10 ms·

Why don't providers just set up a system that creates a country-level null route for a given destination IP? And have a UI with a checkbox for the user to do it

Why don't providers just set up a system that creates a country-level null route for a given destination IP? And have a UI with a checkbox for the user to do it, for any selected country. It would mitigate the issue, and once it's over, the user can un-restrict traffic / or just keep blocking if it's a non-valuable source. I know you can do this on the server, using many different techniques. But this does not help as the traffic still reaches you (that you have to pay for). You can also do this with Geo DNS (and get much less of a bill). And the ISPs, datacenters, and anyone with a router can block ASIA or China allocated IP ranges. Especially if it's not the type of a flood that's designed to attack the routers (instead of the web-server). So what's stopping Amazon?

toomuchtodo 12y ago
Please, don't perceive this as being rude, it's not meant to be. Having provided IP transit at a largish network provider in a previous life, you have no idea at the complexity involved what you're asking for. It could be done, but the costs involved are non-trivial. If you're honestly interested in the complexity involved, start reading about BGP, dynamic routing protocols, router/switch fabrics, control plane integration, autonomous systems, peering agreements, etc.
- unethical_ban 12y ago
  I feel it shouldn't be unreasonable to expect AWS/Cloudflare/Akamai to have policy-based routing to blackhole a lot of these source subnets. Of course it's complex, but these are some of the largest hosting providers in the world.
  - cookiecaper 12y ago
    I've found this is a common thing to say with AWS employees. One of them insisted that Amazon's ridiculous ephemeral storage policy (immediate, permanent, and irrevocable deletion on any halt or stop event, making accidental data loss a real possibility) had to be that way because it would just take too much hardware to allow a cooldown period before the drives were wiped. There's no way I believe that. I think Amazon is just used to intimidating customers with exactly that line of reasoning: "No offense, but you have no idea how hard the cloud is", and people buy it because "the cloud" is the new hotness.
    - jldugger 12y ago
      I've had RAID 6 fail. It should be extremely rare, but isn't. And at AWS's scale, It's not hard to imagine servers going offline regularly. Ephemeral storage as a policy makes sense to me in the sense that you can separate out that what's important from that which is ephemeral, and provide cheaper storage than a more HA solution like ganeti.
    - saywhst 12y ago
      if you need persistant storage, use EBS. Ephemeral is self-defined.
    - deleted 12y ago
      [deleted]
    - MichaelCrawford 12y ago
      I've been looking for work for a while, but I won't even respond to solicitations or job board posts that so much as mention the cloud, agile or scrum.
      - MichaelCrawford 12y ago
        Rather than modding me down, perhaps you could explain why you disagree.
        tracker1 12y ago
        What you said adds pretty much no value to the conversation, I didn't mod you down, and I didn't look to see precisely what field you work in, just the same, cloud is pretty much an obfuscation for on-demand co-location and shared-hosting services. While you may not like the trend, and some providers have better options than others, and you may require some operations over others... but very few businesses can afford to manage multi-site infrastructure that can dynamically scale. Most are probably served just fine with rented servers, traditional colocation, or don't even need more than one VPS... That doesn't make the technology bad, and only makes you seem ignorant in your prior statement.
  - drzaiusapelord 12y ago
    >Cloudflare You mean the company that provides caching services for pay DDOS services?
1ris 12y ago
I think this would not be intended. The page is DDoSed from China and supposed to be reachable from China at the same time.
dreamins 12y ago
Geo DNS (to be more precise AS numbers is what is used) is something that is sometimes used as a very last resort - customers in China are customers as well, and if you drop everything from China thats effectively what the attacker wanted. I recall only hearing about one time when packets from Chinese ISPs were completely dropped for some reason and only for short period. I've also have an anecdotal reference that one can persuade providers that actually deliver traffic from China to do filtering on ingress on next hop routers after China, but that should be something very serious, that impacts their revenue as well and prolonged. As another commenter noted - costs for providers are very non-trivial. In my experience DDOS is always money competition, it costs money to mount one, it costs money to defend against one. Unfortunately when one of the sides is [allegedly] a country it doesn't play very well.
baby 12y ago
Why not redirect to a CAPTCHA to prove that the user is not a BOT?
- MichaelGG 12y ago
  So now you DDoS the captcha system. For companies not operating with massive bandwidth and computing power, you can just overwhelm their defenses. Cloudflare can get away with it, because they explicitly set out to be able to "service" those super huge number of requests. I was working on an anti DDoS system for SIP, a UDP-based protocol. Basically the options were: 1. lockdown, just whitelist known good customers, and break many scenarios. 2. Attempt some kind of analysis, like sending out probes to determine good/bad IPs. 3. Scale the hell up. Write L7 stuff that can go at wire speed, and get lots of wires. Needless to say, #1 is the easiest to implement, but allows you to get your pipe saturated. #2 requires compute + pipe, and #3 is the only thing that'll really work. This matters because DDoS'ing a telecom can be very lucrative. I can say with good confidence that demonstrating DDoS capabilities are probably worth 5-6 digits in blackmail against many companies.
  - iopq 12y ago
    Good luck DDoSing ReCAPTCHA, I'll wait
    - frankchn 12y ago
      Greatfire is unique that they want the site to remain accessible to ordinary Chinese users while withstanding the DDoS attack (so they can't blackhole all traffic from China either). If they put a reCAPTCHA wall in front, the GFW can simply block reCAPTCHA (easy -- it is a Google property and they block everything else from Google anyway) and no one from China can access Greatfire without a VPN. Mission accomplished.
      - gcommer 12y ago
        Assuming the attacker is indeed China: If the goal was only to block Greatfire for non-VPN users, then they could just use the GFW for that from the start. The use of a DDoS can only imply that China wants the site offline for everyone, even VPN users.
latj 12y ago
The point of their website is to make censored content available to Chinese users. China is attacking them to prevent Chinese people from reading the website. Your suggestion is to make the site unavailable to China. Do you see why it is not a solution? You are basically setting up a market for censorship-- the attack doesnt ever have to end-- depending on how much China is willing to pay to keep the website offline.
- themgt 12y ago
  OTOH if the great firewall already blocks this site, wouldn't that mean normal Chinese citizens would access it through a VPN via another country?
  - obituary_latte 12y ago
    If normal citizens had access to a VPN in which to access this site from another country, it would be quite redundant to use this site then wouldn't it? Maybe I'm not understanding.
    - mod 12y ago
      If normal citizens have access to it without a VPN, then why doesn't China just block it with the firewall instead of ddosing? Maybe I'm not understanding.
      - obituary_latte 12y ago
        Yeah, no -- my fault. I wrongly assumed it was some type of proxy or way to get around the great firewall.
      - nilbot 12y ago
        From a source close to some organizations that tune/develop the chinese firewall (spoiler alert: public universities), they are adopting methods to trigger reversed censorships. And in my eyes, these methods, despite less technical challenging, are working as intended. Also, see this: http://furbo.org/2015/01/28/grass-mud-horse/ http://furbo.org/2015/01/28/grass-mud-horse/
deleted 12y ago
[deleted]
lionspaw 12y ago
the real reason is because Amazon wants to do business in China, so they absolutely cannot do something like that on their end without getting blacklisted by China's government.
milos_cohagen 12y ago
DDoS come from hosts which are part of botnets, usually compromised hosts, from all over the world. Not one country or subnet.

toomuchtodo 12y ago

Please, don't perceive this as being rude, it's not meant to be. Having provided IP transit at a largish network provider in a previous life, you have no idea at the complexity involved what you're asking for. It could be done, but the costs involved are non-trivial. If you're honestly interested in the complexity involved, start reading about BGP, dynamic routing protocols, router/switch fabrics, control plane integration, autonomous systems, peering agreements, etc.

unethical_ban 12y ago
I feel it shouldn't be unreasonable to expect AWS/Cloudflare/Akamai to have policy-based routing to blackhole a lot of these source subnets. Of course it's complex, but these are some of the largest hosting providers in the world.
- cookiecaper 12y ago
  I've found this is a common thing to say with AWS employees. One of them insisted that Amazon's ridiculous ephemeral storage policy (immediate, permanent, and irrevocable deletion on any halt or stop event, making accidental data loss a real possibility) had to be that way because it would just take too much hardware to allow a cooldown period before the drives were wiped. There's no way I believe that. I think Amazon is just used to intimidating customers with exactly that line of reasoning: "No offense, but you have no idea how hard the cloud is", and people buy it because "the cloud" is the new hotness.
  - jldugger 12y ago
    I've had RAID 6 fail. It should be extremely rare, but isn't. And at AWS's scale, It's not hard to imagine servers going offline regularly. Ephemeral storage as a policy makes sense to me in the sense that you can separate out that what's important from that which is ephemeral, and provide cheaper storage than a more HA solution like ganeti.
  - saywhst 12y ago
    if you need persistant storage, use EBS. Ephemeral is self-defined.
  - deleted 12y ago
    [deleted]
  - MichaelCrawford 12y ago
    I've been looking for work for a while, but I won't even respond to solicitations or job board posts that so much as mention the cloud, agile or scrum.
    - MichaelCrawford 12y ago
      Rather than modding me down, perhaps you could explain why you disagree.
      - tracker1 12y ago
        What you said adds pretty much no value to the conversation, I didn't mod you down, and I didn't look to see precisely what field you work in, just the same, cloud is pretty much an obfuscation for on-demand co-location and shared-hosting services. While you may not like the trend, and some providers have better options than others, and you may require some operations over others... but very few businesses can afford to manage multi-site infrastructure that can dynamically scale. Most are probably served just fine with rented servers, traditional colocation, or don't even need more than one VPS... That doesn't make the technology bad, and only makes you seem ignorant in your prior statement.
- drzaiusapelord 12y ago
  >Cloudflare You mean the company that provides caching services for pay DDOS services?

1ris 12y ago

I think this would not be intended. The page is DDoSed from China and supposed to be reachable from China at the same time.

dreamins 12y ago

Geo DNS (to be more precise AS numbers is what is used) is something that is sometimes used as a very last resort - customers in China are customers as well, and if you drop everything from China thats effectively what the attacker wanted. I recall only hearing about one time when packets from Chinese ISPs were completely dropped for some reason and only for short period. I've also have an anecdotal reference that one can persuade providers that actually deliver traffic from China to do filtering on ingress on next hop routers after China, but that should be something very serious, that impacts their revenue as well and prolonged. As another commenter noted - costs for providers are very non-trivial. In my experience DDOS is always money competition, it costs money to mount one, it costs money to defend against one. Unfortunately when one of the sides is [allegedly] a country it doesn't play very well.

baby 12y ago

Why not redirect to a CAPTCHA to prove that the user is not a BOT?

MichaelGG 12y ago
So now you DDoS the captcha system. For companies not operating with massive bandwidth and computing power, you can just overwhelm their defenses. Cloudflare can get away with it, because they explicitly set out to be able to "service" those super huge number of requests. I was working on an anti DDoS system for SIP, a UDP-based protocol. Basically the options were: 1. lockdown, just whitelist known good customers, and break many scenarios. 2. Attempt some kind of analysis, like sending out probes to determine good/bad IPs. 3. Scale the hell up. Write L7 stuff that can go at wire speed, and get lots of wires. Needless to say, #1 is the easiest to implement, but allows you to get your pipe saturated. #2 requires compute + pipe, and #3 is the only thing that'll really work. This matters because DDoS'ing a telecom can be very lucrative. I can say with good confidence that demonstrating DDoS capabilities are probably worth 5-6 digits in blackmail against many companies.
- iopq 12y ago
  Good luck DDoSing ReCAPTCHA, I'll wait
  - frankchn 12y ago
    Greatfire is unique that they want the site to remain accessible to ordinary Chinese users while withstanding the DDoS attack (so they can't blackhole all traffic from China either). If they put a reCAPTCHA wall in front, the GFW can simply block reCAPTCHA (easy -- it is a Google property and they block everything else from Google anyway) and no one from China can access Greatfire without a VPN. Mission accomplished.
    - gcommer 12y ago
      Assuming the attacker is indeed China: If the goal was only to block Greatfire for non-VPN users, then they could just use the GFW for that from the start. The use of a DDoS can only imply that China wants the site offline for everyone, even VPN users.

latj 12y ago

The point of their website is to make censored content available to Chinese users. China is attacking them to prevent Chinese people from reading the website. Your suggestion is to make the site unavailable to China. Do you see why it is not a solution? You are basically setting up a market for censorship-- the attack doesnt ever have to end-- depending on how much China is willing to pay to keep the website offline.

themgt 12y ago
OTOH if the great firewall already blocks this site, wouldn't that mean normal Chinese citizens would access it through a VPN via another country?
- obituary_latte 12y ago
  If normal citizens had access to a VPN in which to access this site from another country, it would be quite redundant to use this site then wouldn't it? Maybe I'm not understanding.
  - mod 12y ago
    If normal citizens have access to it without a VPN, then why doesn't China just block it with the firewall instead of ddosing? Maybe I'm not understanding.
    - obituary_latte 12y ago
      Yeah, no -- my fault. I wrongly assumed it was some type of proxy or way to get around the great firewall.
    - nilbot 12y ago
      From a source close to some organizations that tune/develop the chinese firewall (spoiler alert: public universities), they are adopting methods to trigger reversed censorships. And in my eyes, these methods, despite less technical challenging, are working as intended. Also, see this: http://furbo.org/2015/01/28/grass-mud-horse/ http://furbo.org/2015/01/28/grass-mud-horse/

deleted 12y ago

[deleted]

lionspaw 12y ago

the real reason is because Amazon wants to do business in China, so they absolutely cannot do something like that on their end without getting blacklisted by China's government.

milos_cohagen 12y ago

DDoS come from hosts which are part of botnets, usually compromised hosts, from all over the world. Not one country or subnet.