each large provider, and they'd either block the IPs completely (requiring customers to fix their compromised machines before they could get back on the Internet), or at very least they would block all traffic to the destination of the attack. Some silly people think this isn't possible, but if large providers are forced to do it, then they can easily tell smaller ones they'll be blocked if they don't also do this, and so on, and we'd have a slightly more responsible Internet again. Too bad we have shitty, huge companies that don't care about doing the right thing :(
- yjftsjthsd-h 5y ago
  > Some silly people think this isn't possible, but if large providers are forced to do it, then they can easily tell smaller ones they'll be blocked if they don't also do this, and so on, and we'd have a slightly more responsible Internet again. > Too bad we have shitty, huge companies that don't care about doing the right thing :( There's no call to be dismissive of anyone who disagrees with you; maybe you're "silly" for believing that companies will threaten each other for no reason (that they care about).
  - Jweb_Guru 5y ago
    Nope, they are basically right and it's a source of endless frustration to security researchers that these very simple problems are still thinks that have to be dealt with in 2021.
  - malikNF 5y ago
    Usually I would agree. But not in this instance. It really is silly some isps are not doing this by default, just fixing this will reduce so many types of ddos attacks. The current size of ddos attacks are just insane. And thabks to these attacks decentralized nature of the internet is eroding everyday.
phkahler 5y ago
>> Since this is HN, it’s 2021 and DDoS’es are still a thing: why are they still a thing? Is there some fundamental “anonymity” to the Internet that makes it impossible to structurally prevent DDoS attacks? IMHO that is exactly what the problem is. Weather its malware, phishing scams, extortion schemes, the fundamental problem is knowing where stuff comes from. I propose an IPv6 subnet that routes by using a portion of the IP address as lat/long coordinates as a starting point because routing tables are litterally a form of indirection.
- yjftsjthsd-h 5y ago
  > an IPv6 subnet that routes by using a portion of the IP address as lat/long coordinates That seems like a rather large privacy problem.
LinuxBender 5y ago
There are many parts to the answer of your question, but one part yet to be implemented in a meaningful manor is BCP38 [1]. The RFC's around BCP38 keep changing and that may be part of the issue. It is still too easy to spoof the source across ISP boundaries. Then of course there is also the issue of getting all the ISP's to work together to detect and mitigate these attacks and that involves cost that the tier 1 providers barely spend towards. There are so many more pieces to this problem and I am barely touching on it. [1] - https://www.rfc-editor.org/info/rfc8704 https://www.rfc-editor.org/info/rfc8704
ev1 5y ago
It isn't anonymity. It's insecurity. Until you fix the human factor, bad code, weak passwords, shitty programming practices and minimum outsourcing to the worst vendors.
nine_k 5y ago
A DDoS attack is indistinguishable from a huge legitimate success. See Slashdot effect [1]. The very problem of a DDoS attack stems from that (1) each request is a small, fully legitimate request and (2) there are too many of them, coming from too many sources for filtering to be efficient. It is also mixed with indistinguishable non-attack requests by your normal customers. So no, even the best authentication would help little. [1]: https://en.wikipedia.org/wiki/Slashdot_effect https://en.wikipedia.org/wiki/Slashdot_effect
- beermonster 5y ago
  And which sometimes happens to sites with limited b/w when they trend on HN.
jl6 5y ago
Imagine the real-world equivalent: someone spreads a rumor that the Fifth Avenue Apple store is giving away free iPhones at 6pm. Ten thousand people turn up and block the store, the sidewalk, the roads… How should a business defend against that without losing legitimate customers? The answer is probably along the lines of “educate people not to believe rumors” (:: “educate people not to run insecure software”).
- smoldesu 5y ago
  How does secure software protect you from acknowledging perfectly innocuous requests?
  - jl6 5y ago
    It’s the zombie-botnet-machine owners who need to be running more secure software, not the botnet victims.
- sumedh 5y ago
  > (:: “educate people not to run insecure software”). Some of these exploits uses zero day attacks, the users cannot do anything.
matheusmoreira 5y ago
You could for example protect all networked computers with single packet authorization. They will ignore all network traffic unless a signed packet is sent first. To the unauthorized it's like the computer is not even there.
- kazen44 5y ago
  this is basically how a vpn tunnel works in some way. (wireguard, ipsec if properly configured etc). it has one, enourmous downside. it destroys reachability to your systems from the population at large because they need to trust some key, which is not universally distributed.
  - matheusmoreira 5y ago
    > it destroys reachability to your systems from the population at large Indeed. Sometimes I think it was never meant to be. We're allowing our computers to talk to untrustworthy strangers. It was always a matter of time before one of them sent a crafted payload... Perhaps computers shouldn't be so reachable. Can't exploit a computer that's not even there, zero days or not.
gxt 5y ago
There are very little consequences. Until states start doing s/sea/internet/g on their old-school maritime piracy laws[0] I don't think anything is going to change, except attacks are gonna get bigger and bigger. Under current law, that's a lifetime sentence in many*(US[1] & Canada[2] at least) countries. It should do the trick if most states get onboard. > Acts of piracy threaten internet security by endangering, in particular, the welfare of internetfarers and the security of navigation and commerce. These criminal acts may result in the loss of life, physical harm or hostage-taking of internetfarers, significant disruptions to commerce and navigation, financial losses to server owners, increased insurance premiums and security costs, increased costs to consumers and producers, and damage to the internet environment. Pirate attacks can have widespread ramifications, including preventing humanitarian assistance and increasing the costs of future connectivity to the affected areas. [0] https://www.un.org/depts/los/piracy/piracy.htm https://www.un.org/depts/los/piracy/piracy.htm [1] https://www.law.cornell.edu/uscode/text/18/1651 https://www.law.cornell.edu/uscode/text/18/1651 [2] https://laws-lois.justice.gc.ca/eng/acts/c-46/page-11.html#s-74ss-(2)ID0EBBA https://laws-lois.justice.gc.ca/eng/acts/c-46/page-11.html#s...
rasz 5y ago
ZERO monetary incentives to deploy technical solutions preventing DDOSes. It would cost additional hardware, manpower, time and PR dealing with disconnected customers. Ignoring the problem lets you offer paid extra protection services.

foobiekr 5y ago

DDOS events typically use distributed botnets. Unless you analyze the CNC you’re probably asking for wide deployment of acls (flow spec or otherwise); and such agreements happen occasionally, as they operationally brutal but are slow (otherwise they would be subject to abuse). You, right now, may be participating in a DDOS attack without knowing it. Should your ISP cut you off based on information from some Belgian ISP?

spenczar5 5y ago

DDoSes come from asymmetries in the difficulty of making a request and providing a response. For example, a classic is the SYN flood. In this, the attacker makes many requests to open TCP connections (with a SYN packet) but does none of the rest of the handshaking. The server does the initial bookkeeping for setting up TCP connections, before eventually timing out and freeing the resources. The SYN packets are very cheap and easy to form (and the attacker can immediately free all the resources after firing them away), but the connection state information is a little bigger. This asymmetry builds up, making the server overloaded. I believe that asymmetries in resource consumption are, at some point, unavoidable. You also asked: > are there any R&D in the pipeline that may kill this type of attack once and for all? Note that DDoS attacks are a class of attacks. They're a description for a broad genre. It's kind of like how "bronchitis" actually just means "enflamed bronchial tubes" - it's a symptom, not a cause. Even if we permanently defeat SYN floods, there are a gazillion other DDoS-type attacks (UDP flooding, messing with ARP tables - its an almost endless list).

ma2rten 5y ago
Yes, but these attacks are actually easy to detect if they all come from the same IP. Sending packages from a lot of different IPs actually is expensive.
- menmob 5y ago
  That’s.. not what a Distributed Denial of Service does. They come from thousands of IPs.
- bravetraveler 5y ago
  That's the first 'D' in DDoS - distributed. Most robots participating in this are unwitting. It's incredibly unlikely someone is paying... even with stolen funds. Often a sort of malware that more or less sits dormant until command/control sends a target to attack edit: To the individual machine, not a lot. The sum total is where the denial of service comes in - everything has a tipping point.
  - Gigachad 5y ago
    These days even peoples iot washing machines are being found to be participating in ddos attacks.
- oneplane 5y ago
  It's not expensive if you have a botnet, reflective attacks or L7 attacks. It's also not just one type of attack (overloading the target), the only thing in common is that it's a denial of service, and if you distribute it amongst many sources it's a distributed denial of service. Distributed can mean different things, especially if you can spoof addresses, in which case you can do fake distribution (causing src based filtering to be useless). If you know it's just a single bad AS that is doing it, then you can block the AS, but if it's distributed amongst multiple AS'es that's harder. Same with reflective attacks, the source of the traffic might not be the source of the attack and might be a legitimate source which you cannot block because your internet wouldn't work anymore (i.e. when it's DNS servers or NTP servers doing the reflection, or a GCN address which would completely take an ISP's section offline). It's not as simple as sending a large volumetric load from A to B. It used to be that way a decade ago and it can be effective today, but it's not the only way it's happening.

lend000 5y ago

With DDoS the problem is that botnets come from a bunch of random devices that were compromised (for example, your un-updated smart TV or old router could be contributing to the DDoS without your knowledge.) With spam calls, ransomware, and most other forms of cybercrime, the problem is that Russia/China and many 3rd world countries don't extradite/cooperate or have the resources to work with international authorities. I sometimes wonder how much safer the internet would be if China and Russia were cut off. Wouldn't be so great for the already poor state of liberty in either country, but the rest of the world would certainly benefit.

ChuckNorris89 5y ago
>Wouldn't be so great for the already poor state of liberty in either country, but the rest of the world would certainly benefit. That's a pretty closed minded way of looking at things.
- google234123 5y ago
  They are already doing it themselves...
- lend000 5y ago
  How so? To me, closed-mindedness is shooting down an idea without a reason or alternative.
deleted 5y ago
[deleted]
Andrew_nenakhov 5y ago
Cutting off countries will do very little. Compromised devices are spread evenly across the globe, and even if their puppeteers sit in China or Russia, you wouldn't be able to block them from issuing orders to botnets.
spenczar5 5y ago
It's true that they often use botnets, but amplification attacks are more and more common, and an important component here. In these, the attacker sends crafted requests to an unwitting third party, and that third party then floods the victim with traffic. DNS amplification is probably the best known, here, since DNS is (usually) over UDP which has no persistent connection for replies: - Send a DNS query to a DNS server, using your victim's IP address as the "source IP" for the query. Make the query something with a huge response, like using "ANY". - DNS server responds to the victim's IP address, sending many big UDP packets with the response. After all, it can't know any better - it must* just trust the claimed source IP! - Victim gets a huge flood of UDP traffic, overwhelming IP-level infrastructure like routers and switches. This lets a relatively small attacker multiply ("amplify") their impact - and they do it while traversing a third party, making them more hidden. --- * If course, there actually are mitigations for this; it's possible to detect this spoofing. But this is how DNS operators have worked in the past.

jjeaff 5y ago

Most/all ddos attacks come from unwitting people whose computers or iot devices have been taken over on the order of tens or hundreds of thousands of devices. So there isn't much that can be done beyond filtering or having a large enough pipeline to absorb the traffic. Even if you had a central authority cutting off access from ip addresses, do you cut off whole university campuses because someone's "smart" coffee machine is participating in a ddos or entire businesses because there is a computer in a closet somewhere that is infected?

mrweasel 5y ago
We talked about this problem when I worked at a telco. The problem isn't necessarily cutting of the devices that are part of the attack, it's dealing with the aftermatch. As sad as it is, most people won't understand that their device have been effected, and the telcos won't be responsible, financially, for paying to do the cleanup or verification.
toxik 5y ago
I feel like home router makers could intervene here and let their owners know when they’ve likely been hacked. Maybe even a regulation type deal?
- logifail 5y ago
  > home router makers could intervene here and let their owners know when they’ve likely been hacked How? A couple of years ago I had an email from our ISP telling me that "common port X is open on your router" (forwarded to a box exactly as I set it up) and asking if I could "fix the problem". Except it wasn't a mistake or a configuration error, I deliberately set it up that way.
- foxfluff 5y ago
  I don't see how this would be feasible without giving them a backdoor to snoop around in my home network. No thanks.
- MertsA 5y ago
  That's never going to work but it very well could lead to ISPs very strongly herding customers to use their own managed routers. They already push for that for customer support purposes, using this to start automatically snooping on "malicious" traffic within a customer's network would be a big step in the wrong direction. You could make a compromise here and require ISPs and network vendors to support a common notification protocol to identify devices sourcing malicious traffic. Most ISPs already have systems in place to send notification messages to customers that are sending botnet traffic. You could mandate it for all of them and let the customer decide if they want their router configured to automatically block a device they were notified about or just record the MAC address and send the ISP a URL the user can visit to view the device sending the traffic. You could make it friendly to the unwashed masses and still put detection on the ISPs and not give them privileged access inside every customer's network.

Arnt 5y ago

It's not that simple. Collecting 250Gbps of uplink is not that simple. The attack vectors are simple in principle, but carrying it out... Here's next year's fine vector: You write a nice iphone or android app and persuade fifty million people to download it. But unknown to the owners of those mobile phones, it also has a hidden evil feature: If the phone has the screen off, is charging and is on a WLAN, then it can participate in a DDoS if you direct them to. The phone's owner won't notice, but if enough phones are charging and each can contribute 2Mbps of upload, you could collect 250Gbps at the target. And tracing it back to that app will be very difficult.

jonplackett 5y ago
Why would it be so hard to trace back?
- johnklos 5y ago
  It wouldn't be hard. If you can examine traffic on a network from which attacking traffic originates, you can see that it's coming from a phone. Then you could see which app by either limiting or deleting apps one at a time, or you'd need two sources, then just see which apps the two sources have in common. When you have 250 Gbps, it'd be simple to capture a fraction of a second's worth of traffic, then write a script to fire off emails to network admins of every IP involved and ask them to look in to it. Out of hundreds or thousands of messages, you'll get a few humans who'd look in to it and would be helpful. I should know, because I've done this very thing.
- Arnt 5y ago
  If your nontechnical neighbour's ISP calls and says "you're participating in a DDoS, will you please find out which device behind your NAT is sending the traffic and fix whatever the problem is", do you think your neighbour can fix it in five minutes?
  - edoceo 5y ago
    They could remote stop the router?

ancarda 5y ago

As far as I know, a lot of DDoS attacks use UDP amplification, which can be prevented if every ISP implements BCP 38; i.e. drop UDP traffic at the edge of their network that has a source that cannot have come from within their network. EDIT: To clarify, this won't stop layer-7 based DDoS attacks, or anything that uses TCP (like SYN flooding). Just UDP amplification.

woutifier 5y ago
BCP 38 would stop SYN flooding if it is using source address spoofing. It won't stop any attack not based on IP spoofing though.
MertsA 5y ago
>or anything that uses TCP (like SYN flooding) Plenty of SYN floods spoof IP as well. If you don't need to get the response, and you're behind an ISP that doesn't bother blocking IP spoofing, why would you use your actual IP? It'll make it much harder to actually trace an attack to the actual device doing it. It won't work on devices behind NAT but neither will reflected UDP attacks.

hirako2000 5y ago

The issue is: bot nets. The attacks come from multiple sources worldwide. No anonymity, rather a swarm of legitimate hosts sending mass;requests. Research and development? Network connections come in, one way or another some devices have to filter them in or out. AFAIK it's an arm race. Large bot nets on one side, and hardware optimised to filter out certain requests on the other. It's a simple technique but requires compromising enough networked resources to make the attack effective. Cloudflare and other providers having large capacities are well armed to deflect DDoS that can't overwhelmed them, but even then, they aren't safe from a larger bot net than what their network resource can handle. If someone knows more than I do, maybe they could elaborate on technologies I'm not aware of.

johnklos 5y ago

Simple - egress filtering: https://en.wikipedia.org/wiki/Egress_filtering https://en.wikipedia.org/wiki/Egress_filtering If every large network operator did this, then shutting down abusive hosts used to generate the kind of traffic needed for attacks like these would be possible. You'd make a list of all the IPs for each large provider from which excess traffic is coming, and you'd send them to each large provider, and they'd either block the IPs completely (requiring customers to fix their compromised machines before they could get back on the Internet), or at very least they would block all traffic to the destination of the attack. Some silly people think this isn't possible, but if large providers are forced to do it, then they can easily tell smaller ones they'll be blocked if they don't also do this, and so on, and we'd have a slightly more responsible Internet again. Too bad we have shitty, huge companies that don't care about doing the right thing :(

yjftsjthsd-h 5y ago
> Some silly people think this isn't possible, but if large providers are forced to do it, then they can easily tell smaller ones they'll be blocked if they don't also do this, and so on, and we'd have a slightly more responsible Internet again. > Too bad we have shitty, huge companies that don't care about doing the right thing :( There's no call to be dismissive of anyone who disagrees with you; maybe you're "silly" for believing that companies will threaten each other for no reason (that they care about).
- Jweb_Guru 5y ago
  Nope, they are basically right and it's a source of endless frustration to security researchers that these very simple problems are still thinks that have to be dealt with in 2021.
- malikNF 5y ago
  Usually I would agree. But not in this instance. It really is silly some isps are not doing this by default, just fixing this will reduce so many types of ddos attacks. The current size of ddos attacks are just insane. And thabks to these attacks decentralized nature of the internet is eroding everyday.

phkahler 5y ago

>> Since this is HN, it’s 2021 and DDoS’es are still a thing: why are they still a thing? Is there some fundamental “anonymity” to the Internet that makes it impossible to structurally prevent DDoS attacks? IMHO that is exactly what the problem is. Weather its malware, phishing scams, extortion schemes, the fundamental problem is knowing where stuff comes from. I propose an IPv6 subnet that routes by using a portion of the IP address as lat/long coordinates as a starting point because routing tables are litterally a form of indirection.

yjftsjthsd-h 5y ago
> an IPv6 subnet that routes by using a portion of the IP address as lat/long coordinates That seems like a rather large privacy problem.

LinuxBender 5y ago

There are many parts to the answer of your question, but one part yet to be implemented in a meaningful manor is BCP38 [1]. The RFC's around BCP38 keep changing and that may be part of the issue. It is still too easy to spoof the source across ISP boundaries. Then of course there is also the issue of getting all the ISP's to work together to detect and mitigate these attacks and that involves cost that the tier 1 providers barely spend towards. There are so many more pieces to this problem and I am barely touching on it. [1] - https://www.rfc-editor.org/info/rfc8704 https://www.rfc-editor.org/info/rfc8704

ev1 5y ago

It isn't anonymity. It's insecurity. Until you fix the human factor, bad code, weak passwords, shitty programming practices and minimum outsourcing to the worst vendors.

nine_k 5y ago

A DDoS attack is indistinguishable from a huge legitimate success. See Slashdot effect [1]. The very problem of a DDoS attack stems from that (1) each request is a small, fully legitimate request and (2) there are too many of them, coming from too many sources for filtering to be efficient. It is also mixed with indistinguishable non-attack requests by your normal customers. So no, even the best authentication would help little. [1]: https://en.wikipedia.org/wiki/Slashdot_effect https://en.wikipedia.org/wiki/Slashdot_effect

beermonster 5y ago
And which sometimes happens to sites with limited b/w when they trend on HN.

jl6 5y ago

Imagine the real-world equivalent: someone spreads a rumor that the Fifth Avenue Apple store is giving away free iPhones at 6pm. Ten thousand people turn up and block the store, the sidewalk, the roads… How should a business defend against that without losing legitimate customers? The answer is probably along the lines of “educate people not to believe rumors” (:: “educate people not to run insecure software”).

smoldesu 5y ago
How does secure software protect you from acknowledging perfectly innocuous requests?
- jl6 5y ago
  It’s the zombie-botnet-machine owners who need to be running more secure software, not the botnet victims.
sumedh 5y ago
> (:: “educate people not to run insecure software”). Some of these exploits uses zero day attacks, the users cannot do anything.

matheusmoreira 5y ago

You could for example protect all networked computers with single packet authorization. They will ignore all network traffic unless a signed packet is sent first. To the unauthorized it's like the computer is not even there.

kazen44 5y ago
this is basically how a vpn tunnel works in some way. (wireguard, ipsec if properly configured etc). it has one, enourmous downside. it destroys reachability to your systems from the population at large because they need to trust some key, which is not universally distributed.
- matheusmoreira 5y ago
  > it destroys reachability to your systems from the population at large Indeed. Sometimes I think it was never meant to be. We're allowing our computers to talk to untrustworthy strangers. It was always a matter of time before one of them sent a crafted payload... Perhaps computers shouldn't be so reachable. Can't exploit a computer that's not even there, zero days or not.

gxt 5y ago

There are very little consequences. Until states start doing s/sea/internet/g on their old-school maritime piracy laws[0] I don't think anything is going to change, except attacks are gonna get bigger and bigger. Under current law, that's a lifetime sentence in many*(US[1] & Canada[2] at least) countries. It should do the trick if most states get onboard. > Acts of piracy threaten internet security by endangering, in particular, the welfare of internetfarers and the security of navigation and commerce. These criminal acts may result in the loss of life, physical harm or hostage-taking of internetfarers, significant disruptions to commerce and navigation, financial losses to server owners, increased insurance premiums and security costs, increased costs to consumers and producers, and damage to the internet environment. Pirate attacks can have widespread ramifications, including preventing humanitarian assistance and increasing the costs of future connectivity to the affected areas. [0] https://www.un.org/depts/los/piracy/piracy.htm https://www.un.org/depts/los/piracy/piracy.htm [1] https://www.law.cornell.edu/uscode/text/18/1651 https://www.law.cornell.edu/uscode/text/18/1651 [2] https://laws-lois.justice.gc.ca/eng/acts/c-46/page-11.html#s-74ss-(2)ID0EBBA https://laws-lois.justice.gc.ca/eng/acts/c-46/page-11.html#s...

rasz 5y ago

ZERO monetary incentives to deploy technical solutions preventing DDOSes. It would cost additional hardware, manpower, time and PR dealing with disconnected customers. Ignoring the problem lets you offer paid extra protection services.