6 ms·

DDoSes come from asymmetries in the difficulty of making a request and providing a response. For example, a classic is the SYN flood. In this, the attacker mak

DDoSes come from asymmetries in the difficulty of making a request and providing a response. For example, a classic is the SYN flood. In this, the attacker makes many requests to open TCP connections (with a SYN packet) but does none of the rest of the handshaking. The server does the initial bookkeeping for setting up TCP connections, before eventually timing out and freeing the resources. The SYN packets are very cheap and easy to form (and the attacker can immediately free all the resources after firing them away), but the connection state information is a little bigger. This asymmetry builds up, making the server overloaded. I believe that asymmetries in resource consumption are, at some point, unavoidable. You also asked: > are there any R&D in the pipeline that may kill this type of attack once and for all? Note that DDoS attacks are a class of attacks. They're a description for a broad genre. It's kind of like how "bronchitis" actually just means "enflamed bronchial tubes" - it's a symptom, not a cause. Even if we permanently defeat SYN floods, there are a gazillion other DDoS-type attacks (UDP flooding, messing with ARP tables - its an almost endless list).

ma2rten 5y ago
Yes, but these attacks are actually easy to detect if they all come from the same IP. Sending packages from a lot of different IPs actually is expensive.
- menmob 5y ago
  That’s.. not what a Distributed Denial of Service does. They come from thousands of IPs.
- bravetraveler 5y ago
  That's the first 'D' in DDoS - distributed. Most robots participating in this are unwitting. It's incredibly unlikely someone is paying... even with stolen funds. Often a sort of malware that more or less sits dormant until command/control sends a target to attack edit: To the individual machine, not a lot. The sum total is where the denial of service comes in - everything has a tipping point.
  - Gigachad 5y ago
    These days even peoples iot washing machines are being found to be participating in ddos attacks.
- oneplane 5y ago
  It's not expensive if you have a botnet, reflective attacks or L7 attacks. It's also not just one type of attack (overloading the target), the only thing in common is that it's a denial of service, and if you distribute it amongst many sources it's a distributed denial of service. Distributed can mean different things, especially if you can spoof addresses, in which case you can do fake distribution (causing src based filtering to be useless). If you know it's just a single bad AS that is doing it, then you can block the AS, but if it's distributed amongst multiple AS'es that's harder. Same with reflective attacks, the source of the traffic might not be the source of the attack and might be a legitimate source which you cannot block because your internet wouldn't work anymore (i.e. when it's DNS servers or NTP servers doing the reflection, or a GCN address which would completely take an ISP's section offline). It's not as simple as sending a large volumetric load from A to B. It used to be that way a decade ago and it can be effective today, but it's not the only way it's happening.
- alasdair_ 5y ago
  The attacks come from (up to) millions of different ip addresses, each one a different machine and often on a residential network. This is the problem with botnets - all the connections look like real traffic at first glance.
- MrStonedOne 5y ago
  The src ip can be spoofed and randomized if you don't care about getting the response (and to some degree, you care more about not getting it)
vladf 5y ago
Why is this resource asymmetry unavoidable? It seems reasonable that a new protocol could solve it. Consider augmenting TCP with a "pre-SYN" and "pre-SYNACK". Suppose you have to send a pre-SYN which declares your identity ip X. Then the server sends to X a "pre-SYNACK" encrypted message containing (X, t = timestamp()) based on a server-only key. Afterwards, X may send the server a SYN for real. But then the server only allows a timeout of length, say, timestamp() - t, as of receiving the SYN back to maintain bookkeeping. As benevolent cooperating clients, we may want to ourselves wait an exponentially-backed-off amount between receiving the pre-SYNACK from the server and sending our SYN back (such that in log-many rounds we establish our conn). Then any malevolent actor must then keep a resource on X alive for at least half long as the server does (since the server requires zero bookkeeping after firing off the pre-SYNACK). Edit: this is simplified, you could just own a machine at X which is far away from the ddos'd server and then have your botnet spoof requests from X; by augmenting this procedure with even more preamble rounds you could verify how long communication takes between the server and client X and subtract that out.
- jcrawfordor 5y ago
  This method is basically already in use for DOS mitigation using a technique called a SYN cookie. But as the parent said, there is a huge spectrum of different ways to produce a DOS and so there is no single method of addressing them. The problem tends to be much harder as you get to higher levels, for example, requesting things from an HTTP server - there are mitigations available there as well such as Cloudflare's approach of capturing DoS like requests and subjecting them to CAPTCHA, but once again no one size fits all.
  - vladf 5y ago
    I guess the problem is "simply" the use of these resource-asymmetric protocols. As a server-owner, if there was a robust alternative protocol which ensured resource symmetry, wouldn't you be naturally incentivized to adopt it and reject all asymmetric ones? It still feels like there's a way of specifying a protocol (which of course would need to be adopted) where (1) authentication is a first-class entity (2) all non-authenticated requests enforce resource symmetry at the protocol level, while still allowing asymmetric work to be done (after a resource-symmetric auth). Edit: augmenting the rough outline of what I originally proposed you can essentially require an arbitrary amount of proof-of-work, however useless, on the requester side (e.g., literally request a nonce such that the hash of the packet is below some value). Since only auth needs to be symmetric the overhead doesn't seem too bad.
nickthemagicman 5y ago
Seems like that's another benefit of IPv6. Without needing NAT everyone can have their own IP address and biz will be able to ban individual machines instead of some giant NAT Network because one host using that IP address is compromised.
- laurensr 5y ago
  Doesn't it also mean addresses serving as the source of an attack become more disposable?
  - nickthemagicman 5y ago
    The hackers still have to compromise the host right?
- MrStonedOne 5y ago
  if you are sending packets but don't care about the reply, you can spoof the from header. The other form of ddos is udp amplification. you send a packet to a legit host and spoof the target ip as the from ip, the reply goes to your target and bam, ddos.
  - kazen44 5y ago
    this could be solved in ipv6 by implementing ipsec in AH mode.
  - nickthemagicman 5y ago
    Yep but that never opens a full connection. You can filter on hosts who dont respond to an ACK after a certain amount of fails. Most machines don't have UDP services open to accept packets.
    - MrStonedOne 5y ago
      all machines need udp opened to get response from ntp and dns. moving these to tcp would actually seriously help with filtering ddos, but good luck.
stingraycharles 5y ago
> Note that DDoS attacks are a class of attacks. They're a description for a broad genre. While they may be a class of attacks, I would describe all of them as undesired requests. Sometimes, with some clever protocol design, you can, in fact, mitigate a whole class of problems.
bullen 5y ago
But why can't you just block the offending IPs in iptables? My router has some SYN flood protection is that useful at all? High level these kind of attacks must be easily fixable, just remove the offending IPs of the countrys internet for a set amount of time... easy peasy.
- pvtmert 5y ago
  The first 'D' of DDoS means distributed. Which means it is so broad. If you unplug yourself from the internet, yes you can block them... Also blackholing them like this won't be useful. Since attack is comming from multiple zombie clients (hundreds of thousands) and current internet structure is using IPv4 with CGNAT, you would block tens of millions of legitimate users at the expense of a small percentage. Edit: Also, even though you blackhole them within your iptables, packages are still coming to you (routed) and filling up the bandwidth whether you like it or not. And you pay your peers according to bandwidth you use. (eg. bytes in and out per month) So, a proper solution is to use globally distributed system to broadcast specific routes so the attack gets stopped even before it reaches you. (eg. through their own ISP's route table blackholing your routes) But that means legit users from that ISP wont be able to access your network at all...

ma2rten 5y ago

Yes, but these attacks are actually easy to detect if they all come from the same IP. Sending packages from a lot of different IPs actually is expensive.

menmob 5y ago
That’s.. not what a Distributed Denial of Service does. They come from thousands of IPs.
bravetraveler 5y ago
That's the first 'D' in DDoS - distributed. Most robots participating in this are unwitting. It's incredibly unlikely someone is paying... even with stolen funds. Often a sort of malware that more or less sits dormant until command/control sends a target to attack edit: To the individual machine, not a lot. The sum total is where the denial of service comes in - everything has a tipping point.
- Gigachad 5y ago
  These days even peoples iot washing machines are being found to be participating in ddos attacks.
oneplane 5y ago
It's not expensive if you have a botnet, reflective attacks or L7 attacks. It's also not just one type of attack (overloading the target), the only thing in common is that it's a denial of service, and if you distribute it amongst many sources it's a distributed denial of service. Distributed can mean different things, especially if you can spoof addresses, in which case you can do fake distribution (causing src based filtering to be useless). If you know it's just a single bad AS that is doing it, then you can block the AS, but if it's distributed amongst multiple AS'es that's harder. Same with reflective attacks, the source of the traffic might not be the source of the attack and might be a legitimate source which you cannot block because your internet wouldn't work anymore (i.e. when it's DNS servers or NTP servers doing the reflection, or a GCN address which would completely take an ISP's section offline). It's not as simple as sending a large volumetric load from A to B. It used to be that way a decade ago and it can be effective today, but it's not the only way it's happening.
alasdair_ 5y ago
The attacks come from (up to) millions of different ip addresses, each one a different machine and often on a residential network. This is the problem with botnets - all the connections look like real traffic at first glance.
MrStonedOne 5y ago
The src ip can be spoofed and randomized if you don't care about getting the response (and to some degree, you care more about not getting it)

vladf 5y ago

Why is this resource asymmetry unavoidable? It seems reasonable that a new protocol could solve it. Consider augmenting TCP with a "pre-SYN" and "pre-SYNACK". Suppose you have to send a pre-SYN which declares your identity ip X. Then the server sends to X a "pre-SYNACK" encrypted message containing (X, t = timestamp()) based on a server-only key. Afterwards, X may send the server a SYN for real. But then the server only allows a timeout of length, say, timestamp() - t, as of receiving the SYN back to maintain bookkeeping. As benevolent cooperating clients, we may want to ourselves wait an exponentially-backed-off amount between receiving the pre-SYNACK from the server and sending our SYN back (such that in log-many rounds we establish our conn). Then any malevolent actor must then keep a resource on X alive for at least half long as the server does (since the server requires zero bookkeeping after firing off the pre-SYNACK). Edit: this is simplified, you could just own a machine at X which is far away from the ddos'd server and then have your botnet spoof requests from X; by augmenting this procedure with even more preamble rounds you could verify how long communication takes between the server and client X and subtract that out.

jcrawfordor 5y ago
This method is basically already in use for DOS mitigation using a technique called a SYN cookie. But as the parent said, there is a huge spectrum of different ways to produce a DOS and so there is no single method of addressing them. The problem tends to be much harder as you get to higher levels, for example, requesting things from an HTTP server - there are mitigations available there as well such as Cloudflare's approach of capturing DoS like requests and subjecting them to CAPTCHA, but once again no one size fits all.
- vladf 5y ago
  I guess the problem is "simply" the use of these resource-asymmetric protocols. As a server-owner, if there was a robust alternative protocol which ensured resource symmetry, wouldn't you be naturally incentivized to adopt it and reject all asymmetric ones? It still feels like there's a way of specifying a protocol (which of course would need to be adopted) where (1) authentication is a first-class entity (2) all non-authenticated requests enforce resource symmetry at the protocol level, while still allowing asymmetric work to be done (after a resource-symmetric auth). Edit: augmenting the rough outline of what I originally proposed you can essentially require an arbitrary amount of proof-of-work, however useless, on the requester side (e.g., literally request a nonce such that the hash of the packet is below some value). Since only auth needs to be symmetric the overhead doesn't seem too bad.

nickthemagicman 5y ago

Seems like that's another benefit of IPv6. Without needing NAT everyone can have their own IP address and biz will be able to ban individual machines instead of some giant NAT Network because one host using that IP address is compromised.

laurensr 5y ago
Doesn't it also mean addresses serving as the source of an attack become more disposable?
- nickthemagicman 5y ago
  The hackers still have to compromise the host right?
MrStonedOne 5y ago
if you are sending packets but don't care about the reply, you can spoof the from header. The other form of ddos is udp amplification. you send a packet to a legit host and spoof the target ip as the from ip, the reply goes to your target and bam, ddos.
- kazen44 5y ago
  this could be solved in ipv6 by implementing ipsec in AH mode.
- nickthemagicman 5y ago
  Yep but that never opens a full connection. You can filter on hosts who dont respond to an ACK after a certain amount of fails. Most machines don't have UDP services open to accept packets.
  - MrStonedOne 5y ago
    all machines need udp opened to get response from ntp and dns. moving these to tcp would actually seriously help with filtering ddos, but good luck.

stingraycharles 5y ago

> Note that DDoS attacks are a class of attacks. They're a description for a broad genre. While they may be a class of attacks, I would describe all of them as undesired requests. Sometimes, with some clever protocol design, you can, in fact, mitigate a whole class of problems.

bullen 5y ago

But why can't you just block the offending IPs in iptables? My router has some SYN flood protection is that useful at all? High level these kind of attacks must be easily fixable, just remove the offending IPs of the countrys internet for a set amount of time... easy peasy.

pvtmert 5y ago
The first 'D' of DDoS means distributed. Which means it is so broad. If you unplug yourself from the internet, yes you can block them... Also blackholing them like this won't be useful. Since attack is comming from multiple zombie clients (hundreds of thousands) and current internet structure is using IPv4 with CGNAT, you would block tens of millions of legitimate users at the expense of a small percentage. Edit: Also, even though you blackhole them within your iptables, packages are still coming to you (routed) and filling up the bandwidth whether you like it or not. And you pay your peers according to bandwidth you use. (eg. bytes in and out per month) So, a proper solution is to use globally distributed system to broadcast specific routes so the attack gets stopped even before it reaches you. (eg. through their own ISP's route table blackholing your routes) But that means legit users from that ISP wont be able to access your network at all...