Hacker News Reader

Comment by ggreer | Hacker News Reader

The PRC's DDoS of GitHub seems a little risky.[1] If GitHub is inventive (or desperate) enough, they could call on their users for aid. The perpetrators would immediately draw the ire of vast numbers of talented programmers. And GitHub is positioned to direct this ire toward useful ends. They could encourage users to contribute to GreatFire, or even start other initiatives and projects to stymie censorship. The outcome could easily be worse for the PRC than if the attack had never happened.

1. Even if this isn't a PRC-ordered or sponsored attack, large parts of their infrastructure are being co-opted. If they aren't criminally involved, they're criminally irresponsible.

View on HN

Looks to me like it's time for a DDoS X-Prize.

1. SSDP Flood 21%

2. SYN Flood 19%

3. UDP Flood 13%

4. UDP Fragment 12%

5. NTP Flood 8%

6. GET Flood 7%

7. CharGEN Attack 5%

8. DNS Flood 5%

9. ICMP Flood 2%

10. SNMP Flood 2%

Eliminating these 10 attack vectors would account for 94% of DDoS attacks according to this visualization[1], as witnessed by Akamai over the last 30 days. Just the top 3 is more than 50%. Seems like a reasonable start on a way to measure success.

Who'd like to sponsor? Or should I just spin up a GitHub repo for the code and a kickstarter for the prize money?

[1] http://www.stateoftheinternet.com/trends-visualizations-secu...

SYN Flood is already mitigated a long time ago with SYN cookies. The rest ..... well, it's basically just packets.

I see this latest development as good news. The Javascript MITM trick was very clever because forcing github to render and serve a page is a lot more resource consuming than just firing packets at servers that ignore them (like a UDP or SYN flood). The latter can saturate network links until the sources are blocked, but those sources tend to be somewhat focused and don't shift much. An HTTP level attack driven by random web users means every request might have a different IP and it requires running way more of the app stack to be able to filter them out. If China is now resorted to SYN flooding then it means they ran out of better techniques.

> well, it's basically just packets

Is "DNS flood" a DNS reflection attack though?

Usually no.

There are generally two types of floods against DNS infrastructure:

- Flood of "valid" requests, to a large number of open DNS recursors. To avoid caching they usually contain random prefix. Flood against large number of open DNS recursors basically causes the recursors to not work, and many authoritative servers to be overwhelmed.

- Flood directly against authoritative servers, to fill the network or use up all the CPU.

Traditional reflections aren't that popular any more.

synflooding is not mitigated by syncookies. the attacker can encode information inside the packets in exactly the same way as the server, meaning they don't have to maintain any state, see: http://insecure.org/stf/tcpdos/outpost24-sect-sockstress.ppt (slide 18 onwards)

That's not a syn flood though. A syn flood is purely syns. So there is no need for the attacker to encode information if they are just doing a syn flood.

Most of these attack vectors just mean a great amount of a specific traffic of some sort. Traffic volume is not something that you can, or would want to, eliminate.

You have to somehow identify and separate the unwanted requests from you regular traffic. That's why these cases are unique and needs to be handled manually, in cooperation with your uplink(s).

To be clear these are attack vector prevalence relative to each other, and represent 'known' attack traffic identified by Akamai, not general traffic in these protocols.

However, this is no doubt not a complete list of DDoS vectors as it doesn't account for application level exploits like demonstrated in the GitHub attacks. And obviously not everything that is a DDoS is a protocol flood.

Either there is a way to identify those types of attacks now, or improved attack identification should be included as a requirement for the X-Prize.

You aren't going to make ddos attacks go away by offering prizes for a miracle software solution. It amazes me that there are so many programmers here who don't understand this basic principal. I think the only way we can get people to understand the situation is with an analogy.

Let's say your pipe can receive 1 Liter per second of water. There are some impurities that you can filter through your faucet, this is analogous to the software firewall. However what happens when someone starts piping 99 L/s of sludge through the other end? No matter how sophisticated the filter you have on your faucet, the water you will get out of it is going to slow to a trickle.

Now I can already hear you asking, why does the Internet allow people to send whatever sludge they want? And the answer is because that's the way the internet is made. There has been a push to stop spoofing called BCP38, but this requires EVERYONE to do extra work and spend extra money which is why relatively little progress has been made since it was released 15 years ago, and is likely to never succeed.

If it was as easy as creating a piece of software to deal with, large businesses like Prolexic wouldn't be banking their future on a problem that would be so easily solved.

I think there are plenty of people, myself included, who understand how DDoS attacks work.

Do you know how X-Prizes work?

Hit: Did I say anything about software?

[edit: It's odd to me that this would get down voted. Is it offensive? Or are downvoters really that opposed to thinking outside of the box?

The X-Prize encourages participation from unexpected directions, precisely where innovation is often found. As the parent post demonstrates (almost as if on queue), it's quite common for skilled experts within a field to become overly focused on specific classes of solution. I was careful not to say anything about how the above goals might be achieved.]

>Did I say anything about software?

Well, you did say:

"Who'd like to sponsor? Or should I just spin up a GitHub repo for the code and a kickstarter for the prize money?"

Indeed I did, still no software implication. I was being fairly deliberate about that.

What I'm confused about is what the argument is.

Is it we shouldn't try to find a solution?

I'm sorry if I was unclear that I did not intend to limit the scope of solutions to software, but frankly so what even if I had?

In any case the X-Prize proposal seems quite popular so I'd be happy to set it up, help someone else set it up or in general do anything I can to encourage innovative solutions of any kind, but..

...never tell me the odds.

Please stop defending yourself , accept what other know what they talking please.

You cannot setup a github repo for that.

I didn't downvote you but I can see why they did. The way you act is similar to someone running a contest to disprove Turing's proof on the halting problem.

If your bandwidth is being filled from the other end, it doesn't matter how sophisticated the filter is at your server. Even if it is theoretically perfect and able to tell which packets came from real requests with 100% accuracy, it will not solve the problem. This limitation also applies to hardware firewalls.

Many smart people have already tried to solve the DDoS problem and they all came to the same conclusion. Either everyone does BCP38, which is never going to happen, or you buy more bandwidth than your attacker can throw at you.

To suggest that all we have to do to solve this is dangle chump change for some random coder to solve it is rather silly especially when companies like Cloudflare and Prolexic have bet their entire futures on DDoS not being fixed any time soon.

As someone who deals with DDoS attacks every month it is rather obvious that you don't have a very good idea of how ddos attacks work when everything in the list you copied off a random website except for SYN could be classified as attacks that overflow your bandwidth. UDP fragments and Chargen are also bandwidth attacks.

I understand your position, and I don't want to be offensive. I simply want to be clear.

The X-Prize is intended precisely for this type of industry stagnation, and has been very successful at that goal so far. Winners solve unbelievable problems in unbelievable ways.

I am, if not an expert, nearly so, and I can say that my first thought is not better filtration. As you rightly point out that is a very hard problem, technically impossible too if you limit the framing of the problem to only information available to the server and consider each event in isolation.

I am a little surprised that you as a self professed expert keep harping on the futility of better serverside filtration when your very argument is that it isn't a good approach. Why are you assuming that others would choose a poor approach when you would not?

For example my first thoughts go to ideas like: a home firewall auto configuration / lockdown tool and associated marketing campaign; inexpensive home network security hardware; better anti bot software; a police botnet; browser and os patch sets; political campaigns to change regulatory requirements; graphic design, video and other media to improve understanding and provide easy to implement solutions, economic/business models that naturally incentivise users and/or device vendor to prefer better security features on devices. In the end perhaps it would be none of these things are perhaps it would be some particularly spectacular bit of server filter coding.

The point of prize systems like the X-Prize is to efficiently solve hard problems. It is not to solve it in any particular way. Is there no better algorithm to recommend movies? No there isn't, until you consider human factors (The Netflix Prize). Is human space travel truly only the domain of nation states? Yes it is, until the Ansari X-Prize.

Before these prizes were won, their solutions were impossible, afterwards they are simply solved problems.

P.S. In addition to your mistaken impression of my inexperience in the filed you are also mistaken that the information I posted is "off a random website". The information is from Akamai's State of the Internet site and represents Akamai's "real-time 24-hour global attack data: sources, targets, and types of attacks". It is linked to directly from Prolexic's home page. Though, I'm sure as an expert you knew that.

> The X-Prize is intended precisely for this type of industry stagnation

No. Take a look Ansari X-Prize, the first of this kind.

The theoretic foundations for spaceflight were laid out about a century ago, the first flight took place in 1961. So this is something which is very well understood. The prize was, basically, for tweaking the components to make it cheaper.

But you're asking somebody to invent a new method, without providing a theoretical foundation for it to work in.

So this would be like asking to invent a teleporter or faster-than-light travel.

Besides that, other x-prizes were formulated as a contained experiments. E.g. demonstrate that your spacecraft can fly, or provide a program which offers better recommendations.

But what you describe is not an experiment. You actually want participants to go an change how the Internet works. This isn't contained.

So you're being downvoted for being extremely naive. You seem to believe that a kickstarter campaign and a github repo can solve any problem.

Everything you've suggested requires all networks to cooperate/spend extra time and money, or that no one makes an exploitable protocol in the future (as likely as humans never making mistakes). If you can already get all networks to cooperate/spend extra time and money, then you can make them do BCP38 which would be a more complete solution.

> In addition to your mistaken impression of my inexperience in the filed you are also mistaken that the information I posted is "off a random website". The information is from Akamai's State of the Internet site and represents Akamai's "real-time 24-hour global attack data: sources, targets, and types of attacks". It is linked to directly from Prolexic's home page. Though, I'm sure as an expert you knew that.

And all of this doesn't disprove anything I said.

That website is a marketing piece made for laymen such as yourself.

The fact that you are categorizing those attack vectors as seperate problems instead of being in the same class proves what I claim.

> they could call on their users for aid

You gotta be kidding. Calling on their paying customers to commit a crime on their behalf? Really?

When did writing ddos protection tools become a crime? Was that shortly after it became illegal to try to stop someone from stabbing you?

Maybe I misinterpreted the "or desperate enough," I don't know, but quite a lot of people in this thread seem very trigger happy.

// Fun fact: Depending on what jurisdiction you're under and how the tool is implemented writing a DDoS protection tool might actually be considered a crime.

Yeah you did misinterpret his comment. Also, you can be "desperate" for help so I don't understand what you meant.

What jurisdiction or tool-implementation would consider DDoS prevention a crime? We're talking about mitigating a flood of traffic here.

> Yeah you did misinterpret his comment.

Don't rub it in. I had a long night.

> What jurisdiction or tool-implementation would consider DDoS prevention a crime?

That depends on how the tool is implemented. Nobody cares what you use it for; what it does and what that (potentially) enables you to do is usually the deciding factor. I can't give you a concrete example because I'm not a judge and these kind of laws are way too vague anyway. We're obviously not talking about "traditional" methods here (hence the fun fact). Note that the problem is not you using a tool, it's you distributing a tool that can be used for ... well ... I don't know.

Reply on news.ycombinator.com