Slashdot Mirror
Largest DDoS In History Reaches 300 Billion Bits Per Second
An anonymous reader writes "The NYT is reporting that the Largest DDoS in history reached 300 Gbps. The dispute started when the spam-fighting group Spamhaus added the Dutch company Cyberbunker to its blacklist, which is used by e-mail providers to weed out spam. Millions of ordinary Internet users have experienced delays in services like Netflix or could not reach a particular Web site for a short time. Dutch authorities and the police have made several attempts to enter the bunker by force but failed to do so. The attacks were first mentioned publicly last week by Cloudflare, an Internet security firm in Silicon Valley that was trying to defend against the attacks and as a result became a target."
The dispute started when the spam-fighting group, called Spamhaus, added the Dutch company Cyberbunker to its blacklist, which is used by e-mail providers to weed out spam.
I think what they meant to say here was: "The dispute started when the spam-fighting group Spamhaus, which maintains a blacklist used by e-mail providers to weed out spam, added the Dutch company Cyberbunker to its blacklist."
Your political party doesn't care about your rights and only represents corporate interests.
The summary makes it sound like the Cyberbunker is a physical location. If so, a wire cutter should cut off it's access to the inter webs.
“These things are essentially like nuclear bombs,” said Matthew Prince, chief executive of CloudFlare. “It’s so easy to cause so much damage.”
relax dude, its just spam, not nuclear warfare. shut the computer off and go outside for a couple of hours.
WARNING: if you attempt to RTFA, you will also be bombarded by a DDOS of spam ads. I appreciate the realism but it's kinda annoying.
I find it very interesting that they are using a variation on the Old Smurf attacks for this. Sending a message to other places that work as an amplifier. You would think that after 10 years we would have learned that blind, unchecked, forwarding is not a good thing.
Papa Legba come and open the gate
Cutting their communication lines was the first thing I thought of too. Then cutting their power lines. I may not have enough cofee in me to calm me down this morning but visions of the Dirty Dozen dumping fuel and grenades into their bunker came to mind. }:D
With an operator no doubt facilitating illegal actions of their customers, and refusing to no doubt enfore court orders to disconnect their customers for said actions, couldn't a case be made to disconnect them from THEIR upstream providers because they are now acting illegally but not following court orders, presuming that their upstream providers follow court orders, and the upstream upstream until you get to a legitimate entity. It seems quite an shortcoming of the law that they can act with impunity while allowing their customers to bring down the very fabric of the world wide web.
From TFA:
In other words: Cyberbunker is not currently under assault by police, and we have only their word that they ever have been. I suspect that at one time they were successful in having visiting cops think nobody was home by being real quiet and quickly turning off all the lights.
From TFA:
Cyberbunker brags on its Web site that it has been a frequent target of law enforcement because of its “many controversial customers.” The company claims that at one point it fended off a Dutch SWAT team.
The only mention of "Dutch authorities and police" comes from the Cyberbunker company itself. The article is badly written, so it's not completely clear (from the context) whether or this claim is related to the current dDOS the company is running. The writer doesn't appear to have talked to anyone in Holland - except perhaps the self-styled spokesman for Cyberpunker.
#DeleteChrome
Noo...."Reeesearchers"!
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
Who'd they piss off?
Spamhaus must be costing somebody (or some people) a LOT of money to draw such a massive attack.
I admire their balls -- Spamhaus are fighting serious and organised criminals, people who are perfectly capable of raping and murdering folks who get in their way. It wasn't so long ago that the Russian mafia targeted a Russian security specialist by kidnapping his daughter, raping her, injecting her with heroin and selling her into slavery.
They are not very nice people at all, and shouldn't be fucked around with. Picking fights with organised criminals should be left to law enforcement.
More likely some mafiosi that controls malware and spambots, and their "clients" don't like a bunch of amateurs blocking their messages.
This is far more likely. Maybe if the kid rented it from a criminal enterprise, but i doubt some kid is in de facto control of such a vast swarm.
While the bunker itself is designed to withstand a nuclear blast, the doors are the weak point.
A thermal lance can cut through the door while also able to make a nice hold in the concrete walls into which explosives of various types can be implanted.
As others have said, cut the communication and electrical lines and let them fend for themselves. They may have food and fuel, but they can't last forever.
On second thought, cut the electricity and communication, then pile tons of rubble in front of the doors to prevent them from coming out once they exhaust their supplies.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
The bunker is was designed to survive a nuclear war. I wouldn't be surprised if they have considerable fuel reserves.
http://bbc.co.uk/news/technology-21954636
No b/s subscription paywall nonsense
So where is the evidence that Cyberbunker has anything to do with this?
I appreciate the things the Spamhaus people do, but they don't exactly have a spotless record when it comes to accurately pointing fingers.
Did you read the article? If you did you would have spotted this:
Questioned about the attacks, Sven Olaf Kamphuis, an Internet activist who said he was a spokesman for the attackers, said in an online message that, “We are aware that this is one of the largest DDoS attacks the world had publicly seen.” Mr. Kamphuis said Cyberbunker was retaliating against Spamhaus for “abusing their influence.” “Nobody ever deputized Spamhaus to determine what goes and does not go on the Internet,” Mr. Kamphuis said. “They worked themselves into that position by pretending to fight spam.”
When you cant win, ad hominem.
More likely some mafiosi that controls malware and spambots, and their "clients" don't like a bunch of amateurs blocking their messages.
DING DING DING
From the BBC article:
Spamhaus has alleged that Cyberbunker, in cooperation with "criminal gangs" from Eastern Europe and Russia, is behind the attack.
Well, I'd assume to be online they're probably going to have some sort of fiber-optic connection. Even if it's redundant, it's going to plug into the greater infrastructure somewhere and it shouldn't be *too* hard to sever if the police really had a mind to do so.
From TFA:
“Nobody ever deputized Spamhaus to determine what goes and does not go on the Internet,” Mr. Kamphuis said. “They worked themselves into that position by pretending to fight spam.”
I'd rather not have to consult Spamhaus blacklists on my mail servers to block incoming email. I know that if I removed it my bandwidth would be clogged and the amount of work done by my servers to deal with spam would increase many fold. So I use Spamhaus blacklists and it makes me feel dirty. It's the wrong solution to the problem of spam. Surely we should be able to come up with something better.
Spamhaus has been going for 15 years. Look at the other technological advances in that time why don't we have an effective, agreed upon, resolution to the problem of spam? Perhaps the best thing would be for Spamhaus to shut up shop, to stop providing the DNS lists. For mail servers to stop filtering and marking the spam. Let the size of the problem manifest itself. Perhaps then we will get a concerted effort to stop it rather than mitigate the impact.
You may think me a tired, old, cynic. I'd have to disagree about the tired bit.
IF its a DDOS, then losing control of the stupid little robots will not make it stop, they will just be unstoppable. If you want to prevent DDOS, then you need to force ISPs to perform egress filtering of source addresses that are outside of their network. And also implement a choke protocol to inform the ISPs that they have a bad actor on their network.
The real question is: what authority did the police have when they attempted entry? If they are just going to execute a search warrant, they can break down the door but they are not authorized (or equipped) to blow it up. They are certainly not authorized to just cut off power or comms to a place of business in case of an ordinary house search. That however could change now that they are involved in a large (and most certainly illegal) DDOS attack. It is not certain when they'll go offline, but this could well spell the end of Cyberbunker, and if they are proven to be behind this attack, some people will be facing criminal charges and jail time as well.
I doubt very much that "authorities have made several attempts to enter". A quick search turns up no references to any such attempt except on the Cyberbunker site. That picture doesn't show SWAT but ordinary riot police, used to evict squatters or quell riots, or (in rare cases) when doing large scale house searches where real crowd control trouble is expected (like in gypsy / Roma campsites). They have no reason to be here... perhaps they where on exercise or got sent to the wrong address. Authorities have made several requests for search warrants, and some of those were turned down. The rest appears to be just bluster from Cyberbunker.
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
Item 1: The DDOS began after Cyberbunker IPs were added to the black lists.
Item 2: Cyberbunker have a policy saying that they won't look at your servers and don't care what you do. Pretty much a green-light for spammers.
Item 3: The internet activist stating that the DDOS is in response to the blacklisting.
The circumstantial evidence points towards the attacks as being the result of the action Spamhaus took with respect to Cyberbunker. Its unlikely to be the company themselves, but rather at the instigation of one of their customers. The interesting thing is that you can find reports from 2011 (http://www.theregister.co.uk/2011/10/20/spamhaus_a2b_row/) where Spamhaus say that Cyberbunker were on the blacklist then with no prospect of being removed. What has happened in the meantime?
You may think me a tired, old, cynic. I'd have to disagree about the tired bit.
So in other words, the only evidence you will take is for him to tell you himself, or maybe them putting it on their website would work for you as well.... Since it was a quoted message you can assume that it was his words. The location and type of message does not matter. At some point you have to either trust that the journalist was professional, or not, up to you.
When you cant win, ad hominem.
Yes, but they're prisoners in their own facility. "We will tell LEOs to GTFO!" is fine until you realise that those same LEOs are preventing your shift change, and you forgot to pack 80 extra pairs of skivvies this morning in case you happen to be "on shift" until the bunker doors are unsealed.
The Russian Wikipedia page states it has water and fuel for 10 years. I give them 10 days before cabin fever sets in.
Finally had enough. Come see us over at https://soylentnews.org/
It would only hold up for ten years if it was not surrounded and under sustained attack. Yes, it could possibly take a glancing hit from a nuke, but no, it would not stand up very long to some guys with drills and normal demolition charges who had the time to simply drill, demolish or undermine the complex. It would only serve as a fortress hard point if the people inside were armed and there was some hope that allied forces could relieve them in a reasonable amount of time.
And of course, as a way of protecting a connection to the Internet, the building is singularly useless. Even if you didn't just cut the wires, the IP ranges could probably be identified and removed from routing tables in a relatively trivial amount of time. The reason the cops did not simply do this is that they probably just wanted to collect evidence. If they were trying to actually put them out of business, as opposed to just messily collecting evidence, they'd need a specific court order to take that sort of action, and they wouldn't just "give up".
Still, there are some very viable uses for such a bunker. Such a bunker could easily slow down the cops enough to make it possible to destroy incriminating data, or apparently in this case, thwart a raid that was not meant to garner a lot of public attention.
Make no mistake, though, if they *really* wanted in, they could breach in a lot less than ten years. They'd just need to hire some contractors or call the military.
This whole idea that they're impregnable is nonsense. There are cutting tools that will go through blast doors and concrete, and you can be sure that a determined SWAT team has access to them.
"Designed for nuclear war" doesnt mean you can just sit inside and not defend the premises as a demolition team goes to work on it, it just means it has some degree of resistance to a nuclear blast.
The different lists published by Spamhaus distinguish whether the IPs are directly responsible or are organizationally related. There is no abuse of power here — customers subscribe to the lists that they want, and use those lists to block as they see fit. Spamhaus isn't forcing anyone to use the lists, nor is it misrepresenting what's in the lists.
There are drilling machines that will bore railroad tunnels and 4-lane highways through granite.
Your post advocates a
( ) technical (*) legislative (*) market-based (*) vigilante
approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)
( ) Spammers can easily use it to harvest email addresses
(*) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(*) Users of email will not put up with it
(*) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(*) Requires immediate total cooperation from everybody at once
(*) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(*) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(*) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(*) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(*) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(*) Countermeasures must work if phased in gradually
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
(*) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
(*) Nice try, assh0le! I'm going to find out where you live and burn your house down!
1266953+17
Unfortunately, too many DNS configurations can be used for amplification, because the responses are larger than the queries, especially if you've got new and interesting record types like DNSSEC, and too many ISPs still ignore the Best Current Practices #38 recommendation on blocking spoofed traffic. RPF is your friend.
There's some mitigation out there because the bigger response record types don't always fit in a single UDP packet, so DNS servers may handle them over TCP (which is harder to forge), and many DNS providers limit who they'll accept requests from, but there's still a lot of sloppy DNS administration out there.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks