8 ms·
This really is a function of two things: 1) (Mainly) the huge increase in upstream capacity of residential broadband connections with FTTH. It's not uncommon f
by martinald 1y ago
This really is a function of two things:
1) (Mainly) the huge increase in upstream capacity of residential broadband connections with FTTH. It's not uncommon for homes to have 2gbit/sec up now and certainly 1gbit/sec is fairly commonplace, which is an enormous amount of bandwidth compared to many interconnects. 10, 40 and 100gbit/sec are the most common and a handful of users can totally saturate these.
2) Many more powerful IoT devices that can handle this level of attack outbound. A $1 SoC can easily handle this these days.
3) Less importantly, CGNAT is a growing problem. If you have 10k (say) users on CGNAT that are compromised, it's likely that there's at least 1 on each CGNAT IP. This means you can't just null route compromised IPs as you are effectively null routing the entire ISP.
I think we probably need more government regulation of these IoT devices. For example, having a "hardware" limit of (say) 10mbit/sec or less for all networking unless otherwise required. 99% all of them don't need more than this.
- devwastaken 1y ago1gb upload is extraordinarily rare.
- saagarjha 1y agoIt’s not; most places that give you gigabit fiber will give you a symmetric connection.
- vitaflo 1y agoMost places do not have fiber.
- Dylan16807 1y agoWe know. The problem is that the above comment said "extraordinarily rare" which is a very different and incorrect threshold.
- ls612 1y agoThis is probably technically true but very misleading. Fiber penetration in the US has been consistently rising for over a decade now and it is not at all uncommon to have either Google Fiber, Fios, or a local fiber provider available to you in a big city. I bet within the next decade most places will have gigabit fiber available.
- _carbyau_ 1y agoThe US is a big place. But the world is bigger. The internet works across the whole world. There's a long way to go before fibre is commonplace across the world.
- Xss3 1y agoThere are probably more English speakers using the Internet in India than there are in the USA...Let alone the hundreds of millions elsewhere. You cant just assume everyone is talking about your country online.
- shagmin 1y agoDoes it really matter? The grandparent comment states the bandwidth is becoming even more readily available in the US, while the article itself says the bots were largely hosted by US ISPs, and that's obviously enough bandwidth to already cause global disruptions. But that's just the source of the attack, and who is on the receiving end is another. I get being too US-centric, but I think it's interesting if the US has the right combination of hosting tons of infected devices and having the bandwidth to use them on a much larger scale compared to other countries and possible implications.
- Cody-99 1y agoYou can assume the county when it is in the title. >DDoS Botnet Aisuru Blankets US ISPs in Record DDoS
- dylan604 1y agoBut for those that do...symmetric is the norm. The number of fiber connections is only going up.
- devwastaken 1y agosymmetric is not the norm. the infra costs are not worth it. symmetric is primarily a business offering.
- typpilol 1y agoYup. Spectrum is Michigan will give you up to 2gbps down but not anything more than 200mbps up
- zokier 1y agoAren't most residential fiber deployments PONs which generally do not offer symmetric bandwidth? E.g. 10G-PON has 10G down / 2.5G up.
- Hikikomori 1y agoDepends on country, its not common here.
- Xss3 1y agoDefine most places? I know i dont get one (uk) and neither does my german friend or texan friend. I've only ever seen one despite having used 4 different ISPs for gigabit, and that one was special. It was in an apartment i rented in a converted office tower, line was done via a b2b provider then included in the rent.
- saagarjha 1y agoI'm in the US and most fiber providers (I checked a handful: AT&T, Sonic, Google Fiber, Frontier) all provide symmetric connections.
- devwastaken 1y agoNope. less than a percent of a percent. symmetric plans are extra cost and offered primarily to business. almost all homes have no ability to exceed gigabit. infact almost all new homes dont even have data wiring. people just want their netflix to work on wifi.
- saagarjha 1y agoI didn't pay anything extra for symmetric.
- nick32661123 1y agoSeems more likely that residential modems will be required to use ISP-provided equipment that has government mandated chips, firmware, etc to filter outbound traffic for DDoS prevention.
- toast0 1y ago> 3) Less importantly, CGNAT is a growing problem. If you have 10k (say) users on CGNAT that are compromised, it's likely that there's at least 1 on each CGNAT IP. This means you can't just null route compromised IPs as you are effectively null routing the entire ISP. Null routing is usually applied to the targets of the attack, not the sources. If one of your IPs is getting attacked, you null route it, so upstream routers drop traffic instead of sending it to you.
- martinald 1y agoSorry, late here. You are right. I mean filter the IP in question.
- deleted 1y ago[deleted]
- bsder 1y ago> If you have 10k (say) users on CGNAT that are compromised, it's likely that there's at least 1 on each CGNAT IP. This means you can't just null route compromised IPs as you are effectively null routing the entire ISP. How about we actually finally roll out IPv6 and bury CGNAT in the graveyard where it belongs? Suddenly, everybody (ISPs, carriers, end users) can blackhole a compromised IP and/or IP range without affecting non-compromised endpoints. And DDoS goes poof. And, as a bonus, we get the end to end nature of the internet back again.
- rectang 1y agoIs it advantageous to be someone who supports IPv6 on a day like today?
- lgeek 1y agoFrom having worked on DDoS mitigation, there's pretty much no difference between CGNAT and IPv6. Block or rate limit an IPv4 address and you might block some legitimate traffic if it's a NAT address. Block a single IPv6 address... And you might discover that the user controls an entire /64 or whatever prefix. So if you're in a situation where you can't filter out attack trafic by stateless signature (which is pretty bad already), you'll probably err on the side of blocking larger prefixes anyway, which potentially affect other users, the same as with CGNAT. Insofar as it makes a difference for DDoS mitigation, the scarcity of IPv4 is more of a feature than a bug.
- spongebobstoes 1y agoyou can heuristically block ipv6 prefixes on a big enough attack by blocking a prefix once a probabilistic % of nodes under it are themselves blocked, I think it should work fairly well, as long as attacking traffic has a signature. consider simple counters "ips with non-malicious traffic" and "ips with malicious traffic" to probabilistically identify the cost/benefit of blocking a prefix. you do need to be able to support huge block lists, but there isn't the same issue as cgnat where many non-malicious users are definitely getting blocked.
- zamadatix 1y ago
- gjsman-1000 1y ago> I think we probably need more government regulation of these IoT devices. For example, having a "hardware" limit of (say) 10mbit/sec or less for all networking unless otherwise required. 99% all of them don't need more than this. What about DDoSs that come from sideloaded, unofficial, buggy, or poorly written apps? That's what IoT manufacturers will point to, and where most attacks historically come from. They'll point to whether your Mac really needs more than 100mbps. The government is far more likely to figure it out along EU lines: Signed firmware, occasional reboots, no default passwords, mandatory security updates for a long-term period, all other applicable "common sense" security measures. Signed firmware and the sideloading ID requirements on Android also helps to prevent stalkerware, which is a growing threat far scarier than some occasional sideloaded virus or DDoS attack. Never assume sideloading is consensual.
- ShowalkKama 1y ago>What about DDoSs that come from sideloaded, unofficial, buggy, or poorly written apps? That's what IoT manufacturers will point to, and where most attacks historically come from. any source for this claim? Outside of very specific scenarios which differ significantly for the current botnet market (like manjaro sending too many requests to the aur or an android application embedding an url to a wikipedia image) I cannot remember one occourence of such a bug being versatile enough to create a new whole cybercrime market segment. >They'll point to whether your Mac really needs more than 100mbps. it does, because sometimes my computer bursts up to 1gbps for a sustained amount of time, unlike the average iot device that has a predictable communication pattern. >Signed firmware and the sideloading ID requirements on Android also helps to prevent stalkerware, which is a growing threat far scarier than some occasional sideloaded virus or DDoS attack. Never assume sideloading is consensual. if someone can unlock your phone, go into the settings, enable installation of apps for an application (ex. a browser), download an apk and install it then they can do quite literally anything, from enabling adb to exfiltrating all your files.
- gjsman-1000 1y agoHistorically, it was called Windows XP and Vista about 15 years ago (Blaster, Sasser, MyDoom, Stuxnet, Conficker?). Microsoft clamped down, hard, across the board, but everyone outside of Big Tech is still catching up. Despite Microsoft's efforts, 911 S5 was roughly 19 million Windows PCs in 2024, in news that went mostly under the radar. It spread almost entirely through dangerous "free VPN" apps that people installed all over the place. (Why is sideloading under attack so much lately? 19 million people thought it would make them more secure, and instead it turned their home internet into criminal gateways with police visits. I strongly suspect this incident, and how it spread among well-meaning security-minded people, was the invisible turning point in Big Tech against software freedom lately.) https://www.fbi.gov/investigate/cyber/how-to-identify-and-remove-vpn-applications-that-contain-911-s5-backdoors https://www.fbi.gov/investigate/cyber/how-to-identify-and-re... > if someone can unlock your phone, go into the settings, enable installation of apps for an application (ex. a browser), download an apk and install it then they can do quite literally anything, from enabling adb to exfiltrating all your files. Which is more important, and a growing threat? Dump all her photos once; or install a disguised app that pretends to be a boring stock app nobody uses, that provides ongoing access for years, with everything in real-time up to the minute? Increasingly it's the latter. She'll never suspect the "Samsung Battery Optimizer" or even realize it came from an APK. No amount of sandboxing and permissions can detect an app with a deliberately false identity.
- idiotsecant 1y agoHaha that last part is pretty wild. rather than worrying about systemic problems in the entire internet let's just make mandates crippling devices that China, where all these devices are made, will defffinitely 100% listen to. Sure, seems reasonable. Systems that rely on the goodwill of the entire world to function are generally pretty robust, after all.
- saagarjha 1y agoIf they don’t then the devices are not sold in the United States. It’s quite simple.
- dylan604 1y agoGreat to know that smuggling hardware into the US has been completely stopped.
- morsch 1y agoIf the analysis above is accurate, a few smuggled devices would not be an issue, as long as the zillions of devices sold at Walmart are compliant.
- idiotsecant 1y agoCongratulations on the creation of a thriving new black market in which the main beneficiary is organized crime! What could go wrong?
- saagarjha 1y agoDo you take issue with the concept of laws or are you just being annoying?
- idiotsecant 1y agoI'm sorry that you find thinking about second order dynamics annoying, but that's what you have to do if you actually want effective laws. Just making laws doesn't magically fix problems. In many cases it just makes much more exciting problems.
- high_na_euv 1y ago> A $1 SoC can easily handle this these days. Could you elaborate?
- pjc50 1y agoI think there's some exaggeration as few $1 SoC parts come with 10G Ethernet, and >1G to the home is not common, but pretty much any home router can saturate its own uplink - it would be useless if it couldn't!
- sekh60 1y agoNot always the case. Generating traffic can be more computationally intense than routing the traffic. I've done speed tests on a few routers local to it and the results have been less than stellar compared to getting expected results with it just routing traffic (consumer routers). Granted these tests were a few years ago and things have progressed, but how often are people upgrading their routers?
- kees99 1y agoCorrect. Also, most 1Gbit/s and faster routers have hardware-accelerated packet forwarding, aka "flow offloading", aka "hardware NAT", where forwarded packets mostly don't touch software at all. Some routers even have internal "CPU" port of packet core with significantly slower line rate than that of external ports'. So traffic that terminates/originates at the router is necessarily quite a bit slower, regardless of possibly extra-beefy processor, and efficient software. Not really a problem since that traffic would normally be limited to UI, software updates, ARP/NDP/DHCP, and occasional first packet of a forwarded network connection.
- martinald 1y agoA Allwinner H616 is Quad-Core ARM and can definitely saturate gigabit ethernet with packet generation.