6 ms·

What is with ddos these days? Are they doing it for money ? It just seems silly with services like cloud flare

catlikesshrimp 5y ago
You can hire a ddos agaisnt your across the street competitor. It could be the other pizzeria, the other hardwareshop. Use your imagination
- short12 5y ago
  That used to be a thing but is it anymore? There is so much mitigation so it's pretty much ineffective
  - nightfly 5y ago
    Not everyone has mitigation. If you know your competitor is hosted by a small hosting outfit you can get them banned from their webhost by directing a DOS attack at them.
  - gavinray 5y ago
    It's even worse nowadays than it used to be, due to "Serverless" and "Infinite Scalability"/"Auto-scaling". One of the most fascinating things I've read recently is the rise of "Denial-of-Capital" attacks. Essentially, you DDoS a competitor, but not directly in the interest of just taking them offline. Instead (hopefully) running up a massive cloud bill and putting them out of business. Or a similarly critical financial hit. If you don't have billing limits enforced for all of your services, and you run auto-scale/serverless workloads in any part -- if someone can pass enough traffic to your services they can cause you potentially incredible financial grief. Most recent (publicized) one I can think of is this one. Fathom Analytics attacks: https://news.ycombinator.com/item?id=25194795 https://news.ycombinator.com/item?id=25194795 There was an initial cloud bill, but now they're paying $3,000/mo for AWS to have a Cloud Protection team on standby for them. "$36,000 & my call with Fola" "I don’t know anybody who has signed up for this $3,000/month service from AWS… it’s called AWS Shield Advanced. The big value of this service to us is that we have access to some of the world’s best DDoS mitigation experts. In the event of an attack, we can page them, and they’ll help us mitigate the attack, creating firewall rules, identifying bad actors, and offering advice. So instead of just two of us responding to DDoS attacks, we have genius engineers we can speak with, and that feels good." Ouch.
    - aliswe 5y ago
      no such thing as billing limit in Azure, anyway.
      - NullPrefix 5y ago
        As if anyone signing up for Azure care about pricing.
  - goodpoint 5y ago
    Ineffective? It fuels cloudflare's business model.
    - aliswe 5y ago
      what business model? cloudflare basic ddos protection is free
      - goodpoint 5y ago
        Cornering the whole internet is their business model. Besides, advanced DDoS protection is paid.
1270018080 5y ago
If you have that much computing power at your disposal, you might as well just mine cryptocurrency, right?
- codsane 5y ago
  Not necessarily as this is Mirai, a botnet of IoT devices. There’s probably not much else you could do with them.
- remram 5y ago
  You can probably do both at the same time, as cryptocurrency uses a lot of CPU/GPU/memory/... but little bandwidth, and DDoS typically uses bandwidth but little CPU/GPU/memory/...

You can hire a ddos agaisnt your across the street competitor. It could be the other pizzeria, the other hardwareshop. Use your imagination

short12 5y ago
That used to be a thing but is it anymore? There is so much mitigation so it's pretty much ineffective
- nightfly 5y ago
  Not everyone has mitigation. If you know your competitor is hosted by a small hosting outfit you can get them banned from their webhost by directing a DOS attack at them.
- gavinray 5y ago
  It's even worse nowadays than it used to be, due to "Serverless" and "Infinite Scalability"/"Auto-scaling". One of the most fascinating things I've read recently is the rise of "Denial-of-Capital" attacks. Essentially, you DDoS a competitor, but not directly in the interest of just taking them offline. Instead (hopefully) running up a massive cloud bill and putting them out of business. Or a similarly critical financial hit. If you don't have billing limits enforced for all of your services, and you run auto-scale/serverless workloads in any part -- if someone can pass enough traffic to your services they can cause you potentially incredible financial grief. Most recent (publicized) one I can think of is this one. Fathom Analytics attacks: https://news.ycombinator.com/item?id=25194795 https://news.ycombinator.com/item?id=25194795 There was an initial cloud bill, but now they're paying $3,000/mo for AWS to have a Cloud Protection team on standby for them. "$36,000 & my call with Fola" "I don’t know anybody who has signed up for this $3,000/month service from AWS… it’s called AWS Shield Advanced. The big value of this service to us is that we have access to some of the world’s best DDoS mitigation experts. In the event of an attack, we can page them, and they’ll help us mitigate the attack, creating firewall rules, identifying bad actors, and offering advice. So instead of just two of us responding to DDoS attacks, we have genius engineers we can speak with, and that feels good." Ouch.
  - aliswe 5y ago
    no such thing as billing limit in Azure, anyway.
    - NullPrefix 5y ago
      As if anyone signing up for Azure care about pricing.
- goodpoint 5y ago
  Ineffective? It fuels cloudflare's business model.
  - aliswe 5y ago
    what business model? cloudflare basic ddos protection is free
    - goodpoint 5y ago
      Cornering the whole internet is their business model. Besides, advanced DDoS protection is paid.

1270018080 5y ago

If you have that much computing power at your disposal, you might as well just mine cryptocurrency, right?

codsane 5y ago
Not necessarily as this is Mirai, a botnet of IoT devices. There’s probably not much else you could do with them.
remram 5y ago
You can probably do both at the same time, as cryptocurrency uses a lot of CPU/GPU/memory/... but little bandwidth, and DDoS typically uses bandwidth but little CPU/GPU/memory/...