Slashdot Mirror
Massive DDOS Attacks Are Now Targeting Google, Amazon, and the NRA (pcmag.com)
PC Magazine reports:
A new way to amplify DDoS attacks has been spotted harassing Google, Amazon, Pornhub and even the National Rifle Association's main website after striking Github last week. The attacks, which exploit vulnerable "memcached servers," have been trying to hose down scores of new targets with a flood of internet traffic, according to Chinese security firm Qihoo 360... Github was the first high-profile victim and suffered a 1.35 Tbps assault -- or what was then the biggest DDoS attack on record. But days later, an unnamed U.S. service provider fended off a separate assault, which measured at 1.7 Tbps. Unfortunately, the amplified DDoS attacks haven't stopped. They've gone on to strike over 7,000 unique IP addresses in the last seven days, Qihoo 360 said in a blog post... Gaming sites including Rockstargames.com, Minecraft.net, and Playstation.net have been among those hit...
The security community is also steadily addressing the linchpin to all the assaults: the vulnerable memcached servers. About 100,000 of these online storage systems were publicly exposed over a week ago. But the server owners have since patched or firewalled about 60,000 of them, Radware security researcher Daniel Smith said. That leaves 40,000 servers open to exploitation. Smith points to how the coding behind the attack technique has started to circulate online through free tools and scripts.
Meanwhile, Slashdot reader darthcamaro shares an article about "the so-call 'kill switch'" that some vendors have been debating: "The 'kill switch' was immediately obvious to everyone who worked on mitigating this DDoS attack," John Graham-Cumming, CTO of CloudFlare said. "We chose not to use or test this method because it would be unethical and likely illegal since it alters the state of a remote machine without authorization."
The security community is also steadily addressing the linchpin to all the assaults: the vulnerable memcached servers. About 100,000 of these online storage systems were publicly exposed over a week ago. But the server owners have since patched or firewalled about 60,000 of them, Radware security researcher Daniel Smith said. That leaves 40,000 servers open to exploitation. Smith points to how the coding behind the attack technique has started to circulate online through free tools and scripts.
Meanwhile, Slashdot reader darthcamaro shares an article about "the so-call 'kill switch'" that some vendors have been debating: "The 'kill switch' was immediately obvious to everyone who worked on mitigating this DDoS attack," John Graham-Cumming, CTO of CloudFlare said. "We chose not to use or test this method because it would be unethical and likely illegal since it alters the state of a remote machine without authorization."
Or just malware being served as ads?
I'm thinking google, amazon and pornhub have measures in place to prevent massive DDOSattacks.
The NRA? probably not.
There are enough moron administrators on the planet to make memcached ddos possible.
Jesus wept.
The three pillars of society.
You then deserve what you get.
"Meanwhile, Slashdot reader darthcamaro shares an article about "the so-call 'kill switch'" that some vendors have been debating:
"The 'kill switch' was immediately obvious to everyone who worked on mitigating this DDoS attack," John Graham-Cumming, CTO of CloudFlare said. "We chose not to use or test this method because it would be unethical and likely illegal since it alters the state of a remote machine without authorization.""
Unethical my ass. Turn those suckers off.
We need more software that are secure by design. There is no reason to have a tool like memcached available for the entire internet. The memcached developers should have made it listen to localhost only by default. The setting to make it listen to other interfaces should be well explained in the manual, with all the risks and are-you-sure-you-want-this warnings.
It doesn't have to be like this. All we need to do is make sure we keep talking.
Well that's because the NRA is OBVIOUSLY responsible for EVERY SINGLE shooting that happens. Just like every Cloud Flair is responsible for every act of piracy that happens, Ford is responsible for every car crash, pharmaceutical manufacturers are responsible for every single OD, every single Mullah is responsible for every act of Islamist terror, and every single white male is reasonable for pretty much everything.
It's the [Current Year] and no one has any time for reasonable discussion. Just ban everything and you're a racist for not knowing this already.
Why would anyone target The NRA? Seems really suspicious.
Fuck the NRA, the NRA richly deserves being DDOS'ed, the other two cheat on their taxes so they also kind of deserve it, the real question here is : WHY PORNHUB!!!
Why would anyone target The NRA? Seems really suspicious.
It stokes up conflict among the pro-Second Amendment camps and ant-Second Amendment camps internally in the USA, and generally weakens democracy there. The right will blame it on the left, and they will all get into a massive huff over it.
International shits & giggles.
Why would anyone target Amazon, Google or Pornhub . . . ?
Why not, if someone else is footing the bill to disrupt the Internet.
Now who could that someone be . . . ?
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Why would anyone target The NRA? Seems really suspicious.
Maybe because they oppose net neutrality?
https://www.reuters.com/articl...
"She's furniture with a pulse"
unsecured Memcached servers could store data - par2'd data chunks, for example, similar to a newsgroup - along with indices / torrent tracker data / etc. And since they will store keys from spoofed UDP packets, there is no good way to figure out who put the data there.
:(
Just saying. Better than ddoses
Computers and the internet are obviously responsible for this DDOS attack. The people behind it might as well not be there! And these filthy organizations like yahoo and google who represent computers and the internet can go die in a fire! Who cares that the vast overwhelming majority of internet use is great, and it acts to curb government excess. I for one canâ(TM)t wait to put all of my trust in a dishonest, kill happy government run by corporate interests for all of my information in the future.
My guess is that people are hitting big names on purpose. By doing it that way it makes the mainstream news and increases the chances of it getting patched.
That's great they managed to patch 60k out of 100k vulnerable systems...
But as the rest of the systems continue to degrade the internet - at some point don't you have to say, for the public good these servers have to be shut down externally?
It's fine and dandy to say it's not justified to disable someone else's system that is unknowingly taking part in an attack. But that ignores that all companies and people that put systems on the internet have a responsibility to monitor and keep them up to date, and if they abuse that responsibility they lose the right to complain about external kill switches being activated.
It seems like after some time if you cannot get people to be responsible, you do what you have to and maybe next time they will be more proactive about fixes.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Well I remember when I had misconfigured my DNS server. The one's I were connected to didn't "kill me", they just sent a message telling me to fix it.
I haven’t seen it described but I assume the kill switch would be to point the servers at themselves or other open servers?
NRA? Hahaha take that you gun nuts!
Amazon? Whoa wait a minute...that's hitting below the belt. We need to stop them!
agreed. i have seen 400Mb/s ddos before and we asked our ISP to kill the traffic type, and they did so, 3 hops up the pipe..
i am sure their bill for the egress traffic will wake them up eventually..
Easy to narrow down the suspects.
The NRA was in the news? No I think you mean entertainment media companies in collusion with left wing political groups have discussed the NRA and accused them on television and the internet. That is not the same thing as news journalism doing real investigations and reporting on the facts.
Get some sense.
Spammers have made this solution nearly impossible.
Howdy, brownshirted thug! Nice boots you have on!
They have been constantly ddosing my IP with attacks that put 1.3tbs to shame!
You know, blocking DDOS traffic would be in violation of net neutrality.
What? They're harassing PornHub? ... uh... nevermind...
Why won't someone think of the
-
A bad guy with a botnet can only be stopped by a good guy with a botnet.
Attacking Porn Hub is a touch too far.
Why not use the same technique to make these servers attack each other?
That would get the attention of the admins responsible for configuring and firewalling these servers.
(Same for spoofed origin BGP and other amplification attacks too)
I wonder if admins get paid to leave these servers misconfigured / accessible for these attacks. Plausible deniability and all that. Maybe you could slow certain fiber links enough to profit when doing High Frequency Trading on the worldwide stock exchanges? That would be worth paying for. These attacks could be a test run for something like that. Whether this is the case or not, making them attack each other might help.
This would be a lot closer to "sinking to their level" than simply sending the flush command over and over again.
I haven't thought this through very well but since this is slashdot I'll just spout off anyway.
Thoughts?
Just ran out of mod points. Mod parent up!
NRA supports are well versed in false flag operations, both in how they work, and when. Listen to Alex Jones sometime to learn more. The NRA could be doing this to get sympathy.
> "The 'kill switch' was immediately obvious to everyone who worked on mitigating this DDoS attack,"
That is one hell of a stretch.. anyone with a brain would realize the ends do not justify the means. This is the kind of thinking you'd expect from oppressive countries..
> - John Graham-Cumming, CTO of CloudFlare
> - Chinese security firm Qihoo 360
For now if the internet core routers simply dropped all inbound UDP/11211 this nonsense would stop. UDP clients that were assigned ephemeral ports of 11211 would have to retry their connections. The internet glitch rate is already higher than 1/62k so the errors introduced by this configuration on legitimate clients would be hardly noticed while it would eliminate this very destructive attack.
Ok so this is a terrible idea, but is it technically feasible? If a memcached server gets a request that looks like it's a DDOS request (I have no idea if that's possible), have it target the source IP address of the request instead of the intended target.
... but why Amazon and Pornub?
Extremist hate groups make total sense as targets, but why Amazon or Pornhub? Are the attackers out of work retail employees or old porn stars?
You neither know nor have read ANYTHING about the NRA if you truly believe "they actively oppose ANY EFFORT TO FIX THE PROBLEM". The NRA supports denial or restriction of gun ownership to specific classes of people -- convicted felons, mentally ill, etc. Just go an look. I dare You! The NRA supports educational pursuits with children, adolescents, and adults with courses that deal with gun awareness, safety, safety use and proficient use. The NRA is a gigantic educational and training entity that provides training for potential soldiers and LEOs, training for current soldiers and LEOs, training for instructors, range officers, etc. for shooting ranges, etc. If someone knows what a gun can do, how to respect (use and handle) a gun, and how to avoid situations where improper gun use can take place, that someone has the NRA to thank. The NRA teaches this now. The NRA has taught this since its inceptions. The NRA will continue to teach this. If someone knows the above, that someone knows when to leave many potential dangerous situations before a prep starts shooting. Wouldn't it better for someone to know all the above so that they could avoid a dangerous situation? BINGO, you're in sympathy with the NRA!
That will discover the services that have been hijacked, because folk will start complaining their website went down.