5 ms·

Record DDoS pummels site with once-unimaginable 7.3Tbps of junk traffic

65 points by Brajeshwar 1y ago

encom 1y ago
So this "article" "source" is Cloudflare, claiming Cloudflare blocked some super duper mega attack, but gives zero verifiable detail about any of it. Now I hate Cloudflare with a passion, but even setting that aside, this is journalistic malpractice - it's basically a sponsored post. I was going to say I expected better from Ars Technica, but their glory days are long gone.
- decremental 1y ago
  [dead]
- gundmc 1y ago
  Why do you hate Cloudflare so passionately?
  - immibis 1y ago
    There are many reasons Cloudflare should be hated. The main one is that their goal is to centralize the Internet. A secondary one is all those bloody captchas. A tertiary one is that they often block Tor, even if you pass a captcha. Yes, it's configurable, but their recommended settings are the ones that help break the internet. A fourth one is that many DDoS-for-hire sites are protected behind Cloudflare, which allows them because they are good for its business model. Need I go on? However in this case I think we can rely on them to tell us what they did. If they say they got a 7.3 Tbps UDP DDoS, chances are good they actually did.
    - 6r17 1y ago
      tbh i get you ; but one has to realize this has nothing to do with that company and everything to do with the current nature of technological business where "everyone wins it all What I say is that instead of hating on cloudflare one can look up how a DNS server works and start getting into DDOS mitigation ; but even after a couple of month anybody would still just have scratched the surface of it. I don't think it's Cloudflare "goal" to centralize the internet, neither it is to set up captcha everywhere ; but it's definitely frustrating
      - immibis 1y ago
        It's every internet company's goal to centralize the part of the internet that aligns with what they so; cloudflare's part happens to be most of the internet, since they provide low-level infrastructure services.
- greggsy 1y ago
  How is CF not a valid primary source? They literally are a DDoS mitigation service.
  - encom 1y ago
    Encom is the greatest, fastest, cheapest electrician in Denmark. Source: me.
  - nurettin 1y ago
    They have Economic Incentive to lie to you.
curtisszmania 1y ago
[dead]
esafak 1y ago
Who's doing this and why?
- drogbabida 1y ago
  Orchestrated by Cloudflare sales team due to not meeting their revenue targets for the quarter. More fear in website owners and more publicitly about Cloudflare.
ChrisArchitect 1y ago
[dupe] discussion on source: https://news.ycombinator.com/item?id=44330585 https://news.ycombinator.com/item?id=44330585
smokel 1y ago
> A total of 34,500 ports were targeted, indicating the thoroughness and well-engineered nature of the attack. How is that more complicated than a for-loop?
- ukuina 1y ago
  Because it's a distributed for loop?
  - lolinder 1y ago
    Not necessarily. It could be one for loop running on tens of thousands of compromised IoT devices, with the only thing distributed being the command that starts the loops.
    - saulpw 1y ago
      Sounds like you've never managed tens of thousands of nodes in a distributed system. It's not trivial.
      - jjtheblunt 1y ago
        (elixir / otp says "hold my beer")
      - luckylion 1y ago
        What would making a C&C server for a botnet hard? It's not like you need to carefully coordinate all those clients to hit precise timings, you just tell them who to target and let them rip, don't you?
        PcChip 1y ago
        Nothing. I did it with IRC servers in the late 90s when I was a dumb kid in high school
      - lolinder 1y ago
balanc 1y ago
Doesn’t Cloudflare have every incentive to inflate the bandwidth of the attack they have successfully mitigated? And yes I know that there are Cloudflare employees here so spare me with your pinky swears.
- x2tyfi 1y ago
  Couldn’t this logic apply to basically every internal metric across every company?
  - udev4096 1y ago
    [flagged]
    - perching_aix 1y ago
      Speaking of incentives, what might be the incentives of those referring to them as Clownflare? I sure have to wonder what their biases are, and how fairly they represent the company.
    - eviks 1y ago
      How does it counter the incentives of all other companies to make it look like they're not the only one???
      - mlyle 1y ago
        Cloudflare has the biggest scale and is arguably best positioned to soak up massive attacks. Therefore CF may have a unique incentive to make it sound like attacks are larger and there are more really big ones.
        eviks 1y ago
        > is arguably best positioned Lying about the scale of thwarted attacks by others is the counter argument
ksec 1y ago
If I dont want my user to have Cloudflare captcha or for example captcha dont work on my Safari 18.5 running on OpenCore Patcher MacBook 2015. What other options have I got?
- immibis 1y ago
  The simplest is to just wait until the attacker is bored, and/or daddy's credit card runs out. If you aren't doing any business, or not much business, through your site, this can be fine. Your hosting provider may either choose to let your server be overwhelmed with as many packets as its pipe can fit, or it may need to protect its network by discarding traffic to your IP address upstream of itself. It's probably a good idea to reach out to your hosting provider and let them know you're getting DDoSed. Even if they can't do anything about it (though there's a chance they can) they'll hopefully appreciate the heads up. True story: I ran a Pixelflut client for 38C3 from a Netcup server in Nuremberg (this somehow had better performance than running it on my tablet at the physical location) and they somehow thought 38C3 was DDoSing me and "helpfully" blackholed traffic between 38C3 and my server. --- It's important to stop thinking of DDoS as some magic hammer of Thor that you can't do anything about. DDoS packets, like all other packets, have source and destination addresses and flow through routers and links. When Cloudflare receives a 7-terabit DDoS, they aren't receiving 7 terabits through one link. Cloudflare operates a huge number of locations that pretend to be one coherent network. So they're receiving 100 gigabits in London, 100 gigabits in Frankfurt, 200 gigabits in NYC, etc. Their network architecture pretends like it's delivering all these packets to their destination addresses, but really, each location has its own completely different set of servers that all have the same addresses. (This is called anycast.) Each individual packet sender is only sending packets to the nearest Cloudflare node, where they're getting discarded. Likely, no individual node is overloaded by this, but when you aggregate the statistics from all of them, it adds up to a large amount of traffic. This is by the nature of a DDoS - it's devices all over the world attacking you, which means they're all coming by different routes. It's similar with hosting providers too, at least the big ones. Suppose you're on Hetzner: https://www.hetzner.com/unternehmen/rechenzentrum/ https://www.hetzner.com/unternehmen/rechenzentrum/ . They're not getting a terabit against your server through one link - they're getting 100Gbps through DE-CIX Frankfurt, 10Gbps through AMS-IX, 50Gbps through Telia in Nuremburg, 50Gbps through Telia in Helsinki, 50Gbps through Core-Backbone, etc. If they deploy a routing rule to the router on their end of each of those links, which says to discard packets where the destination address is yours, they can protect their network. Your site will still be down, of course. If one of their pipes does get overloaded (say their full 10Gbps from Baltnet in Frankfurt), they can reach out to that network (pretty much every serious network on the internet has a network operations center, reachable 24/7 by phone) and Baltnet will track it down further and block the traffic even closer to its source (or at a wider part of their network). If you're lucky and the DDoS traffic is just coming from a few "directions", users whose packets happen to come via a different direction may still be able to access your site. Suppose you're on Uncle Tom's Tiny Hosting Company Ltd (not real), they're certainly not the scale of Hetzner, and they only have a 10Gbps pipe between them and their ISP which is easily filled by a single attack. They'll have to contact their ISP to block traffic to your server so that the rest can get through, and their ISP will do the above stuff. None of this information will keep your site up during a DDoS, I just want to show you there's a depth to this DDoS thing and this Internet thing and it's not just magic.

65 points by Brajeshwar 1y ago

So this "article" "source" is Cloudflare, claiming Cloudflare blocked some super duper mega attack, but gives zero verifiable detail about any of it. Now I hate Cloudflare with a passion, but even setting that aside, this is journalistic malpractice - it's basically a sponsored post. I was going to say I expected better from Ars Technica, but their glory days are long gone.

decremental 1y ago
[dead]
gundmc 1y ago
Why do you hate Cloudflare so passionately?
- immibis 1y ago
  There are many reasons Cloudflare should be hated. The main one is that their goal is to centralize the Internet. A secondary one is all those bloody captchas. A tertiary one is that they often block Tor, even if you pass a captcha. Yes, it's configurable, but their recommended settings are the ones that help break the internet. A fourth one is that many DDoS-for-hire sites are protected behind Cloudflare, which allows them because they are good for its business model. Need I go on? However in this case I think we can rely on them to tell us what they did. If they say they got a 7.3 Tbps UDP DDoS, chances are good they actually did.
  - 6r17 1y ago
    tbh i get you ; but one has to realize this has nothing to do with that company and everything to do with the current nature of technological business where "everyone wins it all What I say is that instead of hating on cloudflare one can look up how a DNS server works and start getting into DDOS mitigation ; but even after a couple of month anybody would still just have scratched the surface of it. I don't think it's Cloudflare "goal" to centralize the internet, neither it is to set up captcha everywhere ; but it's definitely frustrating
    - immibis 1y ago
      It's every internet company's goal to centralize the part of the internet that aligns with what they so; cloudflare's part happens to be most of the internet, since they provide low-level infrastructure services.
greggsy 1y ago
How is CF not a valid primary source? They literally are a DDoS mitigation service.
- encom 1y ago
  Encom is the greatest, fastest, cheapest electrician in Denmark. Source: me.
- nurettin 1y ago
  They have Economic Incentive to lie to you.

curtisszmania 1y ago

[dead]

esafak 1y ago

Who's doing this and why?

drogbabida 1y ago
Orchestrated by Cloudflare sales team due to not meeting their revenue targets for the quarter. More fear in website owners and more publicitly about Cloudflare.

ChrisArchitect 1y ago

[dupe] discussion on source: https://news.ycombinator.com/item?id=44330585 https://news.ycombinator.com/item?id=44330585

smokel 1y ago

> A total of 34,500 ports were targeted, indicating the thoroughness and well-engineered nature of the attack. How is that more complicated than a for-loop?

ukuina 1y ago
Because it's a distributed for loop?
- lolinder 1y ago
  Not necessarily. It could be one for loop running on tens of thousands of compromised IoT devices, with the only thing distributed being the command that starts the loops.
  - saulpw 1y ago
    Sounds like you've never managed tens of thousands of nodes in a distributed system. It's not trivial.
    - jjtheblunt 1y ago
      (elixir / otp says "hold my beer")
    - luckylion 1y ago
      What would making a C&C server for a botnet hard? It's not like you need to carefully coordinate all those clients to hit precise timings, you just tell them who to target and let them rip, don't you?
      - PcChip 1y ago
        Nothing. I did it with IRC servers in the late 90s when I was a dumb kid in high school
    - lolinder 1y ago

balanc 1y ago

Doesn’t Cloudflare have every incentive to inflate the bandwidth of the attack they have successfully mitigated? And yes I know that there are Cloudflare employees here so spare me with your pinky swears.

x2tyfi 1y ago
Couldn’t this logic apply to basically every internal metric across every company?
- udev4096 1y ago
  [flagged]
  - perching_aix 1y ago
    Speaking of incentives, what might be the incentives of those referring to them as Clownflare? I sure have to wonder what their biases are, and how fairly they represent the company.
  - eviks 1y ago
    How does it counter the incentives of all other companies to make it look like they're not the only one???
    - mlyle 1y ago
      Cloudflare has the biggest scale and is arguably best positioned to soak up massive attacks. Therefore CF may have a unique incentive to make it sound like attacks are larger and there are more really big ones.
      - eviks 1y ago
        > is arguably best positioned Lying about the scale of thwarted attacks by others is the counter argument

ksec 1y ago

If I dont want my user to have Cloudflare captcha or for example captcha dont work on my Safari 18.5 running on OpenCore Patcher MacBook 2015. What other options have I got?

immibis 1y ago
The simplest is to just wait until the attacker is bored, and/or daddy's credit card runs out. If you aren't doing any business, or not much business, through your site, this can be fine. Your hosting provider may either choose to let your server be overwhelmed with as many packets as its pipe can fit, or it may need to protect its network by discarding traffic to your IP address upstream of itself. It's probably a good idea to reach out to your hosting provider and let them know you're getting DDoSed. Even if they can't do anything about it (though there's a chance they can) they'll hopefully appreciate the heads up. True story: I ran a Pixelflut client for 38C3 from a Netcup server in Nuremberg (this somehow had better performance than running it on my tablet at the physical location) and they somehow thought 38C3 was DDoSing me and "helpfully" blackholed traffic between 38C3 and my server. --- It's important to stop thinking of DDoS as some magic hammer of Thor that you can't do anything about. DDoS packets, like all other packets, have source and destination addresses and flow through routers and links. When Cloudflare receives a 7-terabit DDoS, they aren't receiving 7 terabits through one link. Cloudflare operates a huge number of locations that pretend to be one coherent network. So they're receiving 100 gigabits in London, 100 gigabits in Frankfurt, 200 gigabits in NYC, etc. Their network architecture pretends like it's delivering all these packets to their destination addresses, but really, each location has its own completely different set of servers that all have the same addresses. (This is called anycast.) Each individual packet sender is only sending packets to the nearest Cloudflare node, where they're getting discarded. Likely, no individual node is overloaded by this, but when you aggregate the statistics from all of them, it adds up to a large amount of traffic. This is by the nature of a DDoS - it's devices all over the world attacking you, which means they're all coming by different routes. It's similar with hosting providers too, at least the big ones. Suppose you're on Hetzner: https://www.hetzner.com/unternehmen/rechenzentrum/ https://www.hetzner.com/unternehmen/rechenzentrum/ . They're not getting a terabit against your server through one link - they're getting 100Gbps through DE-CIX Frankfurt, 10Gbps through AMS-IX, 50Gbps through Telia in Nuremburg, 50Gbps through Telia in Helsinki, 50Gbps through Core-Backbone, etc. If they deploy a routing rule to the router on their end of each of those links, which says to discard packets where the destination address is yours, they can protect their network. Your site will still be down, of course. If one of their pipes does get overloaded (say their full 10Gbps from Baltnet in Frankfurt), they can reach out to that network (pretty much every serious network on the internet has a network operations center, reachable 24/7 by phone) and Baltnet will track it down further and block the traffic even closer to its source (or at a wider part of their network). If you're lucky and the DDoS traffic is just coming from a few "directions", users whose packets happen to come via a different direction may still be able to access your site. Suppose you're on Uncle Tom's Tiny Hosting Company Ltd (not real), they're certainly not the scale of Hetzner, and they only have a 10Gbps pipe between them and their ISP which is easily filled by a single attack. They'll have to contact their ISP to block traffic to your server so that the rest can get through, and their ISP will do the above stuff. None of this information will keep your site up during a DDoS, I just want to show you there's a depth to this DDoS thing and this Internet thing and it's not just magic.