6 ms·

I'm honestly kinda curious why nobody's blocking these IPs from sending data near the source. Like, I can come up with plenty of possible reasons, and reasons

• bombcar 1y ago
  There's no economic incentive for YOU (as the proximate ISP) to do anything about it, it would cost money, and cost you customers. Any idea why they don't fix it?
  • martinald 1y ago
    Of course there is. If you've got all your internet egress tied up with DDoS attacks from your network it is a big problem.
    • bombcar 1y ago
      I think we’re just starting to see attacks that big - which might start some practical mitigations (or they’ll just upgrade transit).
    • toast0 1y ago
      Most eyeball networks have a lot of inbound traffic and not very much outbound, but interconnections with other networks are almost always symmetric, so there's a lot of room for excess egress before it causes pain to the ISP. When I ran a large web site that attracted lots of DDoS, it didn't really seem worthwhile to track down the source and try to contact ISPs. I had done a lot of trying to track and stop people sending phishing mail under our name, and it's simply too much work to write a reasonable abuse report that is unlikely to be followed up on. With email, mostly people seem to accept the Received headers are probably true; with DDoS, you'd be sending them pcaps, and they'd be telling you it's probably spoofed, and unless I've got lots of peering, I'm not going to be able to get captures that are convincing... so just do my best to manage the inbound and call it a day.
  • Groxx 1y ago
    Yes, you generally see this kind of thing start from the pain-feelers and move up the chain to the pain-causers. So why hasn't that happened? These are clearly damaging to many, and ISPs are apparently doing next to nothing to prevent it, and it has been extremely clear for a while now that it's going to just become a bigger and bigger problem.
    • Hikikomori 1y ago
      How are you going to get an end customer to track down whatever device of theirs was hacked?
      • pixl97 1y ago
        As the ISP you don't care, you just cut off their connection to fix it. Said user will have to contact a local service to come out and find it.
        • Groxx 1y ago
          Made even easier by almost everyone running their local network off the ISP's hardware. Before they get cut off, have the router take a snapshot of what's using what ports, then go hunting.
      • bombcar 1y ago
        As a power user I don't know any way of even checking if I'm involved in a botnet. Is there something like that out there? Something that routers could install to monitor and report?
        • Hikikomori 1y ago
          Maybe Pi-hole and look for weird lookups? Home routers wont have anything useful, I can see bandwidth and log NAT etc on my Ubiquiti though.
      • deleted 1y ago
        [deleted]
  • userbinator 1y ago
    Are there ISPs that don't charge customers for the amount of bandwidth they consume? Even "unlimited" has been ruled by courts to not really mean "unlimited", after all.
    • fukka42 1y ago
      Yes, most if not all of them. Is it different in the US?
      • bombcar 1y ago
        Most non-mobile ISPs will let you get pretty high on bandwidth usage before they flag you; and since DDoS are almost always relatively low-levels of bandwidth (on the source) it's unlikely you'd get flagged.
    • Hikikomori 1y ago
      Most in Europe doesn't. Back when I first got 100/100 fiber I uploaded almost 30TB in a month and the only complaint I got was from the torrent site.
• Mindless2112 1y ago
  > “The outbound and cross-bound DDoS attacks can be just as disruptive as the inbound stuff,” Dobbin said. “We’re now in a situation where ISPs are routinely seeing terabit-per-second plus outbound attacks from their networks that can cause operational problems.” ISPs are starting to feel the pain, so perhaps in the near future they will do something about it.
  • dloy 1y ago
    Perhaps, or perhaps not. Maybe if we held them accountable they would?
• kibbel 1y ago
  A large part of the article is dedicated to this, noting how disruptive it is to other services and customers, and listing a few countermeasures (detection and blocking at the ISP level, detection and blocking at the router level, and educating customers on not buying vulnerable IoT trash).
  • Groxx 1y ago
    Not really? At best it's "DDOS prevention sellers are having trouble" and "ISPs say they're doing fine". The vast majority of the article is talking about the various kinds of malware causing this, and how some have been "fixed" by stopping the individuals running it (which clearly doesn't work very well, new ones just fill the void). Or this: >“The crying need for effective and universal outbound DDoS attack suppression is something that is really being highlighted by these recent attacks,” Dobbins continued. “A lot of network operators are learning that lesson now, and there’s going to be a period ahead where there’s some scrambling and potential disruption going on.” Uh. No. That's gross negligence if they are only starting to think about it now - the trend has been clear for over a decade, and the IoT threat has been obvious since day 1 and even blasted over public news for the past few years. Their status is pretty much only one of: incompetent, malicious, or they have had plans but haven't acted on them fast enough or strongly enough for [some reason], and that reason isn't something I've seen. Surprises happen, prevention costs money and time, and there are plenty of reasons why everyone isn't already prepared for everything, so I think "incompetent or malicious" is pretty rare.... but what are those reasons?
• MartijnBraam 1y ago
  This does happen, but it seems to depend on the ISP. In the Netherlands I've seen ISPs block the internet connectivity when they've detected infected devices, sometimes they send a letter before blocking and some ISPs seem to dump your internet connection in a captive portal. In all these cases it's been enough to call the ISP after finding the problem and you're connected again minutes later.
• TZubiri 1y ago
  > They can then turn around and lambast / sue / etc the company that sold it, putting pressure on the source of the problem Or just unplug the culprit. But the key seems to be that the device continues working. Ideally you would just shutdown or disconnect the device. If fridge is infected, the fridge can still fridge, but it no longer has internet privileges.
  • quantummagic 1y ago
    Any device that participates in a DDOS needs to be recalled by the manufacturer, mandated by law. Make it potentially economically crippling to sell a vulnerable device, and security will be taken very seriously. Frivolous uses of tech, won't be worth the risk.
    • DaSHacka 1y ago
      This just in: every computer manufacturer forced to recall every single computer model they've ever sold because some users use weak passwords. I can't wait for all of them to switch to IOS-ified devices incapable of installing alternative operating systems or programs, as that would be the inevitable end solution for all these manufacturers if this was implemented.
      • quantummagic 1y ago
        Maybe that's a good thing; relying on users to choose good passwords is a cop-out. Systems should be safe-by-default. And owners losing their system if it participates in a DDOS, would add to the incentives to stop the nonsense. It persists because perpetrators, and those who unwittingly abet them, feel no consequences.
        • DaSHacka 1y ago
          At that point, you should force the pain on the individual themselves. Why should all of us be handicapped because there's a couple morons that can't set decent passwords and connect their devices directly to the internet? Even if the device removed the capability for passwords and used key based authentication, connecting it directly to the internet means if there's ever a vulnerability, all that was for naught anyway.