Slashdot Mirror
You're Being DDOSed — What Do You Do? Name and Shame?
badger.foo writes "When you're hit with a DDOS, what do you do? In his most recent column, Peter Hansteen narrates a recent incident that involved a DNS based DDOS against his infrastructure and that of some old friends of his. He ends up asking: should we actively publish or 'name and shame' DDOS participants (or at least their IP addresses)? How about scans that may or may not be preparations for DDOSes to come?"
DDoS the DDoSers, that'll show em!
The vast majority of DDoS participants are infected computers in botnets, and their owners are typically unaware. Will they even notice your naming sufficiently to be ashamed? Maybe if it's a corporation it'd have some effect: publishing that you were hit by a DDoS that included X computers from BigCorp might make BigCorp look bad. But not so much if the botnet is a bunch of random home PCs.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
He ends up asking: should we actively publish or 'name and shame' DDOS participants (or at least their IP addresses)?
Next up, someone broke into my house; is some stern criticism in order?
Hey, how about you give the evidence to the police?
Publish. Shame. Maim. Cripple. What ever it takes to get some measure of satisfaction.
We had this type of DDoS attack. 1 - 2 million requests per hour against a small VPS. Bind wasn't running but it didn't matter; the requests kept coming for weeks. We cloned the VPS so we'd get another IP, switched things over and abandoned the first VPS.
Backups people. Have backups of your code, configs and databases.
The only reason you can possibly have for publishing the IP addresses is to provoke vigilante justice type of actions, likely counter ddos or something.
What you should do is report him to the abuse department of his ISP. Note the responses of the ISP's and name and shame the ISP's that do not take action.
IP addresses from bad ISP's should end up on a "botnet-friendly ip list" so we can start blocking the traffic from these isp's.
Easy, you post the name of the attacker on Slashdot in an article about a new supercool anything and have him slashdotted.
contact the ISPs involved, tell them they yank the bad boys' service or you will blackhole them.
if this is supposed to be a new economy, how come they still want my old fashioned money?
Spoofing is more than trivial, and anyone but the dumbest do this to cover their tracks and keep law enforcement back-tracking from a botnet node back to the perp.
Better to track the traffic back over the 'net (using CEF-forwarding tables or ACL etc.) with the help of the relevant ISPs.
If the end ISP isn't helpful, shame them and their upstream peers.
Dom
1) It's DISTRIBUTED. You'd have to name and shame thousands.
2) Many of the DDOS nodes don't know they're being hijacked for a DDOS. Name and shame an innocent person?
You're being 'ddosed' from thousands of different IPs - list them all!
Who cares if they're compromised computers - naming them will surely shame the botnet owners into submission!
Was this question asked by an idiot?
DDOS is a violation of federal law and should not be tolerated. If it is a botnet, whoever is running such a botnet is in violation of federal law.
Eventually we should have a reputation-based distributed admin function for the Internet. If a dozen high-rated NetOps guys all sign messages that say that a given IP is spewing DDoS traffic, the infrastructure should permit a block without the owning admin having to deal with it proactively.
If a network doesn't participate, that could play into trust levels. If an admin screws up, he loses reputation. If an admin tends to advertise YouTube routes into Pakistan, he never gets a good reputation in the first place.
As usual, it's all trade-offs and we don't yet have an extensible crypto-reputation system, so one thing at a time.
To the original question - it's probably not going to do much good, but it's good to cultivate such expectations.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Many of the DDOS nodes don't know they're being hijacked for a DDOS. Name and shame an innocent person?
They are NOT innocent. They let their computers be used in stealing, censorship, blackmailing, spam and other evil stuff. It doesn't matter if it is stupidity, ignorance or malicious intent.
If your car keeps hitting other cars you should hand over your license.
Make up some story about how you tracked down a huge network of movie pirates.
Nobodies Prefect
Tidbits for Techs Technology Blog
And what do you do when all your 10GB fibers are saturated? Nothing an apparatus will solve.
nosig today
Sites under DoS attack should publish (through a channel not congested by the attack) a list of the IP addresses attacking them, through some trustworthy third party. Then, other sites should subscribe to that list and refuse service to those addresses until they clean up and stop attacking.
For instance, consider your uncle who uses AOL. His computer is infected with botnet garbage and is participating in a DoS attack against (say) Slashdot. Slashdot sends a list of attacking IPs, including your uncle's, to Team Cymru (the third party). Cymru aggregates these and publishes a list, updated every three hours. AOL subscribes to that list. When your uncle goes to check his AOL email, he gets an error: "We regret to inform you, your computer has been hacked, and is being used by criminals to break the Internet. You can't get to your AOL email until you kick the criminals off by installing an antivirus program and running a full scan. Click here to install Kaspersky Antivirus for free. Thank you for helping keep criminals from breaking everyone's Internet. Sincerely, Tim Armstrong, CEO, AOL."
Then your uncle gets mad and calls up AOL and complains. They try walking him through using the antivirus program, but he just curses them out and says he'll go to Hotmail instead. He tries ... but Hotmail also subscribes to the same list and tells him the same thing: "Your computer is infected with malware and is being used to attack other sites on the Internet. You cannot obtain a Hotmail account until your computer is clean. Click here to install Microsoft Antivirus." He gives up and calls AOL back, and they help him get his computer cleaned up. Within half an hour, it's off the botnet; and within three hours, it's off the list of attacking hosts, and your uncle can get his AOL email again.
The idea of voluntary email blackhole lists could be adapted here. Victims of DDOS could submit lists of IP addresses that are attacking, to a central clearinghouse, which will analyze the attack pattern in order to determine the most efficient response. The clearinghouse would verify and document which groups of IPs are part of a particular attack in progress, and notify the relevant ISPs in real time. These ISPs would respond by blocking outgoing access to the victim from their network for a time. Whenever possible, they could later contact the offending customer to help them eliminate the bot infection. Botnets could be mapped out instantly, and in great detail. DDOS attacks could be significantly throttled down after just a few minutes. If enough ISPs participated, DDOSers would be left with just the crummy little ISPs to use that don't give a toot. Regrettably, this system could also be used to illuminate any legitimate activity that governments and ISPs frown upon, and the central clearinghouse itself needs to be somehow immune to DDOS attacks.
Learn more about how open recursive nameservers help enable DNS amplification attacks. A good analogy for open recursive nameservers are the open mail relays of the late 1990's. Someone puts a resource on the internet without locking them down nor caring who (ab)uses them. UDP was fun when the internet was more trustworthy. Now it is the bane of network abuse. It's not just DNS. SNMP is also a frequent attack amplifier that anonymizes the true attack source. The only ones worth naming and shaming are cost-shifting ISPs that don't yet implement SAC004 (aka BCP 38). The lack of source address filtering is what enables anonymous forged UDP attacks to be successful.
If your ISP or Colo provider operates an open recursive nameserver, ask them why. It's no longer acceptable to be ignorant of the detrimental effects they have on the Internet as a whole versus the minor benefit that could easily be served responsibly by OpenDNS or Google DNS.
who will say, "uh, what? if you got a dose from somebody, you want public health."
if this is supposed to be a new economy, how come they still want my old fashioned money?
There is a person who frequents here, famous for using hosts files as a security something or other some-such. I had gone for quite some time without having to see or hear from him but apparently has come back.
Apparently, he has been published and is therefore a celebrity or something like that. Anyway, he has a bizarre set of problems which include replying to his own posts pretending to be someone else, assertions that he had "blown away," "burned," "destroyed" or any other such juveline taunt. He apparently believes I and others are "Jorge Bastida" whoever that may be. His mental deficiencies are his reality and therefore he projects his notion of what normal healthy behavior is upon everyone else. He therefore believes multiple people are all one and has little to do than sit here and and attempt to belittle and berate them with commentary.
Of course his problems with reality extend into the realm of believing things which aren't "quite right." I attempted to point out that this sort of behavior is archived for, so far, "ever" on slashdot and that any searches for anything he might have written could be found by anyone including and especially [potential] employers. With all the stories about how government and employers use social networking (which slashdot nearly qualifies as being) I would think this would be obvious but pointing out the obvious is apparently blackmail. (please grow up... please... prove it by not responding to this!)
So with this, I lay shame and I believe I don't need to name. Will it work?
Let us know how it turns out, Jorge.
Sheesh, evil *and* a jerk. -- Jade
And what do you do when all your 10GB fibers are saturated?
If his post didn't saturate his link, he's probably safe against DDOS.
Sheesh, evil *and* a jerk. -- Jade
We were once DDoSed and we first called our colocation guys (that also manages our firewalls) if they could do it, the technician could do nothing. They called their ISP and they quickly found that the majority of the traffic came from countries we don't do business in so they simply blocked (or routed away) traffic from those countries going to our net and the site became instantly accessible again. The ISP has an anti-DDoS service that does this automatically based on some threshold magic. This is a service we are going to get.
And how are your website's users supposed to reach you in the meantime? As soon as you switch your DNS to point to the new servers, the DDOS follows. Try again.
If anyone's found a solution better (or more cost-effective) than Prolexic or a similar DDOS-prevention service, do let me know. That's some crazy-stupid protection money we're paying out, but it has proven effective.
How are sites slashdotted when nobody reads TFAs?
Most of the systems involved in distributed attacks are not intentionally willing participants. They are generally part of a botnet, belonging to unknowing owners and controlled by uncaring masters. Shame them all you want but that won't make them go away.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I've had sizable amounts of junk come in from China Telecom DSL class C blocks in Shenzhen. It's obviously a botnet. Amusingly, by changing what the attackers get back, it's possible to slowly influence their behavior. The zombies just send blindly, trying SMTP and PHP attacks, and they continue to send even if they get no useful response. But after a few days, some control node notices that the botnet isn't accomplishing anything and stops. Except that a few zombies don't get the word and continue to send the same junk.
The resource-consuming API requests on our system go through a fair queuing system, so that many requests from the same IP address queue up behind each other and don't consume much in the way of resources. At one point, some grad student was trying to use the API, and they were doing it ineptly, sending hundreds of thousands of initial requests without ever making the followup call to get the results. This built up a huge work queue, but the fair queuing meant their requests had lowered priority and weren't impacting real users. After a few days of this, I blocked the IP address for 24 hours. After unblocking, the requests reappeared. So not only was the requester inept, they weren't paying attention to their own program. So I wrote to the department chair at the user's university, and after a few more days, the API calls stopped.
Thank God you so kindly reproduced your fantastic advice here or I might never have seen it!
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
If you actually had a clue about this stuff you wouldn't need to re-post your drivel time and again.
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
null route the ip being attacked?
http://interserver.net/
Most packet based DDoS attacks (SYN|FYN|ACK|ICMP) floods do not require a return packet. The source address is always bogus. Reporting it is a joke. New fun and exciting targeted DDoS attacks use improperly set up services/daemons. In this case, recursive lookups on DNS servers are the cause. IMHO, If someone has a fast connection and doesn't disable recursive DNS lookups they should get a warning. After tha,t publishing their whois information on a web site would be a great way to motivate them.
Having to work for a living is the root of all evil.
Would "I have evidence that a computer system that I operate is being abused in violation of the Computer Fraud and Abuse Act" be any clearer?
Amazon &/or Microsoft pretty much can, & actually DO, vs. such things (amazon's setup for that, but not directly - it was MORE for being "proof" to "holiday shopping 'rushes'" but it works out the same for them, vs. DoS/DDoS too - "bonus!")
If you actually had a clue about this stuff you wouldn't need to re-post your drivel time and again.
I think APK's point here is that Amazon and Microsoft provision their networks for the worst case of traffic that they can imagine, and then they sell the excess capacity back to the public as virtual servers.
As soon as you switch your DNS to point to the new servers, the DDOS follows.
Then switch your DNS to point to a huge caching proxy such as CloudFlare. See previous Slashdot stories mentioning CloudFlare (1) (2).
How does Google DNS not have a detrimental effect while other services comparable to Google DNS do?
Why not install fail2ban instead of this verbose description of script hacking??
And my point is that you need a s*** load of bandwidth, in excess of 100GB, to even start having a usefull model (i.e. filter bad traffic). That is expensive.
Remember that a DDoS is either started by vigilantes such as Anonymous or by botnet operators. In the first case you probably know you could be targetted and probably have the resources to prepare. In the second case, this is what happens: You have a medium size business that is doing well. You get an email saying that you should pay 50.000 dollars in an hour. You don't. Website goes down. At first they find some weak link such as SYN which you fix. After a while, to keep the DDoS effective, the botnet operator changes method and always ends up filling your tubes. It is the botnet operators job to ensure his DDoS works and he has done it more often than you.
The only thing left is asking other network operators to filter traffic for you. Maybe our networking technology should advance to be able to counter this kind of abuse.
nosig today
Well back in the Flintstone days of the net [1994-2001] I'd do an ARIN lookup and call the listed telephone and be speaking to a real knowledgeable person in under a minute who knows their IP addresses by heart. I know those days are over. Never mind.
There is one net protocol for which no one has any expectation of privacy -- and if providers do deep packet inspection there is no controversy, ICMP.
My idea is to fire back a couple of small ICMP messages with an RFC described format back towards each attacking address every so often, with small payloads (we don't want to add to the traffic problem).
The payload of a 'notify' message that includes a unique random identifier, the time DDOS condition started, cumulative packet count from that address if available. Maybe some flags with attack type and name/address targeted to help forensics.
The second type of message used for 'source verification', also throttled, contains a list of recent notify identifiers and a https URL address, and is digitally signed with the same cert used by the SSL server. The url serves a page with a name and contact phone number.
The idea is that responsibly staffed providers (or those upstream of them) would routinely inspect these packets and parse them out to populate a threat board. End providers could match to customer accounts, those upstream of them could at least compile statistics in aggregate.
Of course it always becomes a cat and mouse game with the attackers constructing their own bogus notify networks. You'd see flood attacks consisting of bogus attack notification messages. But here the advantage begins, for it is impractical for botnet operators to address every unique ISP their slaves occupy individually.
Those who already have dark fiber piggyback slurp terabit packet inspection on the backbone (and You Know Who You Are) would have the best picture of all, with these poke messages they could assemble a picture of a botnet in minutes. Do something noble for a change.
Or we could just all run into the closet and pile blankets over our heads. Works for me.
<blink>down the rabbit hole</blink>
Contact the authorities. If they don't care, contact the newspaper and tell them the authorities don't care. Lather, rinse, repeat.
In the meantime, contact your ISP and beg them not to disconnect you.
I've been DDoS'd for insulting people on irc. As a home user you have no option but to wait for it to end, especially if you have a static IP which I did at the time. It's small satisfaction knowing that the person flooding you is never going to amount to anything and will probably end up in PMITA prison one day.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
I think that idea needs one of those old form letter responses: Your idea will never work because...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Speak of the devil.
And he comes and shames himself.
This is not exactly what the OP had in mind.
No. That's the thing I forgot about shame. For shame to work, you have to have something that psychopaths and sociopaths lack. This guy is all over the place. With every new story posted here, he is now a first-poster making comments about me. It's funny actually. I was recently contacted by a news resource on just this guy. So stay tuned -- this might hit the news. Hopefully it won't end with any mass shootings or other such thing. I really do think he is that level of insane.
Thanks, APK, for that giggle!
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?
Point taken about shame.
He seems unwell to me, too. But he must be sufficiently well functioning to continue to afford a computer and a net connection. I'm curious as to how the story pans out.
"The vast majority of DDoS participants are infected computers in botnets" .. that run on Microsoft Windows ...
AccountKiller
--What, you never heard of ' iptraf ' for Linux?
--What, you don't *run* Linux? Whassamatta you, get educated son!! ;-)
.
== WolfriderV6 == I'm willing to admit that *I just might* be wrong... Are you??
It's a shame that ISPs are routing spoofed udp packets, like in DRDOS attacks and are not made liable for this. When a fake UDP packet, spoofed with the source IP being replaced by yours, is sent to an amplifying system, like quake/cs/hl/codt server or a dns, then you get the answers... A lot. Why the hell those guys route trafic issued from an IP that is not in their range ? It's a line of config in routers. (Not exactly rocket science like a friend of mine says) Well simply because they make money out of upload trafic... Shame. Ok it would only solve the DDOS based on UDP spoofed packets, but it's not few. Btw I like the ideas expressed here lf a license to use a computer. Something giving the basics at least. I also like the idea of a reputation system (we have one in our high security cloud) to ban the IPs doing carp tepeatidly, by blackholing them, after a neutral group of netadmins decides it.