8 ms·
Meetup fighting against DDOS extortion
- codinghorror 13y agoIs it really this hard to fend off a DDOS? At the funding and staffing level Meetup is at, I find this a little hard to understand.
- scurvy 13y agoNot particularly. It just requires money, planning, and someone on staff who's old enough to remember the early 2000's when popular sites were routinely attacked. Seems like Meetup is lacking in at least one of those.
- ceejayoz 13y agoCloudFlare recently posted about a 400 Gbps attack they saw. I can't imagine any reason Meetup would have that sort of bandwidth capacity lying around.
- scurvy 13y agoYou don't need that kind of bandwidth capacity lying around if you plan ahead and work with DDoS mitigation services before you're attacked. It's akin to setting up an IDS/IPS before you get pwnt through sloppy PHP/MySQL injections.
- ceejayoz 13y agoPre-CloudFlare, those were expensive. I can't speak to the technical work needed to hook something like MeetUp with CloudFlare, but if this is the first DDOS they've suffered it might not have been particularly worth it to them until now.
- at-fates-hands 13y ago>> but if this is the first DDOS they've suffered it might not have been particularly worth it to them until now. Isn't that the whole point of using a preventative approach when it comes to your site's security? So you don't learn the hard way? Of course knowing a lot of InfoSec guys, they can only tell them what they should have, it's up the owner's to make the call to get it in place. I don't know how many times one of them complained about doing a pen test on someone's site, making the recommendations and then one year later, they haven't fixed anything yet.
- scurvy 13y agoSounds like they should have hired a real ops guy instead of a devops hipster.
- badman_ting 13y agoThanks for posting!
- at-fates-hands 13y agoTo be clear, it was one of CloudFlare's clients, it wasn't a DDOS on them directly: http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack http://blog.cloudflare.com/technical-details-behind-a-400gbp... "On Monday we mitigated a large DDoS that targeted one of our customers. The attack peaked just shy of 400Gbps." And yes, it did affect other parts of their network, but they were able to successfully mitigate it. "We saw attack traffic hitting every one of CloudFlare's data centers. While we were generally able to mitigate the attack, it was large enough that it caused network congestion in parts of Europe"
- eloff 13y agoSo why don't they just use cloudflare? It's cheap compared to the human resources they've been spending on the problem.
- driverdan 13y agoThe are using CF or at least they were at one point during the weekend. It's not going to matter though if the attackers know the IP range the servers are hosted at. They'll just bypass CF and attack the servers directly.
- toomuchtodo 13y agoOrigin under attack? Move it. Consider its current IP block poison for the next 30-60 days.
- eloff 13y agoYou don't even have to move it, just change the IP. Even budget hosts can do that for a price.
- chimeracoder 13y agoShouldn't it be easy though to configure the servers/load balancers to reject any request except for CloudFlare's? Then again, if the attacker spoofs their IP address, I'm not sure how this would work (and I'm not sure how Cloudflare prevents against this as it is).
- rtfeldman 13y agoThey do use CloudFlare.
- stcredzero 13y agoWe've been dealing with DDOS attacks affecting mainstream citizens and businesses of 1st world countries for about a decade now. Why isn't there law enforcement dedicated to catching people who do this? We're at a point where CEOs of companies can engage in such behavior and the companies can stay in business. If there is someone reading this who works with a US congressman or senator, this may be a chance to introduce legislation that can make a positive impact, make it easier to establish Internet-facing companies, and instead of eliciting dismay from the community of technical people, gain their gratitude instead.
- higherpurpose 13y agoYes, and then NSA will say "Sure, we'll protect you. You just have to give us access and control to your whole network and servers, because that's the only way to 'properly protect you'. Deal?" This is exactly what these agencies want. To give up on your responsibility for the security of your users, so they can take over. If your company does that, please tell me now so I know to avoid it forever. The solution is to better design anti-DDoS systems, not to let the government "handle it".
- redbad 13y agoThe NSA has nothing to do with the parent's proposal. Your entire reply is a non-sequitur.
- thisiswrong 13y agoActualy, the NSA - just like the CIA, is known to carry out false flag acttacks to achieve a certain outcome. This point should not be overlooked. In this case Meetup is a perfect NSA 'false-flag' target because it's not a financial institution (NSA ally), and yet is used by millions of people. Thus millions of people starting to ask if GCHQ/NSA will keep them 'safe' online.
- kbar13 13y agousername oddly relevant The FBI is responsible for "cyber" crimes.
- driverdan 13y agoWhen are we going to hold individuals and companies legally responsible for the hardware they control? We already do this for other types of crimes such as remailing scams. If you're going to have hardware on the internet you should be responsible for it. There should be penalties for being irresponsible. Ignorance is never an excuse.
- deleted 13y ago[deleted]
- HarryHirsch 13y agoIndeed. If I understand it right, the recent rash of NTP reflection attacks could have been prevented through egress filtering.
- kbar13 13y agothey already are being held responsible. At least in the United States, it's covered under federal law afaik: https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act The more likely problem is shady networks who either explicitly allow criminal activity or are just negligent. A good number of DoS attacks can be stopped just by origin networks implementing BCP38.
- mbesto 13y agoAnd then set the precedence that a person in Indonesia controlling a server in Iceland can be legally responsible in the US? How do we determine jurisdiction?
- stuntmachine 13y agoThe problem here isn't whether companies are using DDoS mitigation services, it's whether they have ISPs null routing them. The weak point here at the top tier ISPs, not necessarily the individual companies being targeted. You can have the best DDoS mitigation service ever, but if the top-tier ISPs black hole you, you're in a very bad spot.
- scurvy 13y agoWhy would a "tier 1" (I hate that outdated term) transit provider ever null-route an IP that's not in their block nor in a customer's block? I haven't heard of them doing that. That would be a very shady thing to do.
- stuntmachine 13y agoI'm sorry I used a term you don't like -- let's get past that though -- What about if the customer you speak of is the DDoS mitigation service? Even without doing this though, if they remove a BGP route and other ISPs cannot route through them, that's a problem for whoever lives at the destination AS number.
- scurvy 13y agoI'm really confused here. Why would a DDoS mitigation service announce routes for a network they don't serve for a customer? That would simply be an old-fashioned BGP hijacking. Transit providers don't simply send traffic to Prolexic and Defense.net because they think they should. They send traffic there for routes that the mitigators are announcing. They'll only announce client routes (and only when clients announce to the mitigators).
- toomuchtodo 13y agoTransit providers will null route traffic that's inbound to you if you request it. This lets you stop the traffic at their core, instead of overwhelming your edge gear. You are the customer after all; you have a say in what traffic makes it to your edge from your upstream provider.
- chimeracoder 13y agoAt first I almost laughed when I saw the sum - they're asking $300? For a company that's been around for almost 15 years? That said, Meetup's reasons for not paying it are very solid. I'm glad they're spending far more than $300 of their own resources[0] to fight this attack, because other websites would be the ones paying the price if they decided to start this precedent. Also, somewhat relevant: https://en.wikipedia.org/wiki/Danegeld https://en.wikipedia.org/wiki/Danegeld [0] I wonder how much this downtime actually represents to them (plus the engineering time)
- snake_plissken 13y agoI find it astounding that a competitor of Meetup thinks that DoS'ing Meetup could drive a notable amount of traffic to their site.
- serverascode 13y agoI use meetup.com for several meetups. This is not good. I'm really looking forward to finding out how they plan to mitigate this kind of issue in the future, b/c there has to be a way.