Slashdot Mirror
Why the Silencing of KrebsOnSecurity Opens a Troubling Chapter For the Internet (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: For the better part of a day, KrebsOnSecurity, arguably the world's most intrepid source of security news, has been silenced, presumably by a handful of individuals who didn't like a recent series of exposes reporter Brian Krebs wrote. The incident, and the record-breaking data assault that brought it on, open a troubling new chapter in the short history of the Internet. The crippling distributed denial-of-service attacks started shortly after Krebs published stories stemming from the hack of a DDoS-for-hire service known as vDOS. The first article analyzed leaked data that identified some of the previously anonymous people closely tied to vDOS. It documented how they took in more than $600,000 in two years by knocking other sites offline. A few days later, Krebs ran a follow-up piece detailing the arrests of two men who allegedly ran the service. A third post in the series is here. On Thursday morning, exactly two weeks after Krebs published his first post, he reported that a sustained attack was bombarding his site with as much as 620 gigabits per second of junk data. That staggering amount of data is among the biggest ever recorded. Krebs was able to stay online thanks to the generosity of Akamai, a network provider that supplied DDoS mitigation services to him for free. The attack showed no signs of waning as the day wore on. Some indications suggest it may have grown stronger. At 4 pm, Akamai gave Krebs two hours' notice that it would no longer assume the considerable cost of defending KrebsOnSecurity. Krebs opted to shut down the site to prevent collateral damage hitting his service provider and its customers. The assault against KrebsOnSecurity represents a much greater threat for at least two reasons. First, it's twice the size. Second and more significant, unlike the Spamhaus attacks, the staggering volume of bandwidth doesn't rely on misconfigured domain name system servers which, in the big picture, can be remedied with relative ease. The attackers used Internet-of-things devices since they're always-connected and easy to "remotely commandeer by people who turn them into digital cannons that spray the internet with shrapnel." "The biggest threats as far as I'm concerned in terms of censorship come from these ginormous weapons these guys are building," Krebs said. "The idea that tools that used to be exclusively in the hands of nation states are now in the hands of individual actors, it's kind of like the specter of a James Bond movie." While Krebs could retain a DDoS mitigation service, it would cost him between $100,000 and $200,000 per year for the type of protection he needs, which is more than he can afford. What's especially troubling is that this attack can happen to many other websites, not just KrebsOnSecurity.
I thought everyone said the internet treats censorship as damage and routes around it. You mean to tell me that's not true and I got bad information from Slashdot?!? My mind is blown!
I thought the "internet of things" was a .. "diegetic prototype", ie a fantasy. how many net-addressable refrigerators and automatic light switches are there, that they can mount a DDOS of this scale?
--
if all you have is a bow, every problem looks like a skeleton
They don't care that IoT is a horrible idea, and they ignore countless other security practices to increase their own pocket wads. Power holders want to track your every move and dig every loose penny they can find out of _your_ pocket in the process.
Stop connecting every damn thing to the Internet, and start securing what you have to have connected. This is not a mentally challenging thought process, so if you don't "get it" that makes you...
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
I fear the stable internet days are numbered...
There is no fucking reason for the internet to be this much of a clusterfuck. Spoofed routing updates, IP spoofing, none of this should be possible by design.
With a non retarded internet DDOS attacks could simply be blocked at the source by certified ISPs. Any ISP who abused that ability, or ISPs which repeatedly allowed spoofed traffic to originate from their network could simply be banned from the internet. Problem fucking solved.
Stop patching up this shit and give us a next generation internet, I'm sick of this shit.
SPECTRE. The SPecial Executive for Counter-intelligence, Terrorism, Revenge and Extortion.
From a James Bond movie.
https://en.wikipedia.org/wiki/SPECTRE
As long as it scales in parallel to money, its nothing new or revolutionary. New gun for hire, different day.
...that there's ANOTHER reason the "internet of things" is a stupid idea.
-Styopa
Big deal. One domain was silenced.
He can still work and do what he needs, now he has to participate in the rest of the media network.
That's the whole point of the Internet being invented in the 60's to begin with. One site / segment get's bombed, you can still get on in other segments of the network. All he needs to do is submit Press Releases just like everyone else.
Problem that's not a problem has been solved.
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
What's especially troubling is that this attack can happen to many other websites, not just KrebsOnSecurity.
So wait, a DDOS attack can happen to anybody? This kind of hard hitting revelation is why I keep coming back to this site.
Only crack the nuts that crack. You don't put the ones that don't crack in the sack.
This sounds like a good use for some torrent-type technology to supply "distributed websites"
Rather than having a server or "servers", articles go out from a seed source and are quickly seeded throughout the world. Maybe add some sort of checksumming/encryption to help validate that an article did in-fact come from the real source and not an impostor... it would stop sh*t like this from happening.
The attackers are distributed. The victims are not. We need to superdistribute web content like we do with music. Think TOR meets torrents. It would take httpd authors, browser authors, and even search engines to get in on the act, but it would put an end to the problem. (somebody is probably already working on this)
The web, like e-mail, is going through death throes. The kids will decide what lives and what dies I guess.
I am not interested in articles about life extension advancements.
If they are so easy to commandeer, I think a group should go around bricking these damn things. Brick enough of them and either users will toss them or return them. Either way, the vendor will actually consider lockdown and security a value add or go out of business. The world is better off.
Make egress filters mandatory. No ifs or buts. Make it law.
Make it law that I can disconnect any user who isn't egress filtering and is sending me shit. Consumer business enterprise government state.
This shit all has a fucking solution. It's fucking 2016 people. Egress filtering stops a lot of this shit. Any business not doing it needs to gtfo off the internet.
Shitty isps who don't filter will quickly get th picture when I can legally shut down their bgp session despite contracts.
Literally, there is no reason not to do this. Anyone pushing back is either extremely naive, completely technically inept, or a criminal. Seriously.
They don't care that IoT is a horrible idea, and they ignore countless other security practices to increase their own pocket wads. Power holders want to track your every move and dig every loose penny they can find out of _your_ pocket in the process.
Stop connecting every damn thing to the Internet, and start securing what you have to have connected. This is not a mentally challenging thought process, so if you don't "get it" that makes you...
My penis is so very big. It is also incredibly penisey! It could go right up your rancid butt hole.
-1? Lol, looks like I struck a nerve.
> articles go out from a seed source and are quickly seeded throughout the world.
That's a wonderful idea. We'd need a new protocol for distributing these "articles". We could call it Network News Transfer Protocol or something. You could tag your article according to categories andsubcategories, and people could subscribe to these different news groups. We could use ssl/tls for authentication of peers.
It probably wouldn't take too long to develop such a protocol; I bet we could have it done by 1986.
packets are speech, just like money
right?
The sooner we move to IPv6 the sooner we say goodbye to this crap.
That would turn your frown upside down and you'd be full of joy that his evil hate speech is finally offline.
Well good news. Krebs is totally a republican and is voting for Trump - so this is the GOOD kind of censorship.
You flatter yourself. You're another douchy AC, just like me. No more, no less. You are irrelevant here, just like me.
If I understand this correctly, Akamai threw Krebs out because Akamai could not handle the DDS. This means I'm never sending any business to Akamai because they can't handle it properly. But it doesn't mean Krebs is off the air for long.
For example, I bet Cloudflare would take him on. They've differentiated themselves on the ability to handle DDS.
Bruce Perens.
The answer is already here.
Use ipfs
https://ipfs.io/
This problem goes away on it's own. Sure they DDoS but they only be hitting 127.0.0.1
They will help.
Site is suffering a DDoS attack, and we slashdot it.
Why should an entity reveal its capabilites setting up such attack bringing himself too much in the public light and without any monetary profit. It may backfire by getting the authorities, and even other ddos attacks users, on his trail and by triggering the search and implementation of technical and regulatory measures to reduce or eliminate the means he uses for the attack. The entity behind this does attack may have just triggered a Barbara Streisand attack.
In the past it was trivial to just mirror websites as they typically only consisted of some HTML pages and some images. If something like that happened in the past, you'd just have mirrors popping up everywhere.
Today websites are much more complicated. Even something as simple as a blog is now dynamically generated every time its loaded. You cannot simply mirror that.
Gee, sarcasm.
newsgroups are different than a P2P seeding system. There wasn't really a peer so much that your ISP and some other major odies would keep local cache's of the top groups. The obvious disadvantage of this being that those same bodies get to choose which newsgroups they clone/share, whereas in P2P anyone who has picked up the document/article/whatever is potentially also a peer.
That.
Ok, people my point is we have too long relied on companies protecting those that can pay (Brian cannot) the hefty fee from DDOS.
And when I introduced this thought with "one fat .. target" I meant even Akamai with its big - but limited - bandwidth is condensed to just one target when that bandwidth is exhausted.
My point: Mittigation for this scale of attack is to counter it with a "borg collective" of an even or bigger scale.
The vulnerability for Brian, us and everyone is, that the fight is one against an army. Now one could argue that going on the offensive(attacking the bots, identifying the bots) would be a favourable cause. However this would end up in many little scrimishes that drain energy and end in a victory for that bad guys, because they have more energy.
So I don't think that such an offensive would be a meaningful course of action. The best course of action would be to first weaken those DDOS attacks and then rendering them uneffective because there is not even a single target.
So todays sites are a single sitting fat target, Akamai is just a thick wall, but every wall can be shot to pieces with a big army.
But there are two known and working mittigations
a.) freenet / freesite - with its hash keys and asymetric encryption a site is even "signed", also everyone who connects to a freesite will store it in the cache/storage.
b.) bit-torrent
example: It is still active and thriving till today, under attack and not just holding up but thriving.
Idea: torrent(ify) the web
But the secondary - offensive - measure is to identify the unwilling bots of these bot nets and work on this front - long long way to go.
Which central server did these non-peers cache the newsgroups from?
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php
I know that I now want to read the articles, whereas before, I wasn't even aware of them.
Security profesionalls wanting to mitigate the threat of DDOS could start by widely distributing the articles across multiple sites. If every site that cares about security mirrored their targetted colleagues in time of need...
Well, next time it could be your website. Or your bank's website or any other web site or service you need and you don't even know you need it badly.
Krebs just needs to change his distribution model. Instead of limiting this info to his own website, just start publishing the content on any interested website. Why hasn't slashdot already contacted him and offered to host his content? Even if they can DDoS a single major site into submission, they won't stand a chance of taking several offline.
For that matter, why wasn't Akamai sending out tons of abuse@ emails during this mess, telling ISPs to stop the flood coming from their side, or face financial liability for any continuing traffic? That would actually SOLVE the DDoS problem, quickly and permanently diminishing the ranks of their botnets, and eliminating the attackers resources, costing them money.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
My penis is so very big. It is also incredibly penisey! It could go right up your rancid butt hole.
Which would be the best sex you ever had. Leaving you to die, decades later, broken hearted and confused.
Then stop posting you fucking moron.
Just the first round of all the Bad Things IoT is going to bring society. From monster-size DDoSes to the coming binding of real world events to can't-be-made-secure-computers , you know like the one you're typing on now, IoT is a motherfucking disaster in the making and we should stop it dead in its tracks right now.
But no.... think of the future. Think of the children.
NNTP was pretty decentralized, one of the challenges with it in the later days of NNTP was the relative ease of newgroup injection and crapflooding.
IIRC, NNTP server software on the hardware of the early 2000s scaled poorly and the traffic volumes were growing fast so you started to see ISPs get much more control oriented when it came to retention periods and which newgroup messages they would honor and from whom.
Just ask Alexa and Siri - "stop botnet"
> or service you need and you don't even know you need it badly.
Have we really come to the point where we can not live with a couple of sites being temporarily knocked off the internet?
Heaven forbid someone figures out how to ddos the power grid because that would take down all sites!
Hold manufacturers of such shitty IoT appliances liable for facilitating crimes. Not only will we be spared fridges that spy on our lives, this whole mess would end pretty fucking quickly.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
It's not a good thing when one or two jackasses can fuck over the entire internet.
And yes, I know this wasn't the entire internet, but imagine this attack writ large, performed by multiple actors, possibly with state backing (or maybe just a lot of personal resources).
The internet is basically at the mercy of whoever feels malicious on any given day and who has the ability to push a few buttons.
Just cruising through this digital world at 33 1/3 rpm...
It's time for you to go to the mountains for awhile, AC. Nobody here cares about your boring existential crisis.
DOSing is easy. It's easy to DOS. Botnets are cheap as fuck these days and seemingly in neverending supply. If you're pissing off the "wrong" people then you better sure as fuck expect this kind of shit (and worse) to happen.
Post your shit far and wide. Put a mitigation service into play and have a backup ready to go. Hire some personal physical security. Be as visible to the public as you can. If you can't do this, then you need to properly consider what you're getting yourself into.
The article comes across a a creative writing assignment disguised as journalism, which is a bit of a shame.
rockets solve the problem.
Fair amount of Akamai hate going on here.
"Krebs was able to stay online thanks to the generosity of Akamai, a network provider that supplied DDoS mitigation services to him for free."
THAT SHIT AIN'T CHEAP. As it turns out, companies can only do so much before they actually need to get paid for their service. If Mr. Intrepid Security Internet Reporter had some actual contingencies in place, such as the ability to pay for his website's mitigation services during a stepped up attack, when maybe things would be a bit different right now.
The site is back! Now hosted by google.
www.securitytaco.com reports that the staggering amount of junk data involved in the DDOS is equivalent to 3x the holdings of Wikipedia every second. http://www.securitytaco.com/2016/09/24/iot-household-appliances-take-down-website-ddos-attack-is-largest-ever-recorded-and-your-toaster-oven-may-be-on-the-prowl/
> newsgroups are different than a P2P seeding system. There wasn't really a peer so much that your ISP and some other odies (bodies?)
You didn't have to use your ISP's servers, just like you don't have to use their DNS. People routinely used other news servers, and nerds often ran their own. Of course using your ISP's local servers tends to be faster and more efficient than some server on a far-away network.
Until shortly before NNTP mostly died, most ISPs didn't want liability from choosing to carry specific news groups, so they didn't choose - they carried all of the official ones, and most of alt.
> Gee, sarcasm.
Half sarcasm, and moderated +5 Informative. I work with engineers born in the 1990s. It's not uncommon for such people to invent something, not knowing it was commonly used in the 1980s.
If you haven't noticed it in tech, you've surely noticed it in policy discussions - people argue, predicting what the effect of trying policy X might be, apparently unaware that policy X has already been tried many times in many places. I'd guess that close to 50% of political posts are people predicting the past.
I was a pretty strong NNTP user until some of my more regular groups became unavailable (dropped by ISP, probably due to piracy concerns) and the rest started getting spam-flooded.
The big difference in this, other than distribution, is that NNTP was generally synchronised by topic, whereas I'm speaking more on something like a distributed "site" seemed and keyed by a single author/organisation. I.E. for Krebs, only he or somebody affiliated with him should be able to post.
Another user mentioned "ipfs". It seems a bit complicated to setup but is a similar premise.