5 ms·

Why are DDoS attacks still a problem? Can't we, the network engineering community, figure this out? It's 2012, for God's sake. I feel like if every network eng

Why are DDoS attacks still a problem? Can't we, the network engineering community, figure this out? It's 2012, for God's sake. I feel like if every network engineer cared about DoS attacks and actually watched traffic leaving their AS for such attacks (they're relatively easy to identify), the world would be a much better place. I can't tell you how many times I've e-mailed abuse contacts in APNIC regions and heard nothing but silence -- or, occasionally, the attack intensified. And you can't tell me the big telcos like Comcast don't already have packet sniffing gear in place to penalize BitTorrent and so forth; can't you quickly identify LOIC and the other bullshit and yank that customer offline or shape the hell out of them? This is ridiculous, and might have a solution as simple as, "if your network DoS attacks mine and you don't deal with it, I reserve the right to depeer you. Good luck explaining to your customers why they can't hit Google any more." I might have high expectations, though, since countless ASNs still let packets with forged addresses out.

andrewcooke 14y ago
cloudflare http://www.cloudflare.com/ http://www.cloudflare.com/ were quite popular here a while back. i had the impression that they had solved this.
sohn 14y ago
Unpeer the whole China.
runeks 14y ago
The reason we haven't solved DDoS attacks is because we're working on solving the problem at the wrong level. We're trying to solve the wrong problem. This video explains very clearly how this is the case: http://www.youtube.com/watch?v=8Z685OF-PS8 http://www.youtube.com/watch?v=8Z685OF-PS8 Short(er) explanation: we no longer use the internet primarily for the purpose of communicating between two parties. But the infrastructure of the internet forces us to obtain data by having a conversation with a supposedly trusted party, even though a line of communication is not really what we want; we want a specific piece of data (an internet page, the latest exchange rate of USD to EUR, the ISO for the daily image of Ubuntu 12.04, etc.). It doesn't matter where we get it from (location is irrelevant), it only matters that it's the right data. Our use of the internet today is all about data. Yet, the infrastructure of the internet (TCP/IP) is location-centric; not data-centric. Data is shuttled between computers based, not on the data, but on the location of the computers. This creates the possibility of DoS attacks. The TCP/IP protocol is designed to efficiently route packages from a source to a destination, and a DoS attack simply uses this feature maliciously. When someone is hit by a DoS attack, the routers aiding in this are just following the rules of TCP/IP: routing packages to a destination. That's their job. What we need is a data-centric infrastructure. An infrastructure where data is not obtained via a connection to some location, but an infrastructure where data is simply accessed by sending a request for a specific piece of data into the cloud, and receiving the data from someone (and verifying that piece of data via its hash and signature). Instead of me obtaining the NY Times front page like this: * Wireless USB dongle sends out signal. Signal is picked up by my router (and everyone else's routers in near proximity, but all these other routers discard the signal). Router sends out a signal which my dongle (and all other routers/dongles pick up), but only my dongle uses this signal to obtain an IP address that the router knows. Over this connection I tell the router I want to connect to nytimes.com. Router connects to a server (name server) and asks it what the IP address is for nytimes.com. Router establishes a connection to nytimes.com, based on the IP it got from the nameserver. I send some commands over this connection where I ask for data, nytimes.com sends data, router hands it over to me. I now assume that I have the correct data - the front page of the NY Times, because some name sever said some IP address corresponds to nytimes.com, and this IP address sent me this data. I would obtain it like this: * Wireless USB dongle sends out a "data ID" for the NY Times front page. Any of the routers in my near vicinity that has a copy of the NY Times front page sends out a signal containing this data. My USB dongle pick up this data (and all other routers/dongles do so as well, the difference is that they are able to use this data as well, if they're looking for it). My computer checks if the data is signed using the public key of the New York Times. If the "date" field of the data is equal to or newer than, say, "now minus on hour", I accept this data as the NY Times' current front page. A DoS attack is easy in the former case, because there is a connection. Not so easy in the latter case, because routers don't willingly forward any data; they are data-aware and if they receive a copy of the NY Times that isn't signed by the NY Times' signature, it's discarded/ignored. If you want to understand it better, watch that video. It's an excellent talk. Really puts things in perspective.
- chc 14y ago
  It sounds like you're essentially talking about caching proxies, since if the data only lived on NYT's server, it wouldn't matter whether you were looking it up by "data ID" or IP address. Don't we have that already? Is there some significant difference I'm missing?
  - dhx 14y ago
    You can try it today: https://en.wikipedia.org/wiki/Freenet#Distributed_storage_and_caching_of_data https://en.wikipedia.org/wiki/Freenet#Distributed_storage_an... Trust is still needed for a variety of reasons including the prevention of a DoS attack on global storage capacity (injecting 10Tb/s of junk into the peer-to-peer data store).
  - mjschultz 14y ago
    Google, NYT, Amazon, et al. have data caching and it conceptually works in the same way as the idea of named data networking (on of the names of the idea above). However, named data networking would push a cache to every network device between the requester and the provider for every piece of data. Unless an attacker is very close to the provider, they won't be able to take down the resource. The best they could do is take down the resource for themselves and their nearest neighbors.
    - Retric 14y ago
      Until someone poisons the cache by writing and requesting random junk and takes everyone offline at the same time. Remember DOS may be controlled by a few machines, but compromised machines tend to be randomly distributed throughout the world (ed: random but not uniform).
  - runeks 14y ago
    The difference is that a caching proxy is a layer over the TCP/IP protocol. In other words, we're using a location-centric protocol to build a data-centric network. Now I'm not saying that this can't be done, it most certainly can. I'm saying that we would be able to, much easier, build a well-functioning, distributed data-centric network if the foundational protocol, on which we build the network ,is inherently data-aware and location-agnostic, instead of being location-aware and data-agnostic (as the TCP/IP protocol is).
viraptor 14y ago
> actually watched traffic leaving their AS for such attacks (they're relatively easy to identify) Are they? Are you talking about a trivial "let's use the whole bandwidth everywhere" attack, or a more sophisticated "find a bug in website X and make every visitor do one request to DDOS target" class? While any brute-force attack is easy to spot, how do you propose dealing with well organised attack relying on involving random unsuspecting users? (suppose you don't have the Referer header like in the website attack scenario) Of course this depends on the destination. If you want to DDOS the network, you need lots of traffic and a small, well organised attack may not be possible. But if you want to kill someone running a couple of servers on a 100mb connection, that's trivial.

andrewcooke 14y ago

cloudflare http://www.cloudflare.com/ http://www.cloudflare.com/ were quite popular here a while back. i had the impression that they had solved this.

sohn 14y ago

Unpeer the whole China.

runeks 14y ago

The reason we haven't solved DDoS attacks is because we're working on solving the problem at the wrong level. We're trying to solve the wrong problem. This video explains very clearly how this is the case: http://www.youtube.com/watch?v=8Z685OF-PS8 http://www.youtube.com/watch?v=8Z685OF-PS8 Short(er) explanation: we no longer use the internet primarily for the purpose of communicating between two parties. But the infrastructure of the internet forces us to obtain data by having a conversation with a supposedly trusted party, even though a line of communication is not really what we want; we want a specific piece of data (an internet page, the latest exchange rate of USD to EUR, the ISO for the daily image of Ubuntu 12.04, etc.). It doesn't matter where we get it from (location is irrelevant), it only matters that it's the right data. Our use of the internet today is all about data. Yet, the infrastructure of the internet (TCP/IP) is location-centric; not data-centric. Data is shuttled between computers based, not on the data, but on the location of the computers. This creates the possibility of DoS attacks. The TCP/IP protocol is designed to efficiently route packages from a source to a destination, and a DoS attack simply uses this feature maliciously. When someone is hit by a DoS attack, the routers aiding in this are just following the rules of TCP/IP: routing packages to a destination. That's their job. What we need is a data-centric infrastructure. An infrastructure where data is not obtained via a connection to some location, but an infrastructure where data is simply accessed by sending a request for a specific piece of data into the cloud, and receiving the data from someone (and verifying that piece of data via its hash and signature). Instead of me obtaining the NY Times front page like this: * Wireless USB dongle sends out signal. Signal is picked up by my router (and everyone else's routers in near proximity, but all these other routers discard the signal). Router sends out a signal which my dongle (and all other routers/dongles pick up), but only my dongle uses this signal to obtain an IP address that the router knows. Over this connection I tell the router I want to connect to nytimes.com. Router connects to a server (name server) and asks it what the IP address is for nytimes.com. Router establishes a connection to nytimes.com, based on the IP it got from the nameserver. I send some commands over this connection where I ask for data, nytimes.com sends data, router hands it over to me. I now assume that I have the correct data - the front page of the NY Times, because some name sever said some IP address corresponds to nytimes.com, and this IP address sent me this data. I would obtain it like this: * Wireless USB dongle sends out a "data ID" for the NY Times front page. Any of the routers in my near vicinity that has a copy of the NY Times front page sends out a signal containing this data. My USB dongle pick up this data (and all other routers/dongles do so as well, the difference is that they are able to use this data as well, if they're looking for it). My computer checks if the data is signed using the public key of the New York Times. If the "date" field of the data is equal to or newer than, say, "now minus on hour", I accept this data as the NY Times' current front page. A DoS attack is easy in the former case, because there is a connection. Not so easy in the latter case, because routers don't willingly forward any data; they are data-aware and if they receive a copy of the NY Times that isn't signed by the NY Times' signature, it's discarded/ignored. If you want to understand it better, watch that video. It's an excellent talk. Really puts things in perspective.

chc 14y ago
It sounds like you're essentially talking about caching proxies, since if the data only lived on NYT's server, it wouldn't matter whether you were looking it up by "data ID" or IP address. Don't we have that already? Is there some significant difference I'm missing?
- dhx 14y ago
  You can try it today: https://en.wikipedia.org/wiki/Freenet#Distributed_storage_and_caching_of_data https://en.wikipedia.org/wiki/Freenet#Distributed_storage_an... Trust is still needed for a variety of reasons including the prevention of a DoS attack on global storage capacity (injecting 10Tb/s of junk into the peer-to-peer data store).
- mjschultz 14y ago
  Google, NYT, Amazon, et al. have data caching and it conceptually works in the same way as the idea of named data networking (on of the names of the idea above). However, named data networking would push a cache to every network device between the requester and the provider for every piece of data. Unless an attacker is very close to the provider, they won't be able to take down the resource. The best they could do is take down the resource for themselves and their nearest neighbors.
  - Retric 14y ago
    Until someone poisons the cache by writing and requesting random junk and takes everyone offline at the same time. Remember DOS may be controlled by a few machines, but compromised machines tend to be randomly distributed throughout the world (ed: random but not uniform).
- runeks 14y ago
  The difference is that a caching proxy is a layer over the TCP/IP protocol. In other words, we're using a location-centric protocol to build a data-centric network. Now I'm not saying that this can't be done, it most certainly can. I'm saying that we would be able to, much easier, build a well-functioning, distributed data-centric network if the foundational protocol, on which we build the network ,is inherently data-aware and location-agnostic, instead of being location-aware and data-agnostic (as the TCP/IP protocol is).

viraptor 14y ago

> actually watched traffic leaving their AS for such attacks (they're relatively easy to identify) Are they? Are you talking about a trivial "let's use the whole bandwidth everywhere" attack, or a more sophisticated "find a bug in website X and make every visitor do one request to DDOS target" class? While any brute-force attack is easy to spot, how do you propose dealing with well organised attack relying on involving random unsuspecting users? (suppose you don't have the Referer header like in the website attack scenario) Of course this depends on the destination. If you want to DDOS the network, you need lots of traffic and a small, well organised attack may not be possible. But if you want to kill someone running a couple of servers on a 100mb connection, that's trivial.