menscher · HackerTrans

Infinite loops between servers can lead to performance degradation or network overload. We describe two cross-service UDP loop incidents affecting Google's QUIC implementation several years ago, and share some general conclusions about how to avoid them.

menscher

3 anni fadiscuss

We typically fight our own fires, but if one of us sees something interesting/new we often ask others (after the fire is out) if anyone else saw a similar attack (which could be a new botnet, a new attack method, or whatever). In this case we realized we were all looking at the same thing (which could have huge impact on smaller targets), so collaborated on understanding the problem and coordinated the security response with all webserver vendors.

menscher

3 anni fadiscuss

Get a few companies to agree that open proxies are a scourge that needs to be stopped. They each apply some action to open proxies (user-facing messaging, loss of functionality, captcha, or complete block), and the users of those proxies will get the problem fixed.

The hard part (and it truly is hard!) is convincing a few companies to do this. It risks user complaints in the short term, to solve a problem that may not be very acute for the largest companies (who can simply absorb these attacks).

menscher

3 anni fadiscuss

Most likely Google has more than one computer.

menscher

3 anni fadiscuss

It's mostly not infected computers, but rather poorly configured proxies that are open for anyone to bounce malicious traffic through. Convincing everyone to clean up their open proxies is a long-term, hard problem. But I plan to tackle it soon....

menscher

3 anni fadiscuss

We don't need to share a block-list, but yes, blocking all traffic from open proxies (which nearly all the large attacks of the 2020s have used) is definitely part of the long-term plan. Any legitimate users of those proxies will experience some short-term pain, but they'll patch and life will go on.

menscher

5 anni fadiscuss

Totally different.

The attacks on VOIP vendors mostly used UDP amplification, which relies on having a server that can fake its source IP due to an incompetent (or complicit!) network provider, while this is a botnet (that is only about a week old).

menscher

6 anni fadiscuss

DDoS is sometimes used as a form of censorship -- in this case the attack targeted specific videos.

menscher

6 anni fadiscuss

The trend-lines were really just to guide the eye (the text gives this context), but if you really must know: the R^2 for all three fits was above 0.9, suggesting the exponential growth model is reasonable.

As you say, the pps and bps don't show much curvature, so a linear fit could indeed work for them for the displayed portion of the graph. But it's non-sensical when you look further back in time... predicting negative attack volumes prior to mid-2011. ;)

comments