4 ms·
With DDoS the problem is that botnets come from a bunch of random devices that were compromised (for example, your un-updated smart TV or old router could be co
by lend000 5y ago
With DDoS the problem is that botnets come from a bunch of random devices that were compromised (for example, your un-updated smart TV or old router could be contributing to the DDoS without your knowledge.)
With spam calls, ransomware, and most other forms of cybercrime, the problem is that Russia/China and many 3rd world countries don't extradite/cooperate or have the resources to work with international authorities.
I sometimes wonder how much safer the internet would be if China and Russia were cut off. Wouldn't be so great for the already poor state of liberty in either country, but the rest of the world would certainly benefit.
- ChuckNorris89 5y ago>Wouldn't be so great for the already poor state of liberty in either country, but the rest of the world would certainly benefit. That's a pretty closed minded way of looking at things.
- google234123 5y agoThey are already doing it themselves...
- lend000 5y agoHow so? To me, closed-mindedness is shooting down an idea without a reason or alternative.
- deleted 5y ago[deleted]
- Andrew_nenakhov 5y agoCutting off countries will do very little. Compromised devices are spread evenly across the globe, and even if their puppeteers sit in China or Russia, you wouldn't be able to block them from issuing orders to botnets.
- spenczar5 5y agoIt's true that they often use botnets, but amplification attacks are more and more common, and an important component here. In these, the attacker sends crafted requests to an unwitting third party, and that third party then floods the victim with traffic. DNS amplification is probably the best known, here, since DNS is (usually) over UDP which has no persistent connection for replies: - Send a DNS query to a DNS server, using your victim's IP address as the "source IP" for the query. Make the query something with a huge response, like using "ANY". - DNS server responds to the victim's IP address, sending many big UDP packets with the response. After all, it can't know any better - it must* just trust the claimed source IP! - Victim gets a huge flood of UDP traffic, overwhelming IP-level infrastructure like routers and switches. This lets a relatively small attacker multiply ("amplify") their impact - and they do it while traversing a third party, making them more hidden. --- * If course, there actually are mitigations for this; it's possible to detect this spoofing. But this is how DNS operators have worked in the past.
- jansimonek 5y ago"without your knowledge"... is there a way to check if my IP was participating in the DDoS? If they are filtering the traffic, they might be able to create a list of IPs that I can check. Or perhaps, an IP can be associated with a contact info so the if any of my devices would be infected and participate in DDoS, I would get notified by the victim and could take action.
- NicoJuicy 5y agoThat's the reason why my nextdns blocks all .ru and .ch domains. I don't trust them + i don't speak the language. So entirely blocking it is an easy decision. Nextdns on my router blocks generated domains, which could be used against c&c servers.
- edflsafoiewq 5y ago> the rest of the world would certainly benefit OTOH most pirate library sites are hosted in those countries for the same reason.