3 ms·

Yes, but these attacks are actually easy to detect if they all come from the same IP. Sending packages from a lot of different IPs actually is expensive.

menmob 5y ago
That’s.. not what a Distributed Denial of Service does. They come from thousands of IPs.
bravetraveler 5y ago
That's the first 'D' in DDoS - distributed. Most robots participating in this are unwitting. It's incredibly unlikely someone is paying... even with stolen funds. Often a sort of malware that more or less sits dormant until command/control sends a target to attack edit: To the individual machine, not a lot. The sum total is where the denial of service comes in - everything has a tipping point.
- Gigachad 5y ago
  These days even peoples iot washing machines are being found to be participating in ddos attacks.
oneplane 5y ago
It's not expensive if you have a botnet, reflective attacks or L7 attacks. It's also not just one type of attack (overloading the target), the only thing in common is that it's a denial of service, and if you distribute it amongst many sources it's a distributed denial of service. Distributed can mean different things, especially if you can spoof addresses, in which case you can do fake distribution (causing src based filtering to be useless). If you know it's just a single bad AS that is doing it, then you can block the AS, but if it's distributed amongst multiple AS'es that's harder. Same with reflective attacks, the source of the traffic might not be the source of the attack and might be a legitimate source which you cannot block because your internet wouldn't work anymore (i.e. when it's DNS servers or NTP servers doing the reflection, or a GCN address which would completely take an ISP's section offline). It's not as simple as sending a large volumetric load from A to B. It used to be that way a decade ago and it can be effective today, but it's not the only way it's happening.
alasdair_ 5y ago
The attacks come from (up to) millions of different ip addresses, each one a different machine and often on a residential network. This is the problem with botnets - all the connections look like real traffic at first glance.
MrStonedOne 5y ago
The src ip can be spoofed and randomized if you don't care about getting the response (and to some degree, you care more about not getting it)

menmob 5y ago

That’s.. not what a Distributed Denial of Service does. They come from thousands of IPs.

bravetraveler 5y ago

That's the first 'D' in DDoS - distributed. Most robots participating in this are unwitting. It's incredibly unlikely someone is paying... even with stolen funds. Often a sort of malware that more or less sits dormant until command/control sends a target to attack edit: To the individual machine, not a lot. The sum total is where the denial of service comes in - everything has a tipping point.

Gigachad 5y ago
These days even peoples iot washing machines are being found to be participating in ddos attacks.

oneplane 5y ago

It's not expensive if you have a botnet, reflective attacks or L7 attacks. It's also not just one type of attack (overloading the target), the only thing in common is that it's a denial of service, and if you distribute it amongst many sources it's a distributed denial of service. Distributed can mean different things, especially if you can spoof addresses, in which case you can do fake distribution (causing src based filtering to be useless). If you know it's just a single bad AS that is doing it, then you can block the AS, but if it's distributed amongst multiple AS'es that's harder. Same with reflective attacks, the source of the traffic might not be the source of the attack and might be a legitimate source which you cannot block because your internet wouldn't work anymore (i.e. when it's DNS servers or NTP servers doing the reflection, or a GCN address which would completely take an ISP's section offline). It's not as simple as sending a large volumetric load from A to B. It used to be that way a decade ago and it can be effective today, but it's not the only way it's happening.

alasdair_ 5y ago

The attacks come from (up to) millions of different ip addresses, each one a different machine and often on a residential network. This is the problem with botnets - all the connections look like real traffic at first glance.

MrStonedOne 5y ago

The src ip can be spoofed and randomized if you don't care about getting the response (and to some degree, you care more about not getting it)