8 ms·
Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against cor
by pythonguython 3y ago
Who has an incentive to carry out these DDos attacks? Why would anyone be willing to spend large amounts of money and develop a sophisticated attack against corporate cloud infrastructure? It seems like the only reasonable answer is foreign governments. But still what is the result - you inconvenience American tech companies and their customers for a few hours? This happens all the time, so clearly someone finds it worthwhile. Can anyone help me understand?
- GartzenDeHaes 3y agoDDOS protection is a billion dollar a year industry.
- gloosx 3y agofew hours of inconvenience in corporate cloud infrastructure has a result also - large amounts of money lost. So most obvious incentive is simply ransom
- anonacct37 3y agoPR. Attack Google or cloudflare. Wait for them to publish a blog post about the biggest attack ever seen, then tell potential customers of your botnet that you can launch a bigger attack than anyone else and point to the above blog post.
- Jeff_Brown 3y agoThe botnet is probably the critical thing. Even if the PR (or "avenge the global south", or whatever) value might not be enormous, the cost to a bad actor of having other peoples' computers do something is almost negligible.
- endergen 3y agoDoesn't using your botnet expose your botnet IP addresses/devices?
- mrweasel 3y agoYes, but currently that has zero consequences. Say you infect 500.000 Windows XP machines or consumer routers, the owners of those devices isn't going to be informed, nor is their ISPs. In many cases the manufacturer of those devices also aren't going to provide security update, but those probably wasn't going to be applied anyway.
- jrockway 3y agoAre you positive that "tell nobody" is the mitigation strategy that Google used here? They could have easily asked router vendors to patch their devices, asked ISPs to blackhole those customers until they're patched, etc.
- soperj 3y agoPatch what though? They know that they're getting hit with unprecedented traffic, not how those computers were infected.
- menscher 3y agoIt's mostly not infected computers, but rather poorly configured proxies that are open for anyone to bounce malicious traffic through. Convincing everyone to clean up their open proxies is a long-term, hard problem. But I plan to tackle it soon....
- KomoD 3y agoAnyone can claim that, there's no link to a specific actor
- v-erne 3y agoI'm guessing you would do this in advance - "pay attention to tech news next week - our botnet will unleash hell"
- jekude 3y agoStep 1: Put message on blockchain beforehand with exact date/time and characteristics of DDoS Step 2: Execute DDoS Step 3: Prove to others you are responsible by using private key
- darkwater 3y agoAnd Google and Cloudflare also get good PR because how insanely good their are at deflecting those huge attacks. It's a win-win situation here... oh wait /s (the /s is just on the "oh wait" part, not the whole post)
- gowld 3y agoWhy not attack a target that can actually be harmed? Are they afraid? It's not obvious what's the value of having the largest ineffective attack.
- lazide 3y agoWhy not roll a couple defenseless grannies in the streets for pocket change, rather than throw rocks at the cops and then get away unscathed? One gets you more money in the short term. The other one gets you more street cred - which gets you more money in the long term.
- ehsankia 3y agoWell in this case it seems like they blew their "0-day" and Google worked with other providers to patch this type of attack.
- deleted 3y ago[deleted]
- forward1 3y agoIf they're unsophisticated, it's for clout and "street cred" in hacking communities, no different than tagging a freeway overpass with graffiti. If they're advanced, they are doing it to test capabilities and responses. The Taliban used to pay kids to light off firecrackers outside base to check defensive TTPs. It also had the effect of desensitizing the sound of gunfire. Really good adversaries know how to accomplish the latter while appearing as the former.
- averageRoyalty 3y agoOr... It's for fun. Are the 90s/00s that long ago? Not everything is about money and terrorism. Bring back CotDC, MoD, even lulzsec. I miss the days of the internet being the open seas and everyone having their own fun on it, user beware.
- datadeft 3y agoFor example a certain group decides to short on a share. The DDOS the company and "leak" it to the press. The bad press negatively impacts the share price. At least this was the way some time ago when I had to deal with such attacks.
- jedberg 3y agoI've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these big attacks for street cred amongst the botting community. They then use their street cred to get paid by less scrupulous actors to attack their rivals. Sometimes the people paying are governments, sometimes just shady companies. For example last year there was a lot of crypto companies attacking each other's websites. Most of the people who do this have a lot of technical skill but not a lot of opportunity to get paid for it based on where they live or the circumstances of their upbringing.
- whimsicalism 3y agoSeems like attacking Google would be a bad target for street cred as compared to govt websites.
- fnordpiglet 3y agoSurely bringing down Google is a bigger technical achievement than some random government website maintained by someone who stumbled into their job after 20 years doing mid level government organizational work.
- whimsicalism 3y agoYes, but they are clearly going to fail to bring down Google.
- rockinghigh 3y agoFor a recent and similar attack at scale, the authors of the botnet software were from an American security company who sold DDOS mitigation solutions (https://en.wikipedia.org/wiki/Mirai_(malware) https://en.wikipedia.org/wiki/Mirai_(malware)).
- chatmasta 3y agoGoogle keeps showing me a CAPTCHA and telling me I'm part of the Mirai botnet. I'm using Cloudflare WARP so I have an IP from Cloudflare.
- syndacks 3y agofor the lolz
- xeromal 3y agoMy gut instinct is that this is a nation-state initiated.
- belter 3y agoYou don't need a lot of money or resources to pull one of these. Code is on Github: https://github.com/649/Memcrashed-DDoS-Exploit https://github.com/649/Memcrashed-DDoS-Exploit Also the participants are sometimes innocently recruited victims for the attack. I blame app insecure defaults. The trend since 2015 is to get worst as you will see in the bottom layer of this graph: https://www.digitalattackmap.com/ https://www.digitalattackmap.com/
- whimsicalism 3y agoThis is a novel ddos attack. Did you all even read the article?
- belter 3y agoI did. I replied to OP question.And that was about DDos attacks in general not "HTTP/2 Rapid Reset attacks" > Who has an incentive to carry out these DDos attacks? Did you read the comment I was replying to?
- whimsicalism 3y agoYes, “these attacks” referring to the sophisticated novel attacks under discussion in the article. No need to be defensive, just read it next time.
- belter 3y agoAre there DDoS attacks that are not sophisticated in form or execution? :-)
- pizzafeelsright 3y agoping
- jxramos 3y agoI've never contemplated the cost of a DDos attack, I guess there's the upfront setup costs to secure the software and hardware that will execute the attack but are you speaking more about the costs on the day of the attack? Are those costs trivial, like the marginal costs I suppose it would be?
- WelcomeShorty 3y agoTo be effective, you need to either be prepared to hide behind google, Cloudflare or AWS, OR you need some pretty expensive deal with you (large) ISP who can (quickly) filter on their edge. Sitting at the end of whatever network, you will not be able to do anything against a sufficient volume attack.
- karaterobot 3y agoYou can (or could, my information is old) pay botnet owners a few hundred bucks to disrupt the servers of people you don't like. An example would be ruining a match for a competing game clan. There's a suprising amount of this kind of petty bullshit going on in the world. With the Mirai botnet, some of the creators had a DDOS mitigation company as well: they'd sell one party the weapon, and sell another party the defense against that weapon. Sometimes it's for the street cred, or the lulz, or just the challenge of building a botnet.
- red-iron-pine 3y agoDisruption is part of it for sure, but often big, aggressive DDoS come hand-in-hand with other attacks. Seen it happen with big DDoS on clients. Furaffinity, one of the larger furry webistes, and a constant drama magnet, was a client at a former job. They got DDoS'd hard, and in between scripted DDoS hits they slammed the hell out of their web applications to get vulns and do credential stuffing. As in blast em, lighten it up just enough to get a ssh or nmap through a few times, blast em again, and repeat until they got in. Is also why you want out-of-band solution that doesn't touch your infra much.
- somedude895 3y ago> in between scripted DDoS hits they slammed the hell out of their web applications I've heard this before, but I still don't understand what purpose the DDoS serves here. Distraction, so the actual attack drowns in the noise?
- danwee 3y agoGoogle? If you analyze the situation from the perspective of "Who benefits from it?", then the answer is clearly: Google benefits from it (they are so good, they can mitigate gigantic DDoS attacks). So, I don't think it's that crazy to think this is all a publicity stunt .
- bimguy 3y agoI was thinking the same thing. Especially when the the bottom of the article is basically a sales pitch for their own services. Whilst what they are saying is true and correct even if they aren't behind it (which I really doubt that they are the culprit). "With or without patches, organizations would need to make significant infrastructure investments to keep services running in the face of attacks of any moderate size and larger. Instead of bearing that expense themselves, organizations running services on Google Cloud can take advantage of our investment in capacity at global scale in our Cross-Cloud Network to deliver and protect their applications."
- ExoticPearTree 3y agoIf I had the technical prowess to do this, I would do it just for the fun of it. I mean, why not? Anarchy is fun. I'm pretty sure someone will find a way to take down GOOG/AWS/Azure/etc through a DDoS so large nothing will work for anyone.
- CrzyLngPwd 3y agoWhy do you think Finland or Spain might attack USA companies?
- pythonguython 3y agoI don’t think either of those countries would attack US companies. Obviously I would suspect adversaries instead of allies
- CrzyLngPwd 3y agoThe USA sees all countries, even allies, as adversaries, and always has ... hence the deep paranoia the USA has, lack of trust, lies, coercion, and spying (the list is longer but time is limited).
- pythonguython 3y agoOkay. In either case I doubt Spain or Finland is DDosing Google
- RektBoy 3y agoI mean you can ask them https://t.me/s/noname05716eng https://t.me/s/noname05716eng chat of NoName group skids doing some DDOSing, they pool their bots by community of like-minded people (Russians supporting current government, murder rape etc. you know)
- permo-w 3y agoI'm just guessing here but it could easily be stock market manipulation