5 ms·

Large DDoS strikes US, Europe

85 points by ndesaulniers 13y ago

Tepix 13y ago
If you haven't fixed your NTP server, it is probably part of this traffic amplification attack. Here's a description of the necessary configuration changes: http://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1401-ntp-monlist-network-traffic-amplification-attacks.htm http://www.meinbergglobal.com/english/news/meinberg-security...
- marcosdumay 13y ago
  I just got out to fix my machines, and I'm glad to say that Debian's default configuration is already right, nothing to fix there. Anyway, I'd encorage anybody to read the link and check, maybe you are not using the default, or maybe you are using an earlier version.
midhir 13y ago
"Cloudflare did not return a request for more information..." lol.
KerrickStaley 13y ago
Is 400 Gbps globally really that much?
- NKCSS 13y ago
  Pointed to a single target: yes.
- isaack 13y ago
  It may not be a good idea to measure DDoS merely based on the volume. For example, a 100Gbps L7 attack is much harder to mitigate than a 100Gbps L3 attack. [1] Also, some had previously questioned the accuracy of CloudFlare's figures. [2] [1] https://blogs.akamai.com/2013/03/how-big-is-300-gbps-really.html https://blogs.akamai.com/2013/03/how-big-is-300-gbps-really.... [2] http://www.techweekeurope.co.uk/news/prolexic-ceo-scott-hammack-biggest-cyber-attack-lies-spamhaus-113551 http://www.techweekeurope.co.uk/news/prolexic-ceo-scott-hamm...
- dsl 13y ago
  CloudFlare has 24 datacenters worldwide. That works out to 16 Gbps per DC if evenly distributed, or roughly 2 10 GigE circuits.
- Nyr 13y ago
  Obviously yes. Even for an anycast network like CloudFlare. Not that they can't mitigate it, but it's hard and not free to do so.
theknown99 13y ago
Is there a legitimate reason why any ISP / hosting provider etc allows traffic to exit with an IP that doesn't belong to them? Surely enforcing this would prevent any IP spoofing, which would cut down on these types of attacks? (As far as I'm aware in this type of attack you send packets purporting to be from your target, to anything on the internet that will blindly send back a reply. Hopefully the reply will be bigger/more packets than your request was, thus amplifying the bandwidth). If I'm mistaken please explain why...
- dsl 13y ago
  What you suggest is actually the default behavior of most major carriers. Its codified here: http://tools.ietf.org/html/bcp38 http://tools.ietf.org/html/bcp38 That said, source address spoofing is needed for some one-way satellite internet providers. There are also some really cool advanced load balancing tricks you can do with it. It even comes in handy (ironically) when doing DDoS mitigation.
  - theknown99 13y ago
    Is it the default behavior of major carriers in Russia/China/Africa/etc as well as in Europe/America? My experience has been that the majority of the countries where attacks come from do not really care.
    - Nyr 13y ago
      Yes, it is. But DDoS attacks to EU or the US aren't launched from China/Africa anyway. You need relatively low capacity to start an amplification attack, so a server at some ISP which doesn't care is enough. There are some ISPs which knowingly allow this, like Ecatel in The Netherlands which is probably the most notorious example.
- nmc 13y ago
  As dsl pointed out, this filtering is already enforced, but it presents caveats and limitations: http://tools.ietf.org/search/rfc3013#section-4.3 http://tools.ietf.org/search/rfc3013#section-4.3
annnnd 13y ago
NTP reflection attack technical explanation: http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks http://blog.cloudflare.com/understanding-and-mitigating-ntp-...
audessuscest 13y ago
The target is probably : http://egaliteetreconciliation.fr/ http://egaliteetreconciliation.fr/ Edit : French customer, use cloudflare and OVH. Is strongly attacked by ddos since yesterday
- jokoon 13y ago
  yeah right, another blurb of conspiracy theorists. who cares about those guys anyway.
  - audessuscest 13y ago
    A lot of people actually : http://www.alexa.com/siteinfo/egaliteetreconciliation.fr http://www.alexa.com/siteinfo/egaliteetreconciliation.fr
    - jokoon 13y ago
      yeah it's easy to unite people around conspiracy theories
doesnt_know 13y ago
I wonder if this is a part of an attack that has been targeting private torrent trackers recently. A lot of private trackers lately have been getting hit by DDOS attacks. To the point that a few have taken on extra developers/admins which have openly stated their primary goal is to deal with said attacks. One in particular that has a large user base (35,000 active users) has been experiencing difficulties and is also customer of CloudFlare. This might be one reason why CloudFlare is hesitant to give out details. The "French networking host" (OVH) that is mentioned in the article is one of the largest suppliers of seedboxes I known of. Usually indirectly through smaller companies who buy from OVH and then provide support and server management services. In fact, this is so widely known within the private P2P community that "being on the OVH network" is actually a selling point due to the sheer amount of peers that you'll be getting ridiculously high speeds with. Of course, it could all just be a coincidence too.
- huckleberryfinn 13y ago
  The big ones all turned to Cloudflare after last month's DDOS, IIRC. And what looks to be premium plans, too. Hypothetically, of course...
Nux 13y ago
Nothing catches the eye https://www.de-cix.net/about/statistics/ https://www.de-cix.net/about/statistics/ here https://www.linx.net/pubtools/trafficstats.html?stats=week https://www.linx.net/pubtools/trafficstats.html?stats=week https://www.ams-ix.net/technical/statistics https://www.ams-ix.net/technical/statistics
gesman 13y ago
The way to solve this is not through technology but through the bounty, which needs to be assisted-sponsored by the government(s) as it affects global strategic infrastructure. Post $5-$10M bounty to find those responsible, make their buddies to salivate to give them up and then make the public case out of them for others to think 10 times more before engaging in stupidity.
mb0 13y ago
In my opinion, the NTP reflection attacks are a result of a larger problem on the internet - large payloads being delivered without any sort of connection handshake. While it is easy to blame open ntp servers, dns resolvers, and snmp servers - these protocols wouldn't be as easy to abuse if the internet hadn't grown to rely on UDP. UDP is a connectionless protocol, so there is no handshake before data is thrown at the vulnerable target. Worse yet, there is no way to 'reset' function in these protocols, so there is no way for the victim to tell the remote host to shut up. As for the targets of these attacks. They're still happening. It's honestly a pretty stupid attack. The connections from victim:80 to ntpserver:123. The attackers don't seem to understand that port 80 is not a commonly used UDP port. I'm seeing the following targets in my ntp server's logs: 37.187.133.51 (OVH) 216.33.93.214 (edline.com) 23.9.97.251 (akamai) 59.7.146.69 (Korea Telecom) 198.50.139.161 (OVH) 217.236.16.131 (Deutsche Telekom)

85 points by ndesaulniers 13y ago

Tepix 13y ago

If you haven't fixed your NTP server, it is probably part of this traffic amplification attack. Here's a description of the necessary configuration changes: http://www.meinbergglobal.com/english/news/meinberg-security-advisory-mbgsa-1401-ntp-monlist-network-traffic-amplification-attacks.htm http://www.meinbergglobal.com/english/news/meinberg-security...

marcosdumay 13y ago
I just got out to fix my machines, and I'm glad to say that Debian's default configuration is already right, nothing to fix there. Anyway, I'd encorage anybody to read the link and check, maybe you are not using the default, or maybe you are using an earlier version.

midhir 13y ago

"Cloudflare did not return a request for more information..." lol.

KerrickStaley 13y ago

Is 400 Gbps globally really that much?

NKCSS 13y ago
Pointed to a single target: yes.
isaack 13y ago
It may not be a good idea to measure DDoS merely based on the volume. For example, a 100Gbps L7 attack is much harder to mitigate than a 100Gbps L3 attack. [1] Also, some had previously questioned the accuracy of CloudFlare's figures. [2] [1] https://blogs.akamai.com/2013/03/how-big-is-300-gbps-really.html https://blogs.akamai.com/2013/03/how-big-is-300-gbps-really.... [2] http://www.techweekeurope.co.uk/news/prolexic-ceo-scott-hammack-biggest-cyber-attack-lies-spamhaus-113551 http://www.techweekeurope.co.uk/news/prolexic-ceo-scott-hamm...
dsl 13y ago
CloudFlare has 24 datacenters worldwide. That works out to 16 Gbps per DC if evenly distributed, or roughly 2 10 GigE circuits.
Nyr 13y ago
Obviously yes. Even for an anycast network like CloudFlare. Not that they can't mitigate it, but it's hard and not free to do so.

theknown99 13y ago

Is there a legitimate reason why any ISP / hosting provider etc allows traffic to exit with an IP that doesn't belong to them? Surely enforcing this would prevent any IP spoofing, which would cut down on these types of attacks? (As far as I'm aware in this type of attack you send packets purporting to be from your target, to anything on the internet that will blindly send back a reply. Hopefully the reply will be bigger/more packets than your request was, thus amplifying the bandwidth). If I'm mistaken please explain why...

dsl 13y ago
What you suggest is actually the default behavior of most major carriers. Its codified here: http://tools.ietf.org/html/bcp38 http://tools.ietf.org/html/bcp38 That said, source address spoofing is needed for some one-way satellite internet providers. There are also some really cool advanced load balancing tricks you can do with it. It even comes in handy (ironically) when doing DDoS mitigation.
- theknown99 13y ago
  Is it the default behavior of major carriers in Russia/China/Africa/etc as well as in Europe/America? My experience has been that the majority of the countries where attacks come from do not really care.
  - Nyr 13y ago
    Yes, it is. But DDoS attacks to EU or the US aren't launched from China/Africa anyway. You need relatively low capacity to start an amplification attack, so a server at some ISP which doesn't care is enough. There are some ISPs which knowingly allow this, like Ecatel in The Netherlands which is probably the most notorious example.
nmc 13y ago
As dsl pointed out, this filtering is already enforced, but it presents caveats and limitations: http://tools.ietf.org/search/rfc3013#section-4.3 http://tools.ietf.org/search/rfc3013#section-4.3

annnnd 13y ago

NTP reflection attack technical explanation: http://blog.cloudflare.com/understanding-and-mitigating-ntp-based-ddos-attacks http://blog.cloudflare.com/understanding-and-mitigating-ntp-...

audessuscest 13y ago

The target is probably : http://egaliteetreconciliation.fr/ http://egaliteetreconciliation.fr/ Edit : French customer, use cloudflare and OVH. Is strongly attacked by ddos since yesterday

jokoon 13y ago
yeah right, another blurb of conspiracy theorists. who cares about those guys anyway.
- audessuscest 13y ago
  A lot of people actually : http://www.alexa.com/siteinfo/egaliteetreconciliation.fr http://www.alexa.com/siteinfo/egaliteetreconciliation.fr
  - jokoon 13y ago
    yeah it's easy to unite people around conspiracy theories

doesnt_know 13y ago

I wonder if this is a part of an attack that has been targeting private torrent trackers recently. A lot of private trackers lately have been getting hit by DDOS attacks. To the point that a few have taken on extra developers/admins which have openly stated their primary goal is to deal with said attacks. One in particular that has a large user base (35,000 active users) has been experiencing difficulties and is also customer of CloudFlare. This might be one reason why CloudFlare is hesitant to give out details. The "French networking host" (OVH) that is mentioned in the article is one of the largest suppliers of seedboxes I known of. Usually indirectly through smaller companies who buy from OVH and then provide support and server management services. In fact, this is so widely known within the private P2P community that "being on the OVH network" is actually a selling point due to the sheer amount of peers that you'll be getting ridiculously high speeds with. Of course, it could all just be a coincidence too.

huckleberryfinn 13y ago
The big ones all turned to Cloudflare after last month's DDOS, IIRC. And what looks to be premium plans, too. Hypothetically, of course...

Nux 13y ago

Nothing catches the eye https://www.de-cix.net/about/statistics/ https://www.de-cix.net/about/statistics/ here https://www.linx.net/pubtools/trafficstats.html?stats=week https://www.linx.net/pubtools/trafficstats.html?stats=week https://www.ams-ix.net/technical/statistics https://www.ams-ix.net/technical/statistics

gesman 13y ago

The way to solve this is not through technology but through the bounty, which needs to be assisted-sponsored by the government(s) as it affects global strategic infrastructure. Post $5-$10M bounty to find those responsible, make their buddies to salivate to give them up and then make the public case out of them for others to think 10 times more before engaging in stupidity.

mb0 13y ago

In my opinion, the NTP reflection attacks are a result of a larger problem on the internet - large payloads being delivered without any sort of connection handshake. While it is easy to blame open ntp servers, dns resolvers, and snmp servers - these protocols wouldn't be as easy to abuse if the internet hadn't grown to rely on UDP. UDP is a connectionless protocol, so there is no handshake before data is thrown at the vulnerable target. Worse yet, there is no way to 'reset' function in these protocols, so there is no way for the victim to tell the remote host to shut up. As for the targets of these attacks. They're still happening. It's honestly a pretty stupid attack. The connections from victim:80 to ntpserver:123. The attackers don't seem to understand that port 80 is not a commonly used UDP port. I'm seeing the following targets in my ntp server's logs: 37.187.133.51 (OVH) 216.33.93.214 (edline.com) 23.9.97.251 (akamai) 59.7.146.69 (Korea Telecom) 198.50.139.161 (OVH) 217.236.16.131 (Deutsche Telekom)