Why Friday's Massive DDoS Attack Should Be Terrifying
truevault.com
truevault.com
Why can't a list of addresses of all the devices in the world of the type used in the attack be created, and all packets from any address on the list be trashed? At least, for the duration of the attack.
If such lists were made ahead of time, they could be turned on rapidly.
Is anything like this done?
NAT: blocking an iot address may be blocking grandma's whole network (or her whole apartment complex's network), and the ISP doesn't want that support call.
Dynamic addresses: depending on the ISP, the IP could change quite frequently (daily), so keeping the list up to date to avoid collateral damage to the unlucky recipient of the blacklisted IP is very difficult.
I, for one, would be fine with a general internet citizen losing access if they have a compromised device. I suspect this is how we will go -- your home security cam was used in an attack, now every single website you visit for XXXXXXXX days gives you a CAPTCHA.
I maintain the crucial element is informing people why they have that hassle. Add extra friction, but not inhibit what they can do, because they are unable and unwilling to secure their devices.
Yes, this affects the internet-uneducated disproportionately. Yes, I think it is the responsibility of anyone with a broadband connection to understand the responsibilities that come with it.
No, I do not expect grandma to learn this. I expect her to deal with a crippled internet because they are not able to fix their pollution.
Note: this isn't something the US can solve. A lot of this traffic came from overseas. It's needs a coordinated response.
You also need to acount for the fact that these devices are going to be alive for years maybe even decades which means that their security measures would become obsolete.
DDoS needs to be solved on the infrastructure level at this point, securing endpoint nodes is a game you are going to constantly lose.
But paying quality engineers isn't fun and they won't work for idiot management. So as long as management doesn't have to pay for the cost of disasters they cause, nothing will be secure.
It's the same thing that happened at Hillary's State Department.
So I agree: Brick those refrigerators.
Nor would this regulation have to come from government. The details could be delegated to a UL-like industry group.
Also while this attack did involve a botnet which used default credentials there will be attacks that infect via RCE or any other unauthenticated vector or simply don't require a botnet at all like say adding a multicast IP address to some wificamera or telemetry device that would cause it to send its traffic to a victim of your choice.
At the end you want to make sure your network and services are resilient to DDoS attacks, securing the endpoint source of choice everytime isn't that good of a strategy.
My point above is that there are very sane regulatory changes that we can implement immediately, as part of attacking this problem.
The problem with "IoT"(got I hate this term) is that it connects mass produced lowest barrier of entry devices with network stacks over pretty substantial bandwidth lines.
The difference between "residential" and "commercial" bandwidth is eroding it's no longer orders of magnitude greater even if you are pulling multiple 1gbit lines from your DC.
"IoT" are often not that purposely built they are going to share SoCs and likely firmware/software that will make 100,000's of units if not more vulnerable to compromise.
If you have say a 1M Apple HomeKit enabled light switches across Europe and the US which were built by some lowcost/OEM "insert_your_brand_name_here" manufacturer vulnerable to a single exploit you get the same problem.
And this problem will happen over and over and over again with different devices.
Delving into motives can have the effect of encouraging people who want attention.
[1] https://twitter.com/fbajak/status/789611472280178688 and http://www.anonintelgroup.com/2016/10/21/twitter-down-its-no...
Note: I'm not dismissing the validity of the concern. I'm only reporting that I didn't even know about it as the attack was happening. I'm sure others were much more severely affected.
But perhaps this is a smarter approach: build software and services in the most reliable way possible: offline enabled without the assumption of mostly available internet. Oh, and VOIP phone service? Gonzo. Where I work that was the worst effect of the outage. The phones simply didn't work... And we're basically a sales company. Not a lot of sales were made that day...
Imagine if the hack occurs again, but is more targeted towards things that aren't just minor annoyances, and maybe happens on election night in the U.S.; I mean just earlier this year a repo on a package manager being deleted caused mass failure across the world of applications. A targeted attack on certain assets or dependencies could be very bad indeed. I would argue that GitHub being effected was more important than the other consumer based services in this attack. This is the first of many similar attacks in the coming years.
Suppose Mars gets destroyed by an unseen cosmic event. Are Earthlings inciting bullshit to go "oh shit, this could happen to us?"
If you look at HN comments from posts about the attack while it was ongoing you can see plenty of people who were also affected by the attack (for example, people looking for name servers that cached longer than allowed, or opendns' smartcache). I understand why you think "the media" sensationalizes things, but in fact it is absolutely not complicit in saying things that are not true, even for the sake of embellishment (i.e. look at what happened to Brian Williams).