4 ms·
I've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these
by jedberg 3y ago
I've been working on anti-DDOS off and on for 20 years now. The answer is sometimes government actors, but oftentimes scammers in Eastern Europe. They do these big attacks for street cred amongst the botting community.
They then use their street cred to get paid by less scrupulous actors to attack their rivals. Sometimes the people paying are governments, sometimes just shady companies. For example last year there was a lot of crypto companies attacking each other's websites.
Most of the people who do this have a lot of technical skill but not a lot of opportunity to get paid for it based on where they live or the circumstances of their upbringing.
- whimsicalism 3y agoSeems like attacking Google would be a bad target for street cred as compared to govt websites.
- fnordpiglet 3y agoSurely bringing down Google is a bigger technical achievement than some random government website maintained by someone who stumbled into their job after 20 years doing mid level government organizational work.
- whimsicalism 3y agoYes, but they are clearly going to fail to bring down Google.
- usefulcat 3y agoRight, so clearly the ability to bring down Google is not the point.
- jedberg 3y agoIt doesn't matter if you fail. The cred comes from how much bandwidth and resources you can soak up.
- fnordpiglet 3y agoWell - they clearly were successful enough to get a thread on hacker news……
- rvba 3y agoAim high and go out with a bang choom
- ortusdux 3y agoHeck, I'd imagine that making headlines and having Google benchmark your attack would bring some amazing street cred.
- antonjs 3y agoDarknet guerilla marketing. Definitely seems to have worked. Now we need the SEO content side: "How we hit Google with 398M RPS". "... you can do this manually, but our product makes it as easy as a sign up and API call. Talk to us about pricing. [Python API example].
- jedberg 3y agoNah it's even better because they're considered capable defenders so it's harder. What I'm not sure of is why Google published this. I can't figure out what their strategy is here. We never published about the attacks we absorbed because we didn't want them to know our capabilities. Unless this is marketing for Google Cloud?
- vineyardmike 3y agoThis is certainly marketing. If they sell DDOS protection, then announcing that they stopped the largest attack ever is an ad.
- epalm 3y agoMaybe Google is responsible for the attack, to be able to publish this blog post! <\tinfoil-hat>
- ignoramous 3y agoIf Google truly went rouge, they could turn all those Chrome installs and Android devices into one gargantuan botnet.
- FartyMcFarter 3y agoGoogle is already partly rouge, at least in their logo.
- frostiness 3y agoSounds like a symbiotic relationship to me. The attackers get to advertise their capability for pulling off attacks, and Google gets to advertise their ability to stop them.
- pixl97 3y agoAlmost all (but not all) of these attacks are based on some kind of problem that leads to amplification. Advertizing that people should fix these points of exploit help everyone on the internet.
- aa_is_op 3y agoThey're not attacking Google, per se. Just the Google Cloud platform that hosts govt sites, Discord channels, gaming servers, etc.
- jessriedel 3y agoVery useful, thanks. Do you know roughly what sort of resources, in time, money, and compromised machines, it takes to do something like this? (Order of magnitude.)
- xnx 3y agoapprox. 20,000 machines https://news.ycombinator.com/item?id=37831355 https://news.ycombinator.com/item?id=37831355
- southernplaces7 3y agoIf this attack takes only 20,000 machines to orchestrate, how is it the "largest DDoS attack to date"? It was to my understanding that some botnets and organizations have placed far more than 20,000 machines under their control before or currently. Could you explain a bit better?
- xnx 3y agoI think they're measuring "largest" by the number of requests per second.
- southernplaces7 3y agoBut that's part of my question. If other botnets have previously been created with many more than 20,000 controlled machines, why has nobody else before orchestrated an attack with so many requests if it only requires 20,000 machines or so to pull off?
- xnx 3y agoThis is exploiting a new technique. This technique wasn't known previously, or wasn't viable when HTTP/2 wasn't widespread. This technique is a ~100x multiplier on the impact any size botnet can have. A previous botnet might have needed 20,000,000 machines to achieve the same impact.
- frozenport 3y ago>> Most of the people who do this have a lot of technical skill but not a lot of opportunity to get paid for it based on where they live or the circumstances of their upbringing. LOL. No there are plenty of legitimate enterprises as well as opportunity to immigrate. Especially in tech. These guys are just criminals.
- xnickb 3y agoHave you tried that yourself? Especially as someone who has the skills but doesn't speak the language. I know people who can't relocate because of communication issues and/or cultural differences. No they aren't criminals, but they are definitely underpaid compared to those who managed to relocate.
- sharkoz 3y agoIf they operate botnets, I think it's fair to call them criminals
- colinsane 3y agoprobably, or if they aren’t directly criminals they’re probably facilitating criminals. but if you were very particular about it you could in theory set up in a country which doesn’t have treaties with any of the countries in which the victims operate.
- chuckSu 3y ago[dead]
- ExoticPearTree 3y agoIt is only criminal if the botnets are used to steal something. DDoS-in just for fun is at most an annoyance.
- grog454 3y agoYeah, hospitals can't stand that kind of thing...
- wly_cdgr 3y agoWow, I guess sometimes the real world is as cool as the movies
- gffrd 3y agoCrypto companies attacking eachothers' websites?! Color me surprised …