5 ms·

That article is completely wrong. Misconfigured servers that amplify traffic are not a problem at all. Blacklisting all of them would take no morethan several h

That article is completely wrong. Misconfigured servers that amplify traffic are not a problem at all. Blacklisting all of them would take no morethan several hours. The problem is that there is no protocol for rejecting traffic. That's why DDOS is so easy and successful. If you are a website you cannot send a message to uplink saying "I don't want traffic from this network". So small and large ISPs do nothing to help protect victims and make it easy for criminals to extort money.

lucb1e 4y ago
This sort of thing is being done as far as I know, but I'm not aware how big a customer you have to be for your ISP to care about such notices. Perhaps so large that you've nearly got enough capacity to handle the traffic yourself anyway. It also creates a nice DoS vector: if I want to not take an exam today, I'll just do a little ping flood from the school network and get banned for a while. Similar to account locking on 3 invalid attempts, except now you can block everyone at once as soon as you're in the network or on the same ISP.
- somehnguy 4y ago
  As a small customer I’ve experienced them doing the complete opposite. I’ve had a 1u collocated at one center or another for the last ~15 years and occasionally we would be the target of a DDoS. The data center would just blackhole us until things calmed down. It’s better than a surprise bandwidth bill but certainly not great.
  - toast0 4y ago
    FWIW, that's what happens for large customers too, from my past experience. Someone aims the DDoS cannon at one of our webservers [1], and if the traffic is above the threshold, that server's IP gets blackholed for a while. As a large customer, you do get to have some input into the thresholds, and how long the blackholes are, and to definitely have traffic blackholed rather than put through some crazy filtering apparatus that adds so much latency it'd be better to drop everything. OTOH, we always had at least 4 webservers, so if just one got blackholed, no big deal, update DNS so most of the real users make it to the available servers, most of the abusers will keep hitting the blackholed server and not move on. If your abusers aren't run of the mill script kiddies using a rent-a-ddos service, it's more difficult. [1] it's almost always the webservers, not the servers that do real work
    - lucb1e 4y ago
      How large is a large customer here? Paying the hosting company monthly bills on the order of 1k, 10k, 100k? I expected this to only affect small and medium businesses, so I'm genuinely curious what qualifies as large but is still affected. (My security consultancy work only tangentially touches upon DDoS, so I know a thing or two but am not actually in this business.)
      - toast0 4y ago
        My experience is a bit old at this point, and I don't remember quite where exactly we were when we got to have a meaningful conversation on getting the blackhole settings set to reasonable values [1], but our bills were at the high end of your range, and we were a top 5 customer at some point. For us though, getting one server blackholed every so often wasn't that big of a deal, so as long as everything was managed reasonably, and the ticketing was timely so we didn't spend a lot of time trying to figure out why server X wasn't working when it was just a blackhole from DDoS. A clever abuser could have caused a lot more trouble, but clever people tend to find more productive things to do. [1] don't blackhole unless the traffic rate exceeds line rate (which topped out at 2x 10G), retest after 1 hour instead of 24 hours for the first retest, etc.
  - lucb1e 4y ago
    Ah yes, I know those stories as well. I found that surprising also, but it seems to stem from the botnet era where there were thousands upon thousands of originating networks instead of some big (DNS) servers. The practice is still in place though, especially at some cheap hosting providers.
  - codedokode 4y ago
    So basically the data center took the side of the criminals.
    - dizhn 4y ago
      It is sort of a common practice to get rid of "problem" customers too.
      - somehnguy 4y ago
        We ran a pretty large Counterstrike gaming community with public servers, and did some very small scale paid server hosting on the side. It's unfortunate that anyone would consider us "problem" customers because DDoS attacks are so easily performed by script kiddies. It can happen to anyone hosting public resources that aren't easily filtered through no fault of their own. I totally understand what you're saying though.
  - justsomehnguy 4y ago
    Because that makes incoming traffic not to come to them at all. Traffic costs money and usually much more than a single 1U colo cost. BTW nice username
    - somehnguy 4y ago
      No doubt, we weren't able to pony up the cost difference to cover the bandwidth in cases like this so I get why this was their move. You have a nice username as well!
- codedokode 4y ago
  > but I'm not aware how big a customer you have to be for your ISP to care about such notices So basically ISP don't want to do anything to prevent misuse of their infrastructure because it is more profitable this way. > It also creates a nice DoS vector: if I want to not take an exam today, I'll just do a little ping flood from the school network and get banned for a while. The idea is that you can only block traffic going from school network to your site, but not any other traffic from that network.
dagenix 4y ago
The argument is that the servers aren't a problem - the problem is that we don't have a protocol to block them. Of course, we wouldn't need a protocol to block them if they weren't a problem. I'm very confused by this argument.
- admax88qqq 4y ago
  "X isn't the problem, Y is" is the overconfident way of saying "Y is a better solution to the problem"
- cypress66 4y ago
  Misconfigured servers that can amplify are only one way to DDoS attack. Even if this wasn't a problem you would still have all the other ways to DDoS, which you could handle easier if you could actually block the traffic. So yes, we would still need that protocol.
112233 4y ago
You mean something like RFC5575? That actually exists and is in use.
stevewatson301 4y ago
There are protocols in development at the NIST such as Named Data Networking[1] that implement such a scheme through flow balance and interests. [1] https://en.wikipedia.org/wiki/Named_data_networking https://en.wikipedia.org/wiki/Named_data_networking
- dylan604 4y ago
  and the public does what for the next 20 years before that reaches beta stage?
brian-armstrong 4y ago
Also, hosting vendors that allow customers to spoof source IPs. BCP38 would nicely fix all of that and most reputable hosting providers have it, but all it takes is a few to not use it to give this possibility.
Thorrez 4y ago
You're saying the solution is to have every website in existence find all these IPs and then request that their ISP block them? That sounds like a lot of work. Sure it's a good idea to allow requesting the blocks. But changing the reflection sources themselves so they can't be used for reflection anymore is also a good idea.
drran 4y ago
So, government will be able to silent anybody anywhere in the Internet just by using standard protocol. A Great World Wide Firewall.
- codedokode 4y ago
  They will be able to do it only for their citizens and they can do it already.
croes 4y ago
Misconfigured servers are the basis of multiple problems not just DDoS attacks. A new protocol only knocks off one head of the hydra, but does not solve the real problem.
raverbashing 4y ago
The article is correct and MS is at fault here (also per the comment there) "The problem is that the non-exisiting solution doesn't exist" - ok then
Gordonjcp 4y ago
You're wrong. Swap "spam" for "DDoS" in the following. https://craphound.com/spamsolutions.txt https://craphound.com/spamsolutions.txt
deleted 4y ago
[deleted]
jasonwatkinspdx 4y ago
BGP blackholeing is used routinely.
tinus_hn 4y ago
So now uplinks are going to maintain lists of networks you don’t want traffic from. How do you imagine this is going to work with IPv6? It requires unbounded amounts of memory and processing power.

lucb1e 4y ago

This sort of thing is being done as far as I know, but I'm not aware how big a customer you have to be for your ISP to care about such notices. Perhaps so large that you've nearly got enough capacity to handle the traffic yourself anyway. It also creates a nice DoS vector: if I want to not take an exam today, I'll just do a little ping flood from the school network and get banned for a while. Similar to account locking on 3 invalid attempts, except now you can block everyone at once as soon as you're in the network or on the same ISP.

somehnguy 4y ago
As a small customer I’ve experienced them doing the complete opposite. I’ve had a 1u collocated at one center or another for the last ~15 years and occasionally we would be the target of a DDoS. The data center would just blackhole us until things calmed down. It’s better than a surprise bandwidth bill but certainly not great.
- toast0 4y ago
  FWIW, that's what happens for large customers too, from my past experience. Someone aims the DDoS cannon at one of our webservers [1], and if the traffic is above the threshold, that server's IP gets blackholed for a while. As a large customer, you do get to have some input into the thresholds, and how long the blackholes are, and to definitely have traffic blackholed rather than put through some crazy filtering apparatus that adds so much latency it'd be better to drop everything. OTOH, we always had at least 4 webservers, so if just one got blackholed, no big deal, update DNS so most of the real users make it to the available servers, most of the abusers will keep hitting the blackholed server and not move on. If your abusers aren't run of the mill script kiddies using a rent-a-ddos service, it's more difficult. [1] it's almost always the webservers, not the servers that do real work
  - lucb1e 4y ago
    How large is a large customer here? Paying the hosting company monthly bills on the order of 1k, 10k, 100k? I expected this to only affect small and medium businesses, so I'm genuinely curious what qualifies as large but is still affected. (My security consultancy work only tangentially touches upon DDoS, so I know a thing or two but am not actually in this business.)
    - toast0 4y ago
      My experience is a bit old at this point, and I don't remember quite where exactly we were when we got to have a meaningful conversation on getting the blackhole settings set to reasonable values [1], but our bills were at the high end of your range, and we were a top 5 customer at some point. For us though, getting one server blackholed every so often wasn't that big of a deal, so as long as everything was managed reasonably, and the ticketing was timely so we didn't spend a lot of time trying to figure out why server X wasn't working when it was just a blackhole from DDoS. A clever abuser could have caused a lot more trouble, but clever people tend to find more productive things to do. [1] don't blackhole unless the traffic rate exceeds line rate (which topped out at 2x 10G), retest after 1 hour instead of 24 hours for the first retest, etc.
- lucb1e 4y ago
  Ah yes, I know those stories as well. I found that surprising also, but it seems to stem from the botnet era where there were thousands upon thousands of originating networks instead of some big (DNS) servers. The practice is still in place though, especially at some cheap hosting providers.
- codedokode 4y ago
  So basically the data center took the side of the criminals.
  - dizhn 4y ago
    It is sort of a common practice to get rid of "problem" customers too.
    - somehnguy 4y ago
      We ran a pretty large Counterstrike gaming community with public servers, and did some very small scale paid server hosting on the side. It's unfortunate that anyone would consider us "problem" customers because DDoS attacks are so easily performed by script kiddies. It can happen to anyone hosting public resources that aren't easily filtered through no fault of their own. I totally understand what you're saying though.
- justsomehnguy 4y ago
  Because that makes incoming traffic not to come to them at all. Traffic costs money and usually much more than a single 1U colo cost. BTW nice username
  - somehnguy 4y ago
    No doubt, we weren't able to pony up the cost difference to cover the bandwidth in cases like this so I get why this was their move. You have a nice username as well!
codedokode 4y ago
> but I'm not aware how big a customer you have to be for your ISP to care about such notices So basically ISP don't want to do anything to prevent misuse of their infrastructure because it is more profitable this way. > It also creates a nice DoS vector: if I want to not take an exam today, I'll just do a little ping flood from the school network and get banned for a while. The idea is that you can only block traffic going from school network to your site, but not any other traffic from that network.

dagenix 4y ago

The argument is that the servers aren't a problem - the problem is that we don't have a protocol to block them. Of course, we wouldn't need a protocol to block them if they weren't a problem. I'm very confused by this argument.

admax88qqq 4y ago
"X isn't the problem, Y is" is the overconfident way of saying "Y is a better solution to the problem"
cypress66 4y ago
Misconfigured servers that can amplify are only one way to DDoS attack. Even if this wasn't a problem you would still have all the other ways to DDoS, which you could handle easier if you could actually block the traffic. So yes, we would still need that protocol.

112233 4y ago

You mean something like RFC5575? That actually exists and is in use.

stevewatson301 4y ago

There are protocols in development at the NIST such as Named Data Networking[1] that implement such a scheme through flow balance and interests. [1] https://en.wikipedia.org/wiki/Named_data_networking https://en.wikipedia.org/wiki/Named_data_networking

dylan604 4y ago
and the public does what for the next 20 years before that reaches beta stage?

brian-armstrong 4y ago

Also, hosting vendors that allow customers to spoof source IPs. BCP38 would nicely fix all of that and most reputable hosting providers have it, but all it takes is a few to not use it to give this possibility.

Thorrez 4y ago

You're saying the solution is to have every website in existence find all these IPs and then request that their ISP block them? That sounds like a lot of work. Sure it's a good idea to allow requesting the blocks. But changing the reflection sources themselves so they can't be used for reflection anymore is also a good idea.

drran 4y ago

So, government will be able to silent anybody anywhere in the Internet just by using standard protocol. A Great World Wide Firewall.

codedokode 4y ago
They will be able to do it only for their citizens and they can do it already.

croes 4y ago

Misconfigured servers are the basis of multiple problems not just DDoS attacks. A new protocol only knocks off one head of the hydra, but does not solve the real problem.

raverbashing 4y ago

The article is correct and MS is at fault here (also per the comment there) "The problem is that the non-exisiting solution doesn't exist" - ok then

Gordonjcp 4y ago

You're wrong. Swap "spam" for "DDoS" in the following. https://craphound.com/spamsolutions.txt https://craphound.com/spamsolutions.txt

deleted 4y ago

[deleted]

jasonwatkinspdx 4y ago

BGP blackholeing is used routinely.

tinus_hn 4y ago

So now uplinks are going to maintain lists of networks you don’t want traffic from. How do you imagine this is going to work with IPv6? It requires unbounded amounts of memory and processing power.