Hacker News Reader

Comment by TekMol | Hacker News Reader

I am sure the DDoS problem is something that the free market will sort out. The individual players will make it costly for the other players to send problems their way. I expect a chain of "charge the next node for resource usage" to evolve.

If this chain will go all the way to the end user, I don't know. If it will, then end users will probably start using routers that feature restrictions / monitoring / control of outbound traffic. So you know your coffee machine will not be able to use up too much resources. Just like you have a fuse for the power line.

View on HN

Sometimes the free market needs a little help, due to the tragedy of the commons [1].

That's why the FCC has regulations on interference created by electronic devices. Reducing interference costs money. The free market punishes extra costs. The situation of networked devices with security-impacting bad features is analagous.

[1] https://en.wikipedia.org/wiki/Tragedy_of_the_commons

That's assuming that the free market doesn't "solve" things by ISPs and media companies merging into 2-3 mega-conglomerate verticals whose siloed content is only accessible via DRM via their own network.

Wouldn't it lead to just higher internet plans prices? I can also imagine hackers ddosing themselves to get the $$ from the nodes and unfortunate users. And what about international traffic? Same charge for everyone, US citizens and Nigerians? I don't think it can work.

You don't know how DDoS works.

The coffee machine might only have to send one packet per minute. The combined force of 100 million coffee machines distributed around the globe sending 1 packet per minute each to the same destination means that, in your suggested model, the end user traffic sources barely incur cost at all, while the target and every unrelated third party who happens to be unfortunate enough to be "close" to them are bankrupted.

Congratulations, you've just turned a temporary network DDoS into a permanent financial one.

I agree with you. IoT devices inside a SOHO should communicate externally through a proxy gateway device. IoT devices should only have communications in a p2p network in a LAN, and have strong restrictions or none access to WAN. Any type of updates should be given from a proxy device having proper hardening than a normal IoT device.

The router could provide password-protected web proxy to access the LAN IOT webserver. Then you've reduced the attack surface to the router.

It almost seems like we need some protocol extensions:

1) Standard auth protocol (not just web-based) for the router to protect the local computers. Some kind of user-and-software-friendly firewall. This could even extend to game servers and whatnot - what if the "shared password" for connecting to a hosted game server had the shared password implemented at router protocol level?

2) DHCP registration on a network should require a name, one that the user was prompted to provide at some point. No more identifying devices on you router by IP or MAC. You already need to provide a name for SMB or DNS, just finish the job and name all DHCP clients. Possibly this should work with DNS in some way.

This way user-friendly logging information can be presented to the user. Without that, routers don't have the critical information needed to tell the user which device is screwing up.

Edit: Google tells me this is already a thing... Sadly, good conformance on providing meaningful DHCP client names won't happen unless the FCC et al start testing IP-enabled devices for it.

vodafone is building a lowband/narrowband WAN that could/should be used for helping fix an impending Botpocalypse type of thing IF It's implemented with such a goal in mind: http://www.theregister.co.uk/2016/10/20/vodafone_nb_iot_roll...

It's not Vodafone specific, it's really a generic property of cellular IoT.

Any 3GPP technology (for IoT, primarily 2G and LTE) can provide private PDN connectivity, where the device is not put on the Internet but on a private LAN. In this case, the device will only talk to friendly server and will not be directly accessible from random hacker. Now it's not a mandatory features either, so some devices can be put on the Internet and become reachable. Even in this case the situation is less dire: the devices are attached to a subscription, and it's in theory possible to insert some filtering. Also, operators now often require that devices support over-the-air (OTA) software updates, which allows fixing vulnerabilities.

Now with 2G it's possible to have rogue base stations to hack devices. But this is a local attack, so not usable for this kind of massive DDoS. And this hole is closed in LTE, where there is mutual authentication (device authenticates the network too).

So yes, I believe cellular IoT should be safer. The private PDN feature is very simple and very effective. Now, will have to see the prices for the new lower cost IoT LTE categories: CatM1 and NB1.

CatM1 will be the first to appear in the US. It's rather versatile, and can handle low throughput data and will handle VoLTE in a second step. NB1 will appear first in Europe. It's more streamlined but it's really for message based application (sending a message now and then) and data only.

Don't forget that DDoS is a market too, and not the smallest one.

I am not sure why this is being downvoted. I think it's an interesting perspective. After all, it's in pretty much every internet user's and provider's interest to have a working internet.

I think it's being downvoted because it's not a great strategy to address a distributed denial of service. In a DDOS, you have a high number of attack sources, none of them using a great amount of bandwidth on their own.

The bandwidth use isn't notable until you get pretty close to the destination. Thus, the costs are (mostly) borne by the victim. Basically it doesn't put the pain where it needs to go.

If the transaction cost can become insignificantly low, then money could flow in the direction of the victim. Each attack source could end up making a small contribution to the victim's bandwidth bill.

I'm not sure economic incentives will lead to this happening. There's also the difficulty in attributing traffic to the person who requested it ("is this a request, so we should bill the packet source, or is this a reply, so we should bill the packet destination?").

But in theory, I don't see the DDoS pattern (a high number of attack sources) making any difference to this proposal.

Are you suggesting that people should get paid for receiving traffic?

I believe this is what TekMol suggested when he said that the "individual players will make it costly for the other players to send problems their way".

But wouldn't this make the matter worse ?

Besides all the complications associating with billing, wouldn't this create more incentives for those controlling the botnets to use them in a creative way to actually make money from traffic ?

Fuses (circuit breakers actually) are required by code.

Reply on news.ycombinator.com