4 ms·

Temporarily add 500ms of latency to all ipv6 users, backoff timers for ipv4 addresses. Since there's only 4 billion v4 addresses, it's easy enough to just track

Temporarily add 500ms of latency to all ipv6 users, backoff timers for ipv4 addresses. Since there's only 4 billion v4 addresses, it's easy enough to just track them all in a sqlite db.

Taek 3y ago
I don't think that works if your attacker has millions of IPs and is only using 200 per second.
- akiselev 3y ago
  How are they getting millions of ipv4 addresses? IIUC that’s at least the equivalent of a /12 block. Do those shady residential proxies really operate at that scale? If they’re ipv6 address wouldn’t they be safe to block across large ranges?
  - slivanes 3y ago
    My guess through compromised boxes (or some apps) that act as proxies.
  - reaperman 3y ago
    It is trivially easy to get millions of IPv6’s, even spread out across a thousand ranges. It is also trivially “easy” to get past reCAPTCHA, but it costs more. My guess is that a domain name checker tool isn’t worth the cost per request to bypass reCAPTCHA (approximate 0.02 cents per session)
    - jszymborski 3y ago
      Right, but this is why the GGP's post suggested throttling IPV6. Or at least that was my understanding.
      - reaperman 3y ago
        The 500ms latency will help a lot if tons of requests are coming in serial. But most likely they are coming in parallel. It’s hard to “throttle” a single isolated request from a lone IP.
        wtallis 3y ago
        So.. make the requests serial. Just dump all the requests coming in over IPv6 into a queue, service that queue at a rate that's higher than the non-bot traffic requires but still low enough to be a problem for bots that can't self-limit to a reasonable rate. And of course, manage that queue intelligently so that you start dropping requests before you run out of RAM.
        reaperman 3y ago
        That just sounds like DDoSing yourself? It costs bots almost nothing to wait in the queue, and exactly zero real IPv6 clients will wait 10+ seconds to complete the request.
pfooti 3y ago
Mostly works, but there do exist a couple of botnets that contain 1 million compromised machines. If each makes one request before hitting backoff, spread evenly throughout the day, that's about 10 QPS alone before they use an IP number twice. But they tend to not actually level out their usage (which is a bummer - if they did they could have kept using it). Instead they hit with a lot of parallel queries all at once. There's only so much you can really do when your underlying resource is so limited. Luckily the value of the query is lower than the cost of a recaptcha solve, so the attackers moved on to some other target. Ironically I could now turn off the endpoint protection (or have it responsive to traffic load), until the attackers return. I shall not go into too many details, no need to give people a map.

Temporarily add 500ms of latency to all ipv6 users, backoff timers for ipv4 addresses. Since there's only 4 billion v4 addresses, it's easy enough to just track them all in a sqlite db.

Taek 3y ago

I don't think that works if your attacker has millions of IPs and is only using 200 per second.

akiselev 3y ago
How are they getting millions of ipv4 addresses? IIUC that’s at least the equivalent of a /12 block. Do those shady residential proxies really operate at that scale? If they’re ipv6 address wouldn’t they be safe to block across large ranges?
- slivanes 3y ago
  My guess through compromised boxes (or some apps) that act as proxies.
- reaperman 3y ago
  It is trivially easy to get millions of IPv6’s, even spread out across a thousand ranges. It is also trivially “easy” to get past reCAPTCHA, but it costs more. My guess is that a domain name checker tool isn’t worth the cost per request to bypass reCAPTCHA (approximate 0.02 cents per session)
  - jszymborski 3y ago
    Right, but this is why the GGP's post suggested throttling IPV6. Or at least that was my understanding.
    - reaperman 3y ago
      The 500ms latency will help a lot if tons of requests are coming in serial. But most likely they are coming in parallel. It’s hard to “throttle” a single isolated request from a lone IP.
      - wtallis 3y ago
        So.. make the requests serial. Just dump all the requests coming in over IPv6 into a queue, service that queue at a rate that's higher than the non-bot traffic requires but still low enough to be a problem for bots that can't self-limit to a reasonable rate. And of course, manage that queue intelligently so that you start dropping requests before you run out of RAM.
        reaperman 3y ago
        That just sounds like DDoSing yourself? It costs bots almost nothing to wait in the queue, and exactly zero real IPv6 clients will wait 10+ seconds to complete the request.

pfooti 3y ago

Mostly works, but there do exist a couple of botnets that contain 1 million compromised machines. If each makes one request before hitting backoff, spread evenly throughout the day, that's about 10 QPS alone before they use an IP number twice. But they tend to not actually level out their usage (which is a bummer - if they did they could have kept using it). Instead they hit with a lot of parallel queries all at once. There's only so much you can really do when your underlying resource is so limited. Luckily the value of the query is lower than the cost of a recaptcha solve, so the attackers moved on to some other target. Ironically I could now turn off the endpoint protection (or have it responsive to traffic load), until the attackers return. I shall not go into too many details, no need to give people a map.