3 ms·

Am I correct in assuming these kind of problems are not possible if you are using a major cloud provider instead of renting rack space?

eterps 3y ago
You are probably correct in assuming these kinds of problems are not possible given enough $$$
preisschild 3y ago
Depends if you buy their ddos protection services or not.
esskay 3y ago
Still very much possible, in most cases all you're doing at the cloud provider is running virtual hardware through load balancers so they can very much become overwhelmed. Even with more advanced setups, it's still all just hitting a variety of servers, each of which can be affected in different ways. There are (expensive) ways of mitigating but a project like Sourcehut couldn't afford or justify what will likely be a 5 to 6 figure sum.
daenney 3y ago
No, that is not a correct assumption. It's also worth remembering that cloud providers are also servers in racks, but they own the building around it to. For DDoS attacks, you need to have enough capacity to absorb the attack. Major cloud providers tend to have that, as do DDoS mitigation services (Cloudflare amongst others). > We spoke to CloudFlare and were quoted a number we cannot reasonably achieve within our financial means [..] Typically what you want to do though is stop the traffic from reaching you at all, so ideally your network provider, who is upstream from you, blocks the illegitimate traffic so your servers never see it and don't get overwhelmed. What happened here is that due to some administrative lapses, the victims (Sourcehut) of the attack got disabled by the network provider. That was the initial outage. Imagine if your ISP decided to stop routing traffic to Google. Being hosted on GCP, a major cloud provider, would be of no use, since there wouldn't be a network path to them in the first place. In general, Cogent seems to be doing a rather bad job at dealing with this attack and there's been fallout for many services beyond Sourchut. Google or AWS or Microsoft might've handled it more gracefully, or might not. Though major cloud providers tend to have their own connectivity between their datacenters, they too have peering/transit agreements with other major network providers. If those upstreams stop forwarding traffic to them, the same thing would happen. It's just less likely to go unnoticed. Cogent is a massive provider, so you'd think they'd be a bit better at this. But they also have a reputation for being awful.
- dewey 3y ago
  > What happened here is that due to some administrative lapses, the victims (Sourcehut) of the attack got disabled by the network provider. That was the initial outage. That's not what happened based on my understanding. The provider nullrouted their traffic (which is common if a customer is under attack), but Sourcehut couldn't talk to the customer support as their support panel wasn't working for them.
- fmajid 3y ago
  Cogent is also a low-cost provider, and it shows in their customer service.
JoshTriplett 3y ago
If you're using a major cloud provider, a DDoS might mean either that your service hits scaling limits or that you get a massive bill.
tgsovlerkhgsel 3y ago
For any company with a complicated cloud footprint, how do they avoid "denial-of-money" by having the attacker pick some externally reachable piece of the cloud setup where the attacker can take actions that the company pays for (e.g. download large files from a cloud storage bucket, generating huge bandwidth charges)?
- miki123211 3y ago
  This is a major problem, particularly for those offering any kind of outbound SMS capability, whether for 2FA or just phone number verification. That service is the easiest and most profitable to abuse, there are certain providers in certain countries that price inbound SMS very steeply, and are willing to share the profits with you. If you if you can get an attack going.

eterps 3y ago

You are probably correct in assuming these kinds of problems are not possible given enough $$$

preisschild 3y ago

Depends if you buy their ddos protection services or not.

esskay 3y ago

Still very much possible, in most cases all you're doing at the cloud provider is running virtual hardware through load balancers so they can very much become overwhelmed. Even with more advanced setups, it's still all just hitting a variety of servers, each of which can be affected in different ways. There are (expensive) ways of mitigating but a project like Sourcehut couldn't afford or justify what will likely be a 5 to 6 figure sum.

daenney 3y ago

No, that is not a correct assumption. It's also worth remembering that cloud providers are also servers in racks, but they own the building around it to. For DDoS attacks, you need to have enough capacity to absorb the attack. Major cloud providers tend to have that, as do DDoS mitigation services (Cloudflare amongst others). > We spoke to CloudFlare and were quoted a number we cannot reasonably achieve within our financial means [..] Typically what you want to do though is stop the traffic from reaching you at all, so ideally your network provider, who is upstream from you, blocks the illegitimate traffic so your servers never see it and don't get overwhelmed. What happened here is that due to some administrative lapses, the victims (Sourcehut) of the attack got disabled by the network provider. That was the initial outage. Imagine if your ISP decided to stop routing traffic to Google. Being hosted on GCP, a major cloud provider, would be of no use, since there wouldn't be a network path to them in the first place. In general, Cogent seems to be doing a rather bad job at dealing with this attack and there's been fallout for many services beyond Sourchut. Google or AWS or Microsoft might've handled it more gracefully, or might not. Though major cloud providers tend to have their own connectivity between their datacenters, they too have peering/transit agreements with other major network providers. If those upstreams stop forwarding traffic to them, the same thing would happen. It's just less likely to go unnoticed. Cogent is a massive provider, so you'd think they'd be a bit better at this. But they also have a reputation for being awful.

dewey 3y ago
> What happened here is that due to some administrative lapses, the victims (Sourcehut) of the attack got disabled by the network provider. That was the initial outage. That's not what happened based on my understanding. The provider nullrouted their traffic (which is common if a customer is under attack), but Sourcehut couldn't talk to the customer support as their support panel wasn't working for them.
fmajid 3y ago
Cogent is also a low-cost provider, and it shows in their customer service.

JoshTriplett 3y ago

If you're using a major cloud provider, a DDoS might mean either that your service hits scaling limits or that you get a massive bill.

tgsovlerkhgsel 3y ago

For any company with a complicated cloud footprint, how do they avoid "denial-of-money" by having the attacker pick some externally reachable piece of the cloud setup where the attacker can take actions that the company pays for (e.g. download large files from a cloud storage bucket, generating huge bandwidth charges)?

miki123211 3y ago
This is a major problem, particularly for those offering any kind of outbound SMS capability, whether for 2FA or just phone number verification. That service is the easiest and most profitable to abuse, there are certain providers in certain countries that price inbound SMS very steeply, and are willing to share the profits with you. If you if you can get an attack going.