Slashdot Mirror
200-400 Gbps DDoS Attacks Are Now Normal
An anonymous reader writes "Brian Krebs has a followup to this week's 400 Gbps DDoS attack using NTP amplification. Krebs, as a computer security writer, has often been the target of DDoS attacks. He was also hit by a 200Gbps attack this week (apparently, from a 15-year-old in Illinois). That kind of volume would have been record-breaking only a couple of years ago, but now it's just normal. Arbor Networks says we've entered the 'hockey stick' era of DDoS attacks, as a graph of attack volume spikes sharply over the past year. CloudFlare's CEO wrote, 'Monday's DDoS proved these attacks aren't just theoretical. To generate approximately 400Gbps of traffic, the attacker used 4,529 NTP servers running on 1,298 different networks. On average, each of these servers sent 87Mbps of traffic to the intended victim on CloudFlare's network. Remarkably, it is possible that the attacker used only a single server running on a network that allowed source IP address spoofing to initiate the requests. An attacker with a 1 Gbps connection can theoretically generate more than 200Gbps of DDoS traffic.' In a statement to Krebs, he added, 'We have an attack of over 100 Gbps almost every hour of every day.'"
The obvious solution is to unplug the Internet. I'm sure the government and the movie people will be thrilled.
Hosting/Colo/Transit providers are the real core issue. There is absolutely no reason that URPF or similar or at least ingress ACL's are not in place. Lets face it if your limiting the prefixes announced you should be filtering on them as well. Anything even close to core can do this in hardware, URPF and similar there is generally no config required more than turning it on. At Hosting/Colo levels do you still have something on the public side that can not do at least ACL's in hardware? Plenty of automation packages can do this stuff in an automated fashion. The root cause is lazy and broken providers that just do not care, DDOS traffic can make some of them piles of cash directly in transit billing or indirectly as the only people with a big enough pipe to do ddos protection.
No sir I dont like it.
So why don't NTP servers limit their responses to, say, 1 per 10 seconds per IP address? Even if spoofing, it would not take that long to exhaust the subnet of the attack target.
Maybe this is another reason to use TOR or something more generic to mask IP? Not for privacy, but to hide in the crowd. Google wants to know everything anyway....maybe they should offer a service to be a web-proxy-server.
These services are available for any kid with five dollars. The last one that hit my network knocked us off and our upstream provider. They use spoofed packets to machines with services such as chargen/echo to amplify the attacks. If you contact one of these services they will threaten or try to extort money from you.
I can't help but notice all the comments so far are about technical prevention. If it is possible, well, that would be great. But for those who dodge all technical barriers and pull this off, maybe its time for some laws equivalent to those insanely high penalties for file-sharing. It's not like a 200Gbps attacks are inadvertent or accidental; they take some deliberate effort. Make it a criminal-record, no-passport, ruin-your-employability, year-in-jail kind of crime. I suppose the 15-year-old in Illinois will have his computer taken away; what if HE were taken away?
While we patch and patch, we might be getting close to the point where a real restructuring or protocol update needs to happen. Various researchers have proposed technologies that could make the internet far more resilient to stuff like this, and maybe it is time we switch over.
But I am not thinking some nice gradual switch over, but a nice 'if you don't upgrade by X time you loose your insurance and can no longer peer'. If nothing else we could kill at least two birds with one stone... think about the massive economic fallout from the Y2K update, all the money that flowed into tech and job for that had a ripple effect through the economy. Requiring a complete upgrade of the internet would put a real dent in the current economic downturn.
Require ISPs to do checks on IP spoofing. Case closed for most DDoS attacks. Optimization always comes at a cost of security. I'm not even an expert and still know the solution, just like a kid can read and click through a premade tool, fill out some forms and do attacks.
Kids don't have the moral subroutines to understand restraint. Anyone with a minimum amount of knowledge can fire off attacks these days, it seems.
Would you like us to send a refresh signal to your cable modem?
Somewhere, something incredible is waiting to be known. -Carl Sagan
Compared with the mostly unsolvable new normal of having most of basic internet infrastructure backdoored by a government i'd say that is pretty benign. You can diminish a lot asking administrators to fix their NTP servers or ban their IPs. But no matter how much you try, internet as a worldwide network is broken beyond repair, you can choose to ignore that fact (as much you can ignore to being hit by a 400gbps attack), but it will still be broken.
You're talking about an entirely seperate issue. This is all about the NTP amplification, as the article says a server on a gigabit port could theoretically push 200 gigabits.
I run a service that has 2 dedis on 10 gigabit ports..what if those got compromised or were owned by those unethical?
Then make the originating network legally and financially responsible for not filtering the spoofed packets originating from their network with a IDP (Internet Death Protocol) for any networks which do not fix their network within 3 days following a attack launched from their network.
"GET / HTTP/1.0" 200 51230 "-" "Mozilla/4.0 (compatible; Setec Astronomy)"
How can you push out propaganda if your main distribution method goes away?
---- Booth was a patriot ----
DDOS'ing a site? Lock 'm up for, at least, twenty years. The Internet is essential for civilized life nowadays. We wouldn't be lenient on people that blew up power lines, why be soft on the cyber criminals? Arguably they commit worse crimes.
Find them, charge them, incarcerate them. Put it all over the news. Make it known the Internet is not the be tampered with, just like power lines, gas lines, and other essential infrastructure.
That will stop them. Or at least it will stop them for doing it *again*, once caught.
May I remind you the internet is a global borderless network, which makes such laws impossible to implement. Also, it does not solve the problem, because there will always be a new guy stupid enough to DDOS someone. So, forget about laws. Just fix the internet.
DDOS causes more lost money than other "security" breaches. Therefore it is a top priority of companies and by extension public/private partnerships.
Of course, this is an asymmetric attack and you can't stop it. In other words, it is a democratizing attack.
When I worked with the FBI on security issues in the financial sector, I was disgusted by how little attention and funds were available to fix problems like unauthorized transactions but attention is available for issues like this.
-- I was raised on the command line, bitch
You wrote both "weaponize" and "weapon eyes", and you made some reference to "skateboarders" that I couldn't puzzle apart. What's going on here? Is your device set to "wreck a nice beach"?
iOS [fares] even better because all software approved by Apple for Appstore are screened.
But if most home computers are locked down to run only software chosen by the monopoly "App Store" chosen by the computer's manufacturer, then how will high school students enrolled in an introductory programming class complete their homework?
Finally, penalizing countries that continue to support software piracy will also help.
That or penalizing companies that refuse to sell their products at all in certain countries. In affected countries, copyright infringement is the only way to obtain a copy of the work at all.
May I remind you the internet is a global borderless network, which makes such laws impossible to implement.
Then perhaps the solution is to introduce borders, to implement something like SOPA except reworded to be not quite as unpalatable to civil libertarian types.
However, as long as the right legal systems and enterprising businesses exist, ventures like Android will keep popping up to balance out (and eventually crush?) 'monopolies' like iOS.
Then where's the 4" Wi-Fi-only tablet that can run applications designed for recent versions of Android as a competitor to the iPod touch? Or are people supposed to just buy a phone, not activate cellular data service on it, and pay for a GSM radio that they'll never use?
[In an App Store world,] how will high school students enrolled in an introductory programming class complete their homework?
As for young aspiring coders, they can use a free student certificate
Since when? This page states that only accredited postsecondary degree-granting institutions, not high schools, are allowed to participate. Besides, the parents would still need to buy the student a Mac on which to run Xcode; it does not run on an iPad even with a Bluetooth keyboard.
The real issue in this regard will be the effect on the open-source market. Then again, even Linux users are heavily dependent on online centralised package repositories, which could start adopting screening schemes.
Official repos already have screening schemes. But Linux distros also give system administrators the power to add third-party repos that someone other than the distro publisher screens. Ubuntu has PPAs, Android has Amazon Appstore and F-Droid, etc.
Or should people live according to their means
These "means" themselves are hard to compare between countries. Developers in the developed world expect to get paid on an exchange rate basis, while people earn wages on a purchasing power parity basis. The Balassa-Samuelson model predicts that currencies of markets without an established export industry will have disadvantageous exchange rates with more industrialized markets. Do a corrupt judicial branch and an economy oriented towards locally consumed goods and services go hand-in-hand?
CURRENT, low hanging fruit, root cause... take away windows(tm) and they'll target something else.