Hacker News Reader

Comment by jacquesm | Hacker News Reader

I hope they will go after the customers as well, just like they did here in Europe.

IMO most of their customer demographic is the edgy online teenager who wants to mess with someone on the internet, not adults or companies going after any businesses or the like.

Just look at the ADs to these sites that are super flashy and cool to cater to these teens

Edit: Example ADs: https://i.imgur.com/PjqG7dC.gif https://i.imgur.com/ebp4ERm.gif https://i.imgur.com/kTM3fAA.gif

That's ok. I wouldn't necessarily advocate jail time for them but there should be real consequences. Lots of community service or internet usage resrictions would help them learn that people aren't fucking around about this.

Its a known tactic in competitive online games where you can see your opponents IP address to try to "boot them" via DDOS their local IP so they go down or have lessened performance and you win the match. Also harass or shake down kids they think have money. Fortunately the vast majority of people have dynamic IPs, and could likely get a non effected one by just unplugging their router and letting it get a clean IP.

Because of this, a lot of games companies will try to mask the actual IP of the other users now, and Steam has tooling for games they support for devs on their platform.

>that people aren't fucking around about this.

99% of ddos attacks aren't that serious

99% of community service sentences aren't that serious either.

The target of the 'not that serious' DDOS could be a hospital or someone requesting emergency services over voip.

I said 99%.

I remember people used them for DDoSing in high rated WoW Arena matches through IPs leaked through Skype.

Yeah ddosing and gaming have a long history. Over a decade ago these type of services were very popular on other games like Halo, CSGO, & runescape. I was pretty active in the runescape PVP community and around ~2010 onwards tons of people were using these types of services to ddos other players/rival teams & even the game servers themselves. It was especially bad on runescape because ddosing had a financial motive (killing someone for their gear that is worth real money is earlier when they lose connection). At the time hiding your IP wasn't as easy as it is now (Skype was super popular like you pointed out, but so were things like teamspeak & 3rd party forums).

They aren't all kids.

https://www.hackread.com/15-years-prison-for-man-who-hired-a...

Game development is business. The "messing" does real damage with real costs.

Hopefully they will. My whole apartment complex was under ddos attacks for 6 months early during covid. Hundreds of people without a stable connection because someone had a grudge and an account on one of these ddos services.

Hospitals, power infrastructure, nothing is sacred.

I would be very grateful if you could share any info about this.

Our small company's site got DDoSed a month ago and we just let it pass since we're not too convinced that the authorities will take us seriously. We don't even know where to start, just saved the logs with a few hundred random IPs from different countries hoping some day we can do something about it...

We report each DDoS attack our company receives to a special department our police has, your country likely has something similar and I guess it doesn't hurt reaching out to them.

From my experience they will get back to you quickly (usually in <1-2 hour) and they can try helping out if you are still under attack / need some consultation.

Will we ever get compensated for the wasted engineering time to stop these attacks? probably not, but if the police ever finds them and they have extra logs of companies that reported issues, its likely an aggravation of the case.

You're right, I guess I'm still thinking on a few experiences I had way in the past when the Internet was still early and contacting them was a waste of time: they couldn't understand you nor had the time to do so. It's true they now have many more resources and experts in their departments and, as you say, may at least give some good advice on what to do during the panic stage to try and at least mitigate it. Providing them with logs and proof would have been a good idea too.

Oh my, the attack caused so much wasted time and stress that it's still haunting me and the team, specially when thinking that it may not stop there and the attacker/s is just waiting for the next chance to hit us. The days after the attack the first thing I did after waking up was check the servers to see everything was safe. And our roadmap was severely affected too, prioritizing many security features we had in the backlog.

Thank you so much.

Things are significantly better now, I can't comment on how good the aid is if you are under attack since we always had a team ready to handle DDoS, however, their follow-up has always been fast.

Regarding security features, if you are on a cloud such as GCP, AWS or Azure things are complicated since you can't easily route the traffic elsewhere(you can have BGP connections to DDoS mitigation inside GRE/L2TP tunnels only when attacks occur and it would be cheap to rent on a monthly/yearly basis). Voxility is an example that comes to mind and they are very affordable in general terms.

HTTP or HTTPs attacks are easier to handle with Cloudflare, however, there are other interesting solutions such as Stackpath.

We were under a DDoS attack about a month ago too, but were lucky that it didn't manage to affect our business. With that in mind, we took it as a (precious) learning experience - how often do you get the chance to learn about DDoS defence 1st hand?

I realize we were lucky that the attacker didn't find any of the soft spots (or at least none that hurt us). We do prioritize security though, always.

I hope all goes well for you and that in time this is just another learning experience. Maybe next time you'll smile when an attack is thwarted because of what you've all learned.

We get attacked several times a month, we rely on Cloudflare & Corero to mitigate attacks. Cloudflare handles HTTP/s attacks and Corero handles network level attacks.

Both require tweaking and are far from being 1-click setup tools (despite some marketing attempts that try to make it seem that way), however, if you can manage them, they are very powerful and considerably cheaper than other alternatives.

Thank you, I didn't know about Corero, will check them out. CF we use, and as you said, they are a tool. Plenty of ways they could be better, but they are still the best (in moderate price range) we know.

Link from the article: https://krebsonsecurity.com/2019/02/250-webstresser-users-to...

It helps if you have a suspect, typically your local LE will have a cyber division that will know what the next steps are.

Glad to hear there's hefty sentences, many attackers don't realize how much damage they're doing and all the stress and effort that goes into trying to mitigate such attacks.

Thank you!

You're welcome. Good luck with your problems!

You might want to look into using Cloudflare for your infrastructure - the same folks that provided DDoS protection for most of the now-busted Ddos-for-hire sites!

Reply on news.ycombinator.com