Slashdot Mirror
A Live Map of Ongoing DDoS Attacks
Daniel_Stuckey writes "Check out the Digital Attack Map. It was produced in a collaborative effort by Google Ideas and Arbor Networks to raise awareness about distributed denial of service attacks. You know, those malicious digital attempts to choke, or shutdown websites by sending them volumes of traffic far too large for them to handle. The map 'surfaces anonymous attack traffic data to let users explore historic trends and find reports of outages happening on a given day,' as its about page explains. Created using attack data from Arbor's 'ATLAS® global threat intelligence system,' this is the D.A.R.E. of DDoS — it's about the danger of having information streams cut off. Under the heading 'DDoS Attacks Matter,' Google and Arbor explain that 'sites covering elections are brought down to influence their outcome, media sites are attacked to censor stories, and businesses are taken offline by competitors looking for a leg up.'"
This comes alongside Google's announcement of Project Shield, the company's homegrown DDoS mitigation service.
Where is Slashdot on this map?
The site is currently being slashdotted. :)
The government which is strong enough to protect you from everything is strong enough to take everything from you.
This interactive map of denial of service attacks seems to deny it's own interactivity by freezing my browser every time I try to interact with it.
When asked why, the answer is almost always: "It's 2014".
The site has chosen not to display the content to certain browsers. I can't help it that our company policy has us locked to a certain version.
Honest question: will animations, flash, silverlight, (or however it's displayed), really-really not work on last year's browser. Really?
surely, there's a protocol-level solution to this.
There's a balance but I'd like to see more options for refinement and additional information, filter layer style maybe. Whizbang goes whiz.
I certainly hope this isn't like DARE, or else it'll encourage an entire generation of kids to experiment with DDoS...
Seems quite a few countries are taking shots at china, but they're too focused on the United States to care.
The sources of the attacks is not so much where the person launching the attack lives, but computers that takes part in a botnet/have a trojan/visit special pages, or hacked sites (usually with the owner of those computers/sites having no clue of that happening). It could give new information on DDoSed targets, but for sources could have too much noise to be useful.
it's about the danger of having information streams cut off. Under the heading 'DDoS Attacks Matter,' Google and Arbor explain that 'sites covering elections are brought down to influence their outcome...
If you can influence the outcome of an election by shuttering sites that merely cover the election, then you have way bigger problems than DDoS.
Agent Ward: It means somebody really wanted our initials to spell "shield"
Google's Shield is an interesting dare to the malcontents of the internets... Resistant to attack, you say?
I believe that individual liberty is fundamentally incompatible with any society, or at least inversely proportional to societal interconectedness. Fact is, every person who isn't immunized, and every person who isn't educated, and every computer that isn't up-to-date, patched, and secured.. is a liability to us all. Ultimately, the freedom to be or have one of these things will become untenable and will be removed. I believe that's a good thing.
There's an ISP level solution to a major chunk of it, but they're too busy cracking down on bittorrent and competing voip/video services to do anything about it.
A lot of DDoS traffic has spoofed source IPs in order to make it difficult to track down the source. All the ISP has to do is prevent packets from leaving their network if they aren't addressed from their network, and at least what's left can be traced back to the source. For instance, this would eliminate using DNS servers as reflectors for attacks, since these attacks rely on sending a DNS request with the From address forged to be the victim's from address.
If I have been able to see further than others, it is because I bought a pair of binoculars.
is once again overshadowed by the U.S. of A. I think I can see a little line dropping into Canada. There is still hope that more people will care enough to attack you, too.
jsut athnoer menagiensls ltitle psrhae for you to dcoede. Why do we wtsae our tmie dnoig tihs?
To whoever can draw a penis pointing at mexico.
Man, that seems like a sensible thing to do. It's not good, suggesting sensible things. Why don't you please come by to our brain-washi-- I mean, educational center? You clearly need it.
I don't care if I'm wrong. I only care about everyone obtaining something from the discussion.
You must comply
Exterminate
All the ISP has to do is prevent packets from leaving their network if they aren't addressed from their network, and at least what's left can be traced back to the source
Most ISP's already do this, just like most ISP's use a whitelist approach to BGP announcements. Not all, granted, but if you want to peer with the 'big boys' that's how you have to play.
And just as an FYI to the GP, most DDoS are done with botnets these days so there isn't much in common in terms of source ip's and networks. It's not something that can really be dealt with at a protocol level, because there's usually no way to really tell if the traffic surge is legitimate or not. For example, when a nation like the US (just as an example) chooses to launch a new healthcare.gov website (hypothetical of course) which draws global attention and will draw tens of millions of unique visitors per hour (purely speculation of course) it has the exact same pattern as a sudden DDoS.
Unicast reverse path forwarding. ISPs should enable this on subscriber facing interfaces for the majority of their customers. The only exception needed is where customers have BGP adjacencies with the provider, as it's possible they could be multihomed and it would cause issues there. They could also enable something like NetFlow-triggered outbound subscriber shaping/inbound policing. If a customer is sending something which is obviously garbage (like TCP resets to the same destination), NetFlow could easily pick it up and an outbound/inbound policy-map/firewall filter (choose your vendor) pair would be automatically applied on the subscriber-facing interface. This will still allow the customer to use their connection, but bottleneck it until the offending flow stops. Providers already do things like community-string triggered null routing, but this is usually part of an add-on pay service. These other things could and should be done across most of their networks, most specifically on residential customers.
Most of these attacks sources are either
a. Idiots with DSL that click yes to everything
b. Businesses that have no IT staff and let their nephew setup their network.
The traffic is easily detectable and easily shut off by locking their account. ISPs don't want to do that because in most cases the target is not a paying customer and the person whos computer is compromised is. Why would they potentially tick off a paying customer before the target complains? Moreover why would they invest time, energy and equipment into detecting attacks?
Fine the ISP. Then they'll have a reason to give a shit.
Many DDoS attacks don't need spoofed source addresses anymore. Oftentimes, it's sufficient to just have thousands of 'zombies' issue totally ordinary requests to the server. Has the added benefit that you are putting load not only on the network, but also on the server and possibly database.
The numbers of zombies in these attack networks has gotten large enough that there is no way that an ISP could implement source address filtering for every single one of them.
Therefore, your suggested solution won't work in many or even most cases anymore.
I love the fact that Google has its own DDoS mitigation service. THE ADVERTS MUST GET THROUGH!
... then the US has a whole lot of secret admirers.
Anons need not reply. Questions end with a question mark.
Correction: many or most high profile cases. For every big DDoS we hear about on /., there are thousands if not tens of thousands that go unnoticed by the majority, done by some script kiddie who thought he'd have some fun with his tiny botnet or by some crazies in a Middle Eastern or slavic country who decided to deface your site and claim it as theirs. Those attacks very often rely on amplification and spoofing to do any damage.
"All the ISP has to do"
All that all ISP's in the world have to do...
most attacks on the map are "source unknown" type, which I assume means spoofed ip's.
world was created 5 seconds before this post as it is.
I get almost 100% CPU utilization from that map...
The map is total rubbish.
According to my version of the live map, there is a mid-sized attack from the US to China and at the same time a gigantic attack on the US from outer space!!!
Another POS low contrast design.
Hey stupid kids:
If you have something to say, don't say it in gray faded barely readable text.
"All that all ISP's in the world have to do.."
Yes.
And you state this why? Is it impossible for ISPs to do that? Remember there may be tens of thousands of ISPs but they have to hitch to one of only a select few backbone providers who are ALSO ISPs. And they know what subnet that IP came from. Therefore if only those few did it, then spoofing would only be possible within the same sub net that the noncompliant ISP did, and the botnet owner doesn't know (or to this point care) what are acceptable IP ranges to use that won't get nuked by this.
Each of those major ISPs could also refuse to carry traffic from an ISP that doesn't apply this state.
Remember, all that was needed to have a usable commercial home electrical goods system was for "All electronics manufacturers" to agree to a standard set of plug, voltage and/or frequency.
Buy goods in your country and it will work because "all manufacturers" DID agree.
I'm on CentOS, so I'm running FF ESR 17.0.9. It displays the map, after I tell noscipt to do so. However... trying to see any given stream's info, putting the cursor over it, is a complete waste: it flashes, then vanishes. I move it upwards, and I can read part of it, but not the rest before it goes away. In effect, you can't read the captions on what you're seeing.
I'd give it somewhere between a D+ and a C-., with D for useability.
mark