5 ms·

I can not understand these attacks. Why block a service that is free of charge, useful and did no harm? Unless of course this DDoS was not targeted, which makes

by pestaa 15y ago

I can not understand these attacks. Why block a service that is free of charge, useful and did no harm? Unless of course this DDoS was not targeted, which makes even less sense to me. Also, why did Rails Machine throw out the site so quickly? If I choose to sponsor someone out of my free will, I'd do so without distinction from paying customers.

0x0 15y ago
Just guessing, but maybe someone didn't like the content of a stored public "pastie"?
- pestaa 15y ago
  ... and had too much time on their hands. Seriously, when something is offending me, I contact the author and webmaster first. Not take the whole cluster down.
  - 0x0 15y ago
    Maybe they did to no effect, or maybe the content was of such nature that they didn't want to draw any extra attention to it. Pure speculation of course, but no matter the reason, they achieved the intended end result "efficiently".
  - yew 15y ago
    It is actually cheaper to launch a DDoS attack then to talk to the webmaster, if you already control enough zombies and value your personal time highly enough. The attack might have been launched for the fun of it, too. Why not, when you won't be affected personally?
gojomo 15y ago
In such a case, those who launch the DDoS may have no legal/legitimate grounds to take some disfavored content down. (Perhaps it is embarassing to their prophet, government, guru, criminal enterprise, or movement.) They may have asked for material to be taken down, and the hoster said, "no, it's legal content" – at which point the DDoS is launched as both primary censorship (disabling access to the whole site) and censorship-by-blackmail ("take it down or your whole site stays down"). On the other hand, it's also possible that the originators of the DDoS are angry about something the hoster did take down. Perhaps they'd put up material against the rules, Pastie took it down, and in a tantrum after-the-fact, they decided to retaliate with a "well if you won't host our stuff we'll block eveyone". (This is a bit more like the Anonymous DDoS against payment services they didn't like.) Without a statement from those involved, it can be hard to determine DDoSer motivations, but those are some common patterns.
seanp2k2 15y ago
@everyone who doesn't work in hosting.... >"why did Rails Machine throw out the site so quickly?" If you run a datacenter, you pay for an uplink. That uplink has limited capacity. 4gbit, 10gbit...whatever. A big attack can saturate that link completely, so even with the biggest most expensive "mitigation device" on the market (some of this gear can get into the hundreds-of-thousands-of-dollars for /one/ device, mind you), if a DDoS is overloading your upstream bandwidth providers, you can either have your entire DC brought to a crawl, or null route the site. With that said, how did CloudFlare keep lulzsec up? Anycast, lots of iron, lots of smart technicians, and probably tens to hundreds of thousands of dollars in bandwidth fees. TL;DR it was a publicity stunt that they very smartly played up. DDoS is pretty misunderstood, and lots of clients think that there is some magical box that can take all the traffic. Again, if your link is saturated, a "mitigation" device can only filter the traffic; your upstream providers can and will take you offline if you don't fix it. Failing that, you get a massive overage bill and every other client at the facility is crawling. It's not really a good solution (mitigation devices /can/ help with smaller attacks, but for the big stuff, null routing is the best solution unless you have something like CloudFlare -- and even they will pull the plug if the attack gets too heavy, because it's simply not worth the expense to them to keep your site online.)
- jsprinkles 15y ago
  People who haven't worked in hosting don't realize that not only is the gear $100,000+, the administrators that understand it are just as expensive. Annually. (Mitigation is a relatively rare skill for network administrators.) Edit: Let's say you run Joe's Web Hosting. Joe's has three facilities, and you run redundant ten gigabit uplinks at each. Last I priced a device that could handle ten gigabit at line rate, it was ~$120,000, so figure: $120,000 x 2 uplinks x 3 facilities = $720,000 Just for the gear. (I honestly don't remember if that figure was for the gigabit device or the ten gigabit device. I think the ten.)
  - nenolod 15y ago
    your example is pointless as no actual datacenter actually pays their equipment vendor anywhere near list price for those devices. i certainly don't. network equipment vendors like to have high list prices in order to: - ensure they get sales inquiries from serious buyers; - give sales representatives a large amount of leverage when negotiating the actual line-item pricing for each purchase order; - promote some kind of enhanced "value" to executives ("it costs a lot of money, so it must be good!") a realistic price for two routers with two 10gig-e linecards is about $15,000-$25,000 per unit direct from brocade. cisco would be around the $35,000-$50,000 per unit ballpark. if you're paying any more than that, you're getting extremely shafted. further, the circuits for the uplinks aren't going to cost that much themselves, as it's all sold under percentile-billing (not even 95%, usually more like 90% or 80% at over-gig-e levels these days) when we're talking actual transit costs. commits for "Joe's Web Hosting" might only be 1.5gig on each 10gig circuit, so that cuts down pricing a lot right there. in terms of getting an experienced engineer, most attacks can be detected and mitigated automatically using netflow/sflow/ipfix flow analysis. i wrote software which handles the detection automatically, with a fairly high success rate, and it's free to use on bitbucket. :)

by pestaa 15y ago

0x0 15y ago

Just guessing, but maybe someone didn't like the content of a stored public "pastie"?

pestaa 15y ago
... and had too much time on their hands. Seriously, when something is offending me, I contact the author and webmaster first. Not take the whole cluster down.
- 0x0 15y ago
  Maybe they did to no effect, or maybe the content was of such nature that they didn't want to draw any extra attention to it. Pure speculation of course, but no matter the reason, they achieved the intended end result "efficiently".
- yew 15y ago
  It is actually cheaper to launch a DDoS attack then to talk to the webmaster, if you already control enough zombies and value your personal time highly enough. The attack might have been launched for the fun of it, too. Why not, when you won't be affected personally?

gojomo 15y ago

In such a case, those who launch the DDoS may have no legal/legitimate grounds to take some disfavored content down. (Perhaps it is embarassing to their prophet, government, guru, criminal enterprise, or movement.) They may have asked for material to be taken down, and the hoster said, "no, it's legal content" – at which point the DDoS is launched as both primary censorship (disabling access to the whole site) and censorship-by-blackmail ("take it down or your whole site stays down"). On the other hand, it's also possible that the originators of the DDoS are angry about something the hoster did take down. Perhaps they'd put up material against the rules, Pastie took it down, and in a tantrum after-the-fact, they decided to retaliate with a "well if you won't host our stuff we'll block eveyone". (This is a bit more like the Anonymous DDoS against payment services they didn't like.) Without a statement from those involved, it can be hard to determine DDoSer motivations, but those are some common patterns.

seanp2k2 15y ago

@everyone who doesn't work in hosting.... >"why did Rails Machine throw out the site so quickly?" If you run a datacenter, you pay for an uplink. That uplink has limited capacity. 4gbit, 10gbit...whatever. A big attack can saturate that link completely, so even with the biggest most expensive "mitigation device" on the market (some of this gear can get into the hundreds-of-thousands-of-dollars for /one/ device, mind you), if a DDoS is overloading your upstream bandwidth providers, you can either have your entire DC brought to a crawl, or null route the site. With that said, how did CloudFlare keep lulzsec up? Anycast, lots of iron, lots of smart technicians, and probably tens to hundreds of thousands of dollars in bandwidth fees. TL;DR it was a publicity stunt that they very smartly played up. DDoS is pretty misunderstood, and lots of clients think that there is some magical box that can take all the traffic. Again, if your link is saturated, a "mitigation" device can only filter the traffic; your upstream providers can and will take you offline if you don't fix it. Failing that, you get a massive overage bill and every other client at the facility is crawling. It's not really a good solution (mitigation devices /can/ help with smaller attacks, but for the big stuff, null routing is the best solution unless you have something like CloudFlare -- and even they will pull the plug if the attack gets too heavy, because it's simply not worth the expense to them to keep your site online.)

jsprinkles 15y ago
People who haven't worked in hosting don't realize that not only is the gear $100,000+, the administrators that understand it are just as expensive. Annually. (Mitigation is a relatively rare skill for network administrators.) Edit: Let's say you run Joe's Web Hosting. Joe's has three facilities, and you run redundant ten gigabit uplinks at each. Last I priced a device that could handle ten gigabit at line rate, it was ~$120,000, so figure: $120,000 x 2 uplinks x 3 facilities = $720,000 Just for the gear. (I honestly don't remember if that figure was for the gigabit device or the ten gigabit device. I think the ten.)
- nenolod 15y ago
  your example is pointless as no actual datacenter actually pays their equipment vendor anywhere near list price for those devices. i certainly don't. network equipment vendors like to have high list prices in order to: - ensure they get sales inquiries from serious buyers; - give sales representatives a large amount of leverage when negotiating the actual line-item pricing for each purchase order; - promote some kind of enhanced "value" to executives ("it costs a lot of money, so it must be good!") a realistic price for two routers with two 10gig-e linecards is about $15,000-$25,000 per unit direct from brocade. cisco would be around the $35,000-$50,000 per unit ballpark. if you're paying any more than that, you're getting extremely shafted. further, the circuits for the uplinks aren't going to cost that much themselves, as it's all sold under percentile-billing (not even 95%, usually more like 90% or 80% at over-gig-e levels these days) when we're talking actual transit costs. commits for "Joe's Web Hosting" might only be 1.5gig on each 10gig circuit, so that cuts down pricing a lot right there. in terms of getting an experienced engineer, most attacks can be detected and mitigated automatically using netflow/sflow/ipfix flow analysis. i wrote software which handles the detection automatically, with a fairly high success rate, and it's free to use on bitbucket. :)