4 ms·

> A total of 34,500 ports were targeted, indicating the thoroughness and well-engineered nature of the attack. How is that more complicated than a for-loop?

by smokel 1y ago

ukuina 1y ago
Because it's a distributed for loop?
- lolinder 1y ago
  Not necessarily. It could be one for loop running on tens of thousands of compromised IoT devices, with the only thing distributed being the command that starts the loops.
  - saulpw 1y ago
    Sounds like you've never managed tens of thousands of nodes in a distributed system. It's not trivial.
    - jjtheblunt 1y ago
      (elixir / otp says "hold my beer")
    - luckylion 1y ago
      What would making a C&C server for a botnet hard? It's not like you need to carefully coordinate all those clients to hit precise timings, you just tell them who to target and let them rip, don't you?
      - PcChip 1y ago
        Nothing. I did it with IRC servers in the late 90s when I was a dumb kid in high school
    - lolinder 1y ago
      Coordinating a botnet to launch a DDoS is commodity software at this point. You could argue that the engineering that went into the coordination software is good, which may or may not be true, but simply launching a botnet is well within the capabilities of a script kiddie and not something that shows sophistication on the part of the attacker.
blitq 1y ago
It’s not :)
monster_truck 1y ago
You can't just spray every port blindly if you are maximally trying to disrupt, there is nuance to it.
- lolinder 1y ago
  Right. So why does the fact that they targeted 34,500 ports show it was a well-engineered attack? By itself it's just evidence that they know how to iterate over ports. Coupled with the data size (7.3Tbps) we know they had an enormous botnet. None of this points to a well-engineered attack, it just means that lousy IoT has made botnets incredibly cheap. A well-engineered attack would not draw headlines for its scale because it would take down its target without breaking any records.
  - motorest 1y ago
    > A well-engineered attack would not draw headlines for its scale because it would take down its target without breaking any records. You don't hear much about DDoS that are either comparable in size or bring down targets. How do you explain why this one made the news in spite of not having met your arbitrary and personal bar?
    - rob_c 1y ago
      [flagged]
    - lolinder 1y ago
      Like I said: it broke records for data throughput. It doesn't hurt that Cloudflare has an interest in publicizing the size of the DDoS attacks it fights off. > in spite of not having met your arbitrary and personal bar? I'm not sure what you mean by this. I didn't establish any sort of bar for what sorts of DDoS should get headlines, I'm just agreeing with OP that that line in the article doesn't make any sense. There may be other reasons to believe this attack was well-engineered but the article doesn't get into them.
      - 1y ago

> A total of 34,500 ports were targeted, indicating the thoroughness and well-engineered nature of the attack. How is that more complicated than a for-loop?

by smokel 1y ago

> A total of 34,500 ports were targeted, indicating the thoroughness and well-engineered nature of the attack. How is that more complicated than a for-loop?

ukuina 1y ago

Because it's a distributed for loop?

lolinder 1y ago
Not necessarily. It could be one for loop running on tens of thousands of compromised IoT devices, with the only thing distributed being the command that starts the loops.
- saulpw 1y ago
  Sounds like you've never managed tens of thousands of nodes in a distributed system. It's not trivial.
  - jjtheblunt 1y ago
    (elixir / otp says "hold my beer")
  - luckylion 1y ago
    What would making a C&C server for a botnet hard? It's not like you need to carefully coordinate all those clients to hit precise timings, you just tell them who to target and let them rip, don't you?
    - PcChip 1y ago
      Nothing. I did it with IRC servers in the late 90s when I was a dumb kid in high school
  - lolinder 1y ago
    Coordinating a botnet to launch a DDoS is commodity software at this point. You could argue that the engineering that went into the coordination software is good, which may or may not be true, but simply launching a botnet is well within the capabilities of a script kiddie and not something that shows sophistication on the part of the attacker.

blitq 1y ago

It’s not :)

monster_truck 1y ago

You can't just spray every port blindly if you are maximally trying to disrupt, there is nuance to it.

lolinder 1y ago
Right. So why does the fact that they targeted 34,500 ports show it was a well-engineered attack? By itself it's just evidence that they know how to iterate over ports. Coupled with the data size (7.3Tbps) we know they had an enormous botnet. None of this points to a well-engineered attack, it just means that lousy IoT has made botnets incredibly cheap. A well-engineered attack would not draw headlines for its scale because it would take down its target without breaking any records.
- motorest 1y ago
  > A well-engineered attack would not draw headlines for its scale because it would take down its target without breaking any records. You don't hear much about DDoS that are either comparable in size or bring down targets. How do you explain why this one made the news in spite of not having met your arbitrary and personal bar?
  - rob_c 1y ago
    [flagged]
  - lolinder 1y ago
    Like I said: it broke records for data throughput. It doesn't hurt that Cloudflare has an interest in publicizing the size of the DDoS attacks it fights off. > in spite of not having met your arbitrary and personal bar? I'm not sure what you mean by this. I didn't establish any sort of bar for what sorts of DDoS should get headlines, I'm just agreeing with OP that that line in the article doesn't make any sense. There may be other reasons to believe this attack was well-engineered but the article doesn't get into them.
    - 1y ago