5 ms·

Spamhaus DDOS Suspect Arrested

45 points by dylangs1030 13y ago

dylangs1030 13y ago
In case you're unaware of what Spamhaus is, its severity as a DDOS, and the ongoing investigation into its operations, read here: http://arstechnica.com/security/2013/03/spamhaus-ddos-grows-to-internet-threatening-size/ http://arstechnica.com/security/2013/03/spamhaus-ddos-grows-...
- sillysaurus2 13y ago
  I think it's a marvelous feat of engineering that people were able to prevent Spamhaus from being knocked offline by that massive DDoS. http://arstechnica.com/security/2013/03/how-whitehats-stopped-the-ddos-attack-that-knocked-spamhaus-offline/ http://arstechnica.com/security/2013/03/how-whitehats-stoppe...
  - codexon 13y ago
    Anycast isn't difficult to implement and is widely used to create CDNs. It is simply costly. You need to buy a large block of IPs and have multiple data centers. After you have that, it is trivial to block all DNS packets, especially due to the fact that Cloudflare doesn't need to receive DNS packets on their public endpoints because they only serve HTTP traffic.
    - sillysaurus2 13y ago
      Hmm, is it very hard to DDoS DNS servers? I'm a bit confused about the DNS part of what you said.
      - codexon 13y ago
        Not to be rude but if you don't understand what I just said, you might want to re-read the article you just cited.
        sillysaurus2 13y ago
        You are being rude, but I care about learning more than rudeness, so if you'll kindly help me out: But DNS servers can also be queried for the IP addresses of huge swaths of the Internet, putting the person listed as making the request on the receiving end of a massive response. In a blog post published Wednesday, CloudFlare CEO Matthew Prince said each DNS request sent by the Spamhaus attackers was likely only 36 bytes long, while each response was about 3,000 bytes. By spoofing the requests to make them appear as if they originated with Spamhaus, the attackers can turn the firepower of all those networks against their opponent, all but guaranteeing it won't be available to process legitimate traffic. I'm still not really getting it. Which IP addresses are they referring to when they say "huge swaths of the internet"? To get Spamhaus back online, CloudFlare relied on Anycast, a routing technique that distributes the same IP address across 23 data centers across the world. Internet traffic almost always chooses the shortest physical path. Anycast allows the geographically dispersed junk traffic to be absorbed by dozens of individual centers, where each packet is then inspected. When it bears signatures found in the attack traffic—for example, if it's a 3,000-byte response from an open DNS resolver—it is discarded in the CloudFlare data center. Only Legitimate Web requests are allowed to be forwarded to the Spamhaus data center. How do they differentiate between a legit query and a DDoS query?
        imbriaco 13y ago
        The "huge swaths of the internet" part is poorly phrased in the article. What they're basically saying is that there are a large number of DNS servers on the Internet that allow anyone to query them. Attackers query those servers and forge the source address that the query originates from such that it points at the IP address of their target. The attacker needs only send 36 bytes of data to the DNS server and the server responds with up to thousands of bytes of response -- directly at the target of the attack. I don't know precisely how CloudFlare mitigated it but I can make some guesses: - They may have just blocked UDP traffic on their edge. Since their DDoS mitigation service is specifically for HTTP and HTTPS, UDP is safe to simply drop. - They may have determined that the attack responses had payloads that fell within a size range, and configured their mitigation hardware or routers to drop packets in that size envelope. - They may have analyzed inbound UDP traffic to see what open resolvers were flooding them and surgically blocked UDP traffic from those IPs.
    - pizzeys 13y ago
      Is it trivial to block all DNS if your core business is serving records over DNS, though?
gojomo 13y ago
[April 29, 2013] Previous submissions about this around that time: https://news.ycombinator.com/item?id=5614179 https://news.ycombinator.com/item?id=5614179 https://news.ycombinator.com/item?id=5613891 https://news.ycombinator.com/item?id=5613891
codexon 13y ago
That's nice but what do start-ups and other less famous organizations do? Any competitor can buy a 30+ gbps attack for a few dollars. http://hackforums.net/forumdisplay.php?fid=232 http://hackforums.net/forumdisplay.php?fid=232 And it costs $2000/month just for 20 gbps of protection. https://www.staminus.net/ddos-protection https://www.staminus.net/ddos-protection https://ordering.blacklotus.net/cart.php?pid=10 https://ordering.blacklotus.net/cart.php?pid=10 DDoS attacks are going to get larger and more frequent.
- jamesaguilar 13y ago
  I wager it's pretty rare for the following conditions to exist simultaneously: - Small enough that $2k a month is a serious spend. - Big enough to draw the attention of someone who cares to DDoS you. - Important enough to one's customers that a few hours of downtime is a serious issue. If you somehow cause all three to exist at once, either you're going out of your way to piss off the wrong people, or you're not charging enough. (Also, there's always the option to roll your own DDoS protection. It's complicated, but not super complicated, at least for a 90% solution. If I'm not mistaken, it basically involves detecting anomalous traffic and telling upstream routers that you don't exist for the source IP generating that traffic. Someone who knows more about it might be able to fill in some details.)
  - codexon 13y ago
    $2k is just the beginning. If you looked at the forum I just posted, attacks can go up to 60 gbps and still only cost a couple of dollars. This can easily cost as much as a full time employee, and many large sites can be run by 1-2 people. Having to spend 33% more just to stay online is not negligible. You can't just roll your own DDoS protection. If you do this you are looking at rolling your own data centers. Once an attack gets bigger than the port at one of your standard hosts, your host is going to null route you and even kick you off if it happens too often. You are going to be hard pressed to find a host that is willing to broadcast your /24, let alone getting a /24 with this IP shortage if you were going to do your own cloudflare. "If I'm not mistaken, it basically involves detecting anomalous traffic and telling upstream routers that you don't exist for the source IP generating that traffic." This is called null routing. It involves telling your upstream that the IP can't be routed to. This blocks ALL traffic to that IP so your port doesn't get maxed. Large transit providers are going to charge you an arm and a leg to give you an API to insert ACLs because routers have a limited number of rules.
txutxu 13y ago
Blink: "Spanish police said that upon his arrest, the suspect identified himself as a diplomat, saying he was the Minister of Telecommunications and Foreign Affairs for the Republic of Cyberbunker." I think from monday, at work, I will identify myself as a diplomat, the "Minister of Telecommunications and Foreign Affairs of the Republic of the Local Domain". Sounds nice.
Core-TX 13y ago
Spamhaus does not only build the Autobahn, but also enforces American definitions and trade policy whenever disputes arise.
SchizoDuckie 13y ago
Why is there an article from 4 months ago on the frontpage?
D9u 13y ago
If being attacked with a DDoS why not set the source of the attacks as the address to resolve your IP address to?
- kyrra 13y ago
  It depends on the type of DOS attack being used by the attackers. If they are using a SYN attack you can change the source ip as you don't care to hear back. But a SYN attack can be mitigated a bit easier once you know about it. If you are doing a more application specific attack, you need to establish a connection (assuming it is TCP), so you can't hide you IP in that case.
  - D9u 13y ago
    It's not "hiding" your IP address, it's changing your affected nameservers to that of the attacker.
- deleted 13y ago
  [deleted]

45 points by dylangs1030 13y ago

In case you're unaware of what Spamhaus is, its severity as a DDOS, and the ongoing investigation into its operations, read here: http://arstechnica.com/security/2013/03/spamhaus-ddos-grows-to-internet-threatening-size/ http://arstechnica.com/security/2013/03/spamhaus-ddos-grows-...

sillysaurus2 13y ago
I think it's a marvelous feat of engineering that people were able to prevent Spamhaus from being knocked offline by that massive DDoS. http://arstechnica.com/security/2013/03/how-whitehats-stopped-the-ddos-attack-that-knocked-spamhaus-offline/ http://arstechnica.com/security/2013/03/how-whitehats-stoppe...
- codexon 13y ago
  Anycast isn't difficult to implement and is widely used to create CDNs. It is simply costly. You need to buy a large block of IPs and have multiple data centers. After you have that, it is trivial to block all DNS packets, especially due to the fact that Cloudflare doesn't need to receive DNS packets on their public endpoints because they only serve HTTP traffic.
  - sillysaurus2 13y ago
    Hmm, is it very hard to DDoS DNS servers? I'm a bit confused about the DNS part of what you said.
    - codexon 13y ago
      Not to be rude but if you don't understand what I just said, you might want to re-read the article you just cited.
      - sillysaurus2 13y ago
        You are being rude, but I care about learning more than rudeness, so if you'll kindly help me out: But DNS servers can also be queried for the IP addresses of huge swaths of the Internet, putting the person listed as making the request on the receiving end of a massive response. In a blog post published Wednesday, CloudFlare CEO Matthew Prince said each DNS request sent by the Spamhaus attackers was likely only 36 bytes long, while each response was about 3,000 bytes. By spoofing the requests to make them appear as if they originated with Spamhaus, the attackers can turn the firepower of all those networks against their opponent, all but guaranteeing it won't be available to process legitimate traffic. I'm still not really getting it. Which IP addresses are they referring to when they say "huge swaths of the internet"? To get Spamhaus back online, CloudFlare relied on Anycast, a routing technique that distributes the same IP address across 23 data centers across the world. Internet traffic almost always chooses the shortest physical path. Anycast allows the geographically dispersed junk traffic to be absorbed by dozens of individual centers, where each packet is then inspected. When it bears signatures found in the attack traffic—for example, if it's a 3,000-byte response from an open DNS resolver—it is discarded in the CloudFlare data center. Only Legitimate Web requests are allowed to be forwarded to the Spamhaus data center. How do they differentiate between a legit query and a DDoS query?
        imbriaco 13y ago
        The "huge swaths of the internet" part is poorly phrased in the article. What they're basically saying is that there are a large number of DNS servers on the Internet that allow anyone to query them. Attackers query those servers and forge the source address that the query originates from such that it points at the IP address of their target. The attacker needs only send 36 bytes of data to the DNS server and the server responds with up to thousands of bytes of response -- directly at the target of the attack. I don't know precisely how CloudFlare mitigated it but I can make some guesses: - They may have just blocked UDP traffic on their edge. Since their DDoS mitigation service is specifically for HTTP and HTTPS, UDP is safe to simply drop. - They may have determined that the attack responses had payloads that fell within a size range, and configured their mitigation hardware or routers to drop packets in that size envelope. - They may have analyzed inbound UDP traffic to see what open resolvers were flooding them and surgically blocked UDP traffic from those IPs.
  - pizzeys 13y ago
    Is it trivial to block all DNS if your core business is serving records over DNS, though?

gojomo 13y ago

[April 29, 2013] Previous submissions about this around that time: https://news.ycombinator.com/item?id=5614179 https://news.ycombinator.com/item?id=5614179 https://news.ycombinator.com/item?id=5613891 https://news.ycombinator.com/item?id=5613891

codexon 13y ago

That's nice but what do start-ups and other less famous organizations do? Any competitor can buy a 30+ gbps attack for a few dollars. http://hackforums.net/forumdisplay.php?fid=232 http://hackforums.net/forumdisplay.php?fid=232 And it costs $2000/month just for 20 gbps of protection. https://www.staminus.net/ddos-protection https://www.staminus.net/ddos-protection https://ordering.blacklotus.net/cart.php?pid=10 https://ordering.blacklotus.net/cart.php?pid=10 DDoS attacks are going to get larger and more frequent.

jamesaguilar 13y ago
I wager it's pretty rare for the following conditions to exist simultaneously: - Small enough that $2k a month is a serious spend. - Big enough to draw the attention of someone who cares to DDoS you. - Important enough to one's customers that a few hours of downtime is a serious issue. If you somehow cause all three to exist at once, either you're going out of your way to piss off the wrong people, or you're not charging enough. (Also, there's always the option to roll your own DDoS protection. It's complicated, but not super complicated, at least for a 90% solution. If I'm not mistaken, it basically involves detecting anomalous traffic and telling upstream routers that you don't exist for the source IP generating that traffic. Someone who knows more about it might be able to fill in some details.)
- codexon 13y ago
  $2k is just the beginning. If you looked at the forum I just posted, attacks can go up to 60 gbps and still only cost a couple of dollars. This can easily cost as much as a full time employee, and many large sites can be run by 1-2 people. Having to spend 33% more just to stay online is not negligible. You can't just roll your own DDoS protection. If you do this you are looking at rolling your own data centers. Once an attack gets bigger than the port at one of your standard hosts, your host is going to null route you and even kick you off if it happens too often. You are going to be hard pressed to find a host that is willing to broadcast your /24, let alone getting a /24 with this IP shortage if you were going to do your own cloudflare. "If I'm not mistaken, it basically involves detecting anomalous traffic and telling upstream routers that you don't exist for the source IP generating that traffic." This is called null routing. It involves telling your upstream that the IP can't be routed to. This blocks ALL traffic to that IP so your port doesn't get maxed. Large transit providers are going to charge you an arm and a leg to give you an API to insert ACLs because routers have a limited number of rules.

txutxu 13y ago

Blink: "Spanish police said that upon his arrest, the suspect identified himself as a diplomat, saying he was the Minister of Telecommunications and Foreign Affairs for the Republic of Cyberbunker." I think from monday, at work, I will identify myself as a diplomat, the "Minister of Telecommunications and Foreign Affairs of the Republic of the Local Domain". Sounds nice.

Core-TX 13y ago

Spamhaus does not only build the Autobahn, but also enforces American definitions and trade policy whenever disputes arise.

SchizoDuckie 13y ago

Why is there an article from 4 months ago on the frontpage?

D9u 13y ago

If being attacked with a DDoS why not set the source of the attacks as the address to resolve your IP address to?

kyrra 13y ago
It depends on the type of DOS attack being used by the attackers. If they are using a SYN attack you can change the source ip as you don't care to hear back. But a SYN attack can be mitigated a bit easier once you know about it. If you are doing a more application specific attack, you need to establish a connection (assuming it is TCP), so you can't hide you IP in that case.
- D9u 13y ago
  It's not "hiding" your IP address, it's changing your affected nameservers to that of the attacker.
deleted 13y ago
[deleted]