5 ms·

In my opinion, DDoS is possible only because there is no network protocol for a host to control traffic filtering on upstream providers (deny traffic from certa

In my opinion, DDoS is possible only because there is no network protocol for a host to control traffic filtering on upstream providers (deny traffic from certain subnets or countries). In this case everybody would prefer write their own systems rather than rely on a harmful monopoly.

powerpixel 11mo ago
> here is no network protocol for a host to control traffic filtering on upstream providers (deny traffic from certain subnets or countries). There is no network protocol per se, but there is commercial solutions like fortinet that can block countries iirc, but to note that it's only ip range based so it's not worth a lot
- wbl 11mo ago
  Unless you filter at the far end of the bottleneck you still go offline.
- jabart 11mo ago
  I'm pretty sure BGP magic will let you blackhole a whole subnet.
- mrktf 11mo ago
  I think parent means: there no network protocol which can propagate blocking in sane manner between providers (something like bgp for firewalls) edit: yes, you can you bgp to blockhole subnet traffic - the standard doesn't play well if you want blackhole unrelated subnets from upstream network
peanut-walrus 11mo ago
What traffic would you request the upstream providers to block if getting hit by Aisuru? Considering the botnet consists of residential routers, those are the same networks your users will be originating from. Sure, in best case, if your site is very regional, you can just block all traffic outside your country - but most services don't have this luxury. Blocking individual IP addresses? Sure, but consider that before your service detects enough anomalous traffic from one particular IP and is able to send the request to block upstream, your service will already be down from the aggregate traffic. Even a "slow" ddos with <10 packets per second from one source is enough to saturate your 10Gbps link if the attacker has a million machines to originate traffic from.
- amaccuish 11mo ago
  Could it not be argued that ISPs should be forced to block users with vulnerable devices? They have all the data on what CPE a user has, can send a letter and email with a deadline, and cut them off after it expires and the router has not been updated/is still exposed to the wide internet.
  - encom 11mo ago
    It could be argued that ISPs should not snoop on my traffic, barring a court order.
  - SJC_Hacker 11mo ago
    Xfinity did exactly this to me a few years ago. I wasn't compromised but tried running a blockchain node on my machine. The connection to the whole house was blocked off until I stopped it.
  - deleted 11mo ago
    [deleted]
  - hombre_fatal 11mo ago
    My dad’s small town ISP called him to say his household connection recently started saturating the link 24/7 and to look into whether a device had been compromised. (Turns out some raspi reseller shipped a product with empty uname/password) While a cute story, how do you scale that? And what about all the users that would be incapable of troubleshooting it, like if their laptop, roku, or smart lightbulb were compromised? They just lose internet? And what about a botnet that doesn’t saturate your connection, how does your ISP even know? They get full access to your traffic for heuristics? What if it’s just one curl request per N seconds? Not many good answers available if any.
    - mschuster91 11mo ago
      > While a cute story, how do you scale that? And what about all the users that would be incapable of troubleshooting it, like if their laptop, roku, or smart lightbulb were compromised? They just lose internet? Uh, yes. Exactly and plainly that. We also go and suspend people's driver licenses or at the very least seriously fine them if they misbehave on the road, including driving around with unsafe cars. Access to the Internet should be a privilege, not a right. Maybe the resulting anger from widespread crackdowns would be enough of a push for legislators to demand better security from device vendors. > And what about a botnet that doesn’t saturate your connection, how does your ISP even know? In ye olde days providers had (to have to) abuse@ mailboxes. Credible evidence of malicious behavior reported to these did lead to customers getting told to clean up shop or else.
gnfargbl 11mo ago
The recent Azure DDoS used 500k botnet IPs. These will have been widely distributed across subnets and countries, so your blocking approach would not have been an effective mitigation. Identifying and dynamically blocking the 500k offending IPs would certainly be possible technically -- 500k /32s is not a hard filtering problem -- but I seriously question the operational ability of internet providers to perform such granular blocking in real-time against dynamic targets. I also have concerns that automated blocking protocols would be widely abused by bad actors who are able to engineer their way into the network at a carrier level (i.e. certain governments).
- tw04 11mo ago
  It also completely overlooks the fact that some of the traffic has spoofed source IP addresses and a bad actor could use automated black holing to knock a legitimate site offline.
  - codedokode 11mo ago
    > a bad actor could use automated black holing to knock a legitimate site offline. No, in my concept the host can only manage the traffic targeted at it and not at other hosts.
    - tw04 11mo ago
      That already exists… that's part of cloudflare and other vendors mitigation strategy. There’s absolutely no chance ISPs are going to extend that functionality to random individuals on the internet.
- __alexs 11mo ago
  > 500k /32s is not a hard filtering problem Is this really true? What device in the network are you loading that filter into? Is it even capable of handling the packet throughput of that many clients while also handling such a large block list?
  - 11mo ago

powerpixel 11mo ago

> here is no network protocol for a host to control traffic filtering on upstream providers (deny traffic from certain subnets or countries). There is no network protocol per se, but there is commercial solutions like fortinet that can block countries iirc, but to note that it's only ip range based so it's not worth a lot

wbl 11mo ago
Unless you filter at the far end of the bottleneck you still go offline.
jabart 11mo ago
I'm pretty sure BGP magic will let you blackhole a whole subnet.
mrktf 11mo ago
I think parent means: there no network protocol which can propagate blocking in sane manner between providers (something like bgp for firewalls) edit: yes, you can you bgp to blockhole subnet traffic - the standard doesn't play well if you want blackhole unrelated subnets from upstream network

peanut-walrus 11mo ago

What traffic would you request the upstream providers to block if getting hit by Aisuru? Considering the botnet consists of residential routers, those are the same networks your users will be originating from. Sure, in best case, if your site is very regional, you can just block all traffic outside your country - but most services don't have this luxury. Blocking individual IP addresses? Sure, but consider that before your service detects enough anomalous traffic from one particular IP and is able to send the request to block upstream, your service will already be down from the aggregate traffic. Even a "slow" ddos with <10 packets per second from one source is enough to saturate your 10Gbps link if the attacker has a million machines to originate traffic from.

amaccuish 11mo ago
Could it not be argued that ISPs should be forced to block users with vulnerable devices? They have all the data on what CPE a user has, can send a letter and email with a deadline, and cut them off after it expires and the router has not been updated/is still exposed to the wide internet.
- encom 11mo ago
  It could be argued that ISPs should not snoop on my traffic, barring a court order.
- SJC_Hacker 11mo ago
  Xfinity did exactly this to me a few years ago. I wasn't compromised but tried running a blockchain node on my machine. The connection to the whole house was blocked off until I stopped it.
- deleted 11mo ago
  [deleted]
- hombre_fatal 11mo ago
  My dad’s small town ISP called him to say his household connection recently started saturating the link 24/7 and to look into whether a device had been compromised. (Turns out some raspi reseller shipped a product with empty uname/password) While a cute story, how do you scale that? And what about all the users that would be incapable of troubleshooting it, like if their laptop, roku, or smart lightbulb were compromised? They just lose internet? And what about a botnet that doesn’t saturate your connection, how does your ISP even know? They get full access to your traffic for heuristics? What if it’s just one curl request per N seconds? Not many good answers available if any.
  - mschuster91 11mo ago
    > While a cute story, how do you scale that? And what about all the users that would be incapable of troubleshooting it, like if their laptop, roku, or smart lightbulb were compromised? They just lose internet? Uh, yes. Exactly and plainly that. We also go and suspend people's driver licenses or at the very least seriously fine them if they misbehave on the road, including driving around with unsafe cars. Access to the Internet should be a privilege, not a right. Maybe the resulting anger from widespread crackdowns would be enough of a push for legislators to demand better security from device vendors. > And what about a botnet that doesn’t saturate your connection, how does your ISP even know? In ye olde days providers had (to have to) abuse@ mailboxes. Credible evidence of malicious behavior reported to these did lead to customers getting told to clean up shop or else.

gnfargbl 11mo ago

The recent Azure DDoS used 500k botnet IPs. These will have been widely distributed across subnets and countries, so your blocking approach would not have been an effective mitigation. Identifying and dynamically blocking the 500k offending IPs would certainly be possible technically -- 500k /32s is not a hard filtering problem -- but I seriously question the operational ability of internet providers to perform such granular blocking in real-time against dynamic targets. I also have concerns that automated blocking protocols would be widely abused by bad actors who are able to engineer their way into the network at a carrier level (i.e. certain governments).

tw04 11mo ago
It also completely overlooks the fact that some of the traffic has spoofed source IP addresses and a bad actor could use automated black holing to knock a legitimate site offline.
- codedokode 11mo ago
  > a bad actor could use automated black holing to knock a legitimate site offline. No, in my concept the host can only manage the traffic targeted at it and not at other hosts.
  - tw04 11mo ago
    That already exists… that's part of cloudflare and other vendors mitigation strategy. There’s absolutely no chance ISPs are going to extend that functionality to random individuals on the internet.
__alexs 11mo ago
> 500k /32s is not a hard filtering problem Is this really true? What device in the network are you loading that filter into? Is it even capable of handling the packet throughput of that many clients while also handling such a large block list?
- 11mo ago