5 ms·
Not a 100% solution but would help greatly if ISPs: 1) performed egress filtering to prevent spoofing arbitrary source addresses 2) temporarily shut off custo
by alyandon 1y ago
Not a 100% solution but would help greatly if ISPs:
1) performed egress filtering to prevent spoofing arbitrary source addresses
2) temporarily shut off customers that are sending a large volume of malicious traffic
- dijit 1y agoLargely they do these things, it’s just not completely automatic.
- alberth 1y ago> sending a large volume of malicious traffic How would an ISP determine egress is malicious? Genuinely curious.
- markrages 1y agohttps://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt
- alyandon 1y agoIf someone is reporting malicious traffic coming from the ISP's network then an ISP should be obligated to investigate and shut off the offending customer if necessary until they've resolved the problem.
- cyral 1y agoHow would this ever work at scale? These attacks come from thousands of compromised devices usually. e.g. Someone's smart fridge with 5 year old firmware gets exploited
- alyandon 1y agoI don't have a specific answer for that but it is really a problem that residential ISPs are going to have to solve now that gigabit or faster symmetric internet connections are becoming the norm.
- nhecker 1y agoAs dijit (above this comment) has noted, this is somewhat possible and automated today. For example, one method has the attacked IP get completely null-routed, and the subsequent route is advertised. Upstream routers will pick up the null-route advertisement and drop the traffic ever closer to the source(s). The effect of the null route is that the attacked IP is unreachable by anyone until the null-route is lifted... so the aim of the DDoS isn't averted, but at least the flood of traffic won't pummel any network paths except for (ideally) the paths between the attacker(s) and the first router respecting the null-route. In my experience the DDoS tends to stop more quickly and shift away to other targets if the folks directing the attack can no longer reach the target (because: null-route) and then the null-route can be lifted sooner relative to a long-running DDoS that hasn't shifted away to other targets.
- whstl 1y agoWith SMTP there are services who provide a list of malicious servers so that they can be blocked at the receiving end. I wonder if this would work in reverse, having a standardised, automated protocol that allow providers like Cloudflare to notify upstream networks of attacks in real time, so malicious traffic can be blocked closer to the source. Genuinely curious, I'm not an expert in low-level networking ops.
- viraptor 1y agoYour ISP likely knows you're part of a botnet quite early. For example many of them use magic domains as either shutoff switches or CC endpoints, so could be detected. But when was the last time anyone's ISP ever told them "hey one of your hosts is infected"?
- mschuster91 1y ago> How would this ever work at scale? We pay internet providers healthy amounts of money each month. Surely they can afford to hire some staff to monitor the abuse mailbox and react on it - we know they can when the MAFIAA comes knocking for copyright violations, because if they don't comply they might end up getting held liable for infractions.
- motorest 1y ago> How would this ever work at scale? - ISP has terms of service preventing abuse, - ISP provides an email address to receive complains about abuse - once a ISP receives a complain, their check if a customer abused their terms of service - once a ISP spots a customer abusing terms of service, they act upon it. ISPs have been doing this since the time ISPs exist.
- bityard 1y agoAll large ISPs have fancy network visibility and DDoS mitigation solutions.[1] But getting them to actually USE them for problems that aren't lighting up their monitoring dashboards is another story entirely. (1. I know this, because I used to work for a company that made them, and the majority of worldwide ISPs were our customers.)
- stackskipton 1y agoOne simple way to do it is configure the customers routers to drop/reject all UDP/TCP packets where SRC address does not match Private IP/WAN Assigned Public IP.
- Y_Y 1y agoThe customer's router is for the customer to configure
- __turbobrew__ 1y agoI think ideally the customers router shouldn’t be touched, but the ISP can still do packet filtering on the next hop to drop any packets which don’t have a src ip matching the assigned WAN address of the router.
- pedrocr 1y agoWouldn't that need a huge amount of extra hardware to do that filtering when the routers in each customer's home are mostly idle? Just setting egress filtering as the default and letting users override that if they need to for some reason should be a good outcome. The few that do change the default hopefully know what they are doing and won't end up part of a DDoS but they'll be few anyway so the impact will still be small.
- remram 1y agoThe router in the customer's home cannot be trusted. With cable at least, you are able to bring in your own modem and router. Even if not, swapping it is easy, you just have to clone the original modem's MAC. In practice this is probably quite common to save money if nothing else (cable box rental is $10+/mo). Note that spoofing source IPs is only needed by the attacker in an amplification attack, not for the amplyfing devices and not for a "direct" botnet DDOS.
- SoftTalker 1y ago
- zokier 1y agoHundreds of Gbps of UDP traffic to random ports of a single destination IP from residental (?) network should be pretty easy pattern to automatically detect and throttle. More advanced attacks are more tricky to detect, but plain dumb UDP flood should be easily detectable.
- quotemstr 1y ago> Hundreds of Gbps of UDP traffic to random ports of a single destination IP from residental (?) network You mean my legitimate QUIC file transfer?
- BenjiWiebe 1y agoHave you ever uploaded 100's of Gbps over QUIC from your residential connection to a single IP? And the aggregate across the ISP's network could in theory be monitored - so if you were uploading 1Gbps, yes, it could be legitimate. If you and 582 others were all uploading 1Gbps to the same IP at the same time, much less likely legitimate.
- quotemstr 1y ago> Have you ever uploaded 100's of Gbps over QUIC from your residential connection to a single IP? Yes actually --- migration between cloud bulk storage providers. Edit: I misread Gbps as Mbps above.
- zokier 1y agoWhich residential ISP offers >100Gbps service?
- ongy 1y agoMy homenet is 1GBit, so is my Internet I.e. no traffic beyond my legitimate saturation can reach the ISP I have saturated my link with quic or wireguard (logical or) plenty of times. The lack of any response on high data rates would be an indicator I've only tried that once and it failed gloriously due to congestion. I don't think there's many real protocols that are unidirectional without even ACKs