Hacker News Reader

Comment by codedokode | Hacker News Reader

That article is completely wrong. Misconfigured servers that amplify traffic are not a problem at all. Blacklisting all of them would take no morethan several hours.

The problem is that there is no protocol for rejecting traffic. That's why DDOS is so easy and successful. If you are a website you cannot send a message to uplink saying "I don't want traffic from this network". So small and large ISPs do nothing to help protect victims and make it easy for criminals to extort money.

View on HN

The argument is that the servers aren't a problem - the problem is that we don't have a protocol to block them. Of course, we wouldn't need a protocol to block them if they weren't a problem. I'm very confused by this argument.

"X isn't the problem, Y is" is the overconfident way of saying "Y is a better solution to the problem"

Misconfigured servers that can amplify are only one way to DDoS attack. Even if this wasn't a problem you would still have all the other ways to DDoS, which you could handle easier if you could actually block the traffic.

So yes, we would still need that protocol.

Also, hosting vendors that allow customers to spoof source IPs. BCP38 would nicely fix all of that and most reputable hosting providers have it, but all it takes is a few to not use it to give this possibility.

This sort of thing is being done as far as I know, but I'm not aware how big a customer you have to be for your ISP to care about such notices. Perhaps so large that you've nearly got enough capacity to handle the traffic yourself anyway.

It also creates a nice DoS vector: if I want to not take an exam today, I'll just do a little ping flood from the school network and get banned for a while. Similar to account locking on 3 invalid attempts, except now you can block everyone at once as soon as you're in the network or on the same ISP.

As a small customer I’ve experienced them doing the complete opposite. I’ve had a 1u collocated at one center or another for the last ~15 years and occasionally we would be the target of a DDoS. The data center would just blackhole us until things calmed down. It’s better than a surprise bandwidth bill but certainly not great.

FWIW, that's what happens for large customers too, from my past experience. Someone aims the DDoS cannon at one of our webservers [1], and if the traffic is above the threshold, that server's IP gets blackholed for a while. As a large customer, you do get to have some input into the thresholds, and how long the blackholes are, and to definitely have traffic blackholed rather than put through some crazy filtering apparatus that adds so much latency it'd be better to drop everything.

OTOH, we always had at least 4 webservers, so if just one got blackholed, no big deal, update DNS so most of the real users make it to the available servers, most of the abusers will keep hitting the blackholed server and not move on. If your abusers aren't run of the mill script kiddies using a rent-a-ddos service, it's more difficult.

[1] it's almost always the webservers, not the servers that do real work

How large is a large customer here? Paying the hosting company monthly bills on the order of 1k, 10k, 100k? I expected this to only affect small and medium businesses, so I'm genuinely curious what qualifies as large but is still affected. (My security consultancy work only tangentially touches upon DDoS, so I know a thing or two but am not actually in this business.)

My experience is a bit old at this point, and I don't remember quite where exactly we were when we got to have a meaningful conversation on getting the blackhole settings set to reasonable values [1], but our bills were at the high end of your range, and we were a top 5 customer at some point.

For us though, getting one server blackholed every so often wasn't that big of a deal, so as long as everything was managed reasonably, and the ticketing was timely so we didn't spend a lot of time trying to figure out why server X wasn't working when it was just a blackhole from DDoS. A clever abuser could have caused a lot more trouble, but clever people tend to find more productive things to do.

[1] don't blackhole unless the traffic rate exceeds line rate (which topped out at 2x 10G), retest after 1 hour instead of 24 hours for the first retest, etc.

Ah yes, I know those stories as well. I found that surprising also, but it seems to stem from the botnet era where there were thousands upon thousands of originating networks instead of some big (DNS) servers. The practice is still in place though, especially at some cheap hosting providers.

So basically the data center took the side of the criminals.

It is sort of a common practice to get rid of "problem" customers too.

We ran a pretty large Counterstrike gaming community with public servers, and did some very small scale paid server hosting on the side. It's unfortunate that anyone would consider us "problem" customers because DDoS attacks are so easily performed by script kiddies. It can happen to anyone hosting public resources that aren't easily filtered through no fault of their own.

I totally understand what you're saying though.

Because that makes incoming traffic not to come to them at all. Traffic costs money and usually much more than a single 1U colo cost.

BTW nice username

No doubt, we weren't able to pony up the cost difference to cover the bandwidth in cases like this so I get why this was their move.

You have a nice username as well!

> but I'm not aware how big a customer you have to be for your ISP to care about such notices

So basically ISP don't want to do anything to prevent misuse of their infrastructure because it is more profitable this way.

> It also creates a nice DoS vector: if I want to not take an exam today, I'll just do a little ping flood from the school network and get banned for a while.

The idea is that you can only block traffic going from school network to your site, but not any other traffic from that network.

There are protocols in development at the NIST such as Named Data Networking[1] that implement such a scheme through flow balance and interests.

[1] https://en.wikipedia.org/wiki/Named_data_networking

and the public does what for the next 20 years before that reaches beta stage?

So, government will be able to silent anybody anywhere in the Internet just by using standard protocol. A Great World Wide Firewall.

They will be able to do it only for their citizens and they can do it already.

The article is correct and MS is at fault here (also per the comment there)

"The problem is that the non-exisiting solution doesn't exist" - ok then

You mean something like RFC5575? That actually exists and is in use.

You're saying the solution is to have every website in existence find all these IPs and then request that their ISP block them? That sounds like a lot of work.

Sure it's a good idea to allow requesting the blocks. But changing the reflection sources themselves so they can't be used for reflection anymore is also a good idea.

So now uplinks are going to maintain lists of networks you don’t want traffic from. How do you imagine this is going to work with IPv6? It requires unbounded amounts of memory and processing power.

You're wrong. Swap "spam" for "DDoS" in the following.

https://craphound.com/spamsolutions.txt

Misconfigured servers are the basis of multiple problems not just DDoS attacks.

A new protocol only knocks off one head of the hydra, but does not solve the real problem.

BGP blackholeing is used routinely.

Reply on news.ycombinator.com