Bigger Than Mirai: Leet Botnet Delivers 650 Gbps DDoS Attack (betanews.com) 74
Reader Mark Wilson writes: Earlier in the year, a huge DDoS attack was launched on Krebs on Security. Analysis showed that the attack pelted servers with 620 Gbps, and there were fears that the release of the Mirai source code used to launch the assault would lead to a rise in large-scale DDoS attacks. Welcome Leet Botnet. In the run-up to Christmas, security firm Imperva managed to fend off a 650 Gbps DDoS attack. But this was nothing to do with Mirai; it is a completely new form of malware, but is described as "just as powerful as the most dangerous one to date". The concern for 2017 is that "it's about to get a lot worse". Clearly proud of the work put into the malware, the creator or creators saw fit to sign it. Analysis of the attack showed that the TCP Options header of the SYN packets used spelled out l33t, hence the Leet Botnet name.
Re: (Score:2)
I know this is a troll (and i'll take any downvotes) but one of my fave movie lines...
Ain't had pussy since pussy had you....
Re: (Score:2)
Now that's a term I haven't heard in a long time...
It's almost as if you didn't read to the end of the article summary before posting that...
Internet of shit strikes again! (Score:5, Insightful)
Should rename these from IoT devices to Internet of DDoS devices.
Re: (Score:1)
The name in the subject was better. IoS Internet of Shit devices.
Re: (Score:3)
The internet is really trashing its own reputation with this guff. I'm pretty interested in an internet camera system for my house (Live inner city, it gets pretty crazy in my hood) BUT If its just going to make me a sitting duck for s'kiddies building ddos nets, well no, I think i'll hold off.
Re: (Score:2)
Internet of Never updated, Easily Pwn3d Things,
I.N.E.P.T?
Re: (Score:2)
Internet of Never updated, Easily Pwn3d Things,
I.N.E.P.T?
this should be your signature
Re: (Score:1)
When manufacturers learn not to cut corners on the security or upgrade options of these IoT devices, a.k.a. never.
Re: (Score:2)
Manufacturers won't learn anything until it hits them in the pocketbook. And since the IoT devices are a dime a dozen, made by thousands of different fly by night operations in China, that is highly unlikely. Cutting corners is how they make a $24.99 device that does something that eliminates you walking across the room to do.
Re: (Score:2)
Both attack bursts originated from spoofed IPs, making it impossible to trace the botnet's actual geo-location or learn anything about the nature of the attacking devices.
No way to cut the problem at the root? (Score:2)
Re: (Score:3)
I know I might be being naive, but there is no way to solve the problem at the root, such as cutting the connection of devices that begin to generate disproportionately traffic aimed at a single site (the target)?
Each source is just a small part of the whole generating traffic the looks "normal" for the most part. So a bit harder to automatically filter. But... Logs and tracking back, and using the existing RIAA procedures to warn and then disconnect those sources would be a good start.
Re: (Score:1)
Exactly. Especially when these IoT bothets are in the hundreds of thousands of devices. The amount of traffic per device is less than what is used simply streaming from Netflix.
Re: (Score:3, Insightful)
Re: (Score:1)
Re: (Score:3)
If there is a known C&C that it communicates with or other things that will give away the device then yes some ISPs will call you up, warn you, and then suspend your account until you get the device removed or are able to clean it.
Re: (Score:1)
Well, asking an expert for an answer, and then dismissing that answer because it doesn't suit you makes you more of an asshole (IMHO). The original poster is entirely correct. I liken it to how to eat an elephant. You see an elephant, and figure you can eat a pound or two a day and it takes a couple years. I look at the Elephant and send my herd of trained ants to eat it, and it is gone in a couple days. It is a perspective that most people (like yourself) have no clue about. You see an ant, and think "it c
Re: (Score:2)
As for your answer, I will introduce what I am thinking using your own example: I want to prevent the elephant from being devoured by the ants, what can I do? The most obvious is to take the elephant off the place, works 100%. But I need the ele
Re: (Score:1)
The problem isn't the ants (IoT). The ants provide valuable services to the nature of the Savannah. The problem isn't the elephant (Internet domain). The problem is that there are people telling the ants to attack that elephant over there ---->
You want to solve that "people" problem ... and good luck. The internet has made that person more or less anonymous. And unless you're suggesting tracking every person every day on everything they do on the internet, it isn't easily solvable.
In the days of old, wh
Re: (Score:2)
If we had a global registry of DDoS targets that we added new addresses to when the bandwidth of an attack broached limit X from number of sources Y (100gbps / 1million bots?), then we could require ISPs to run automated scripts that Null Route those addresses in the database for time period Z (1 day?) The Botnet gets rejected at the edge in those cases, but the end result is the same for the target, they have to move or wait. If you can get the move done fast enough (up on new IP addresses in an automate
Re: (Score:1)
So, after thinking about this a little more, there is nothing preventing the Botnet operators from doing a DNS lookup and simply targeting the new IP address. However, that would let us weed out legitimate traffic from botnet traffic over enough iterations. ISPs could have a three strikes rule for clients. 1st time you attempt to contact an IP address on the DDoS target list, strike one, most "strike one traffic" is probably legit, people pressing F5 trying to reload the site, etc. Strike two, and you s
Re: (Score:1)
The whole point of a ddos attack is that each bot is only sending small amounts of traffic such as to not alert the user or their ISP.
Re: (Score:2)
Re: (Score:1)
Now we know what is in the header, couldn't the ISP reject these packets?
Re: (Score:2)
Nobody in this attack generates "disproportional traffic". That is the idea of DDoS.
Re: (Score:3)
Don't really know the answer; consumer routers aren't up to the task, and configuring a more advanced router/firewall isn't easy, and the end devices themselves have terrible security. You could proxy some of the data that is sent by the equipment and track anomalies... but that becomes a lot of work.
Re: (Score:2)
I just bought a small box with two Ethernet ports for under $150US that I plan to run something like pfSsense or similar on. I'll supplement an HDD and RAM scavenged from a retired laptop to complete the H/W package. The initial rationale was to block DNS requets to any but my preferred provider to defeat the DNS hijacking attacks. Perhaps there would be a way to detect unusual traffic patterns and block them to thwart other sorts of attacks. Better yet, I could restrict outbound connections from my devices
Re: (Score:2)
(I was just thinking about Breaking Bad this morning...)
Re: (Score:2)
I would say you might be better off with a $50 Ubiquiti EdgeRouter X; cheaper and easier.
Definitely cheaper and easier. My Asus AC-RT68 is also cheaper and easier.
I'm pretty confident that that pfSense has a broader feature set and is likely more secure than the Asus. I wonder where the EdgeRouter X fits on that spectrum?
Not that hard in principle to fix this (Score:2)
Yes, there are quite a few details to work through to reduce the risk of this being spoofed, and dealing with legacy devices, but in principle this
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Yes, the "DDoS" was people flooding their store to buy things. Valve still seems to not have learned any lessons from past winter sales.
DDOS has had its 15 minutes (Score:4, Insightful)
These DDOS attacks are mildly interesting but irrelevant in the grander scheme of things. Given the nature of the attack payloads, it probably would have been effective at less than 100 Gbps so why hype the new high watermark? AFAIK, DDOS isn't a huge money maker so this isn't a threat in the same league as ransomware.
Quit trying to promote vandalism as news and maybe, just maybe it will become less interesting a thing to do.
Re: (Score:1)
"These DDOS attacks are mildly interesting but irrelevant in the grander scheme of things"
Hitler's conquering of Poland was irrelevant in the grander scheme of things, until it wasn't.
Re: (Score:1)
For the record, Brian Krebs, a security research blog/reporter who publicizes cyber criminals like the ones involved, who run DDOS farms to attack any victim for a fee paid in bitcoin on the darknet. Read more kids. There are millions of victims. Maybe nobody you know, but that's because you don't pay attention more than not.
Re: (Score:3)
This is just a test really, and it'll be irrelevant until it's not. Egg on their face and what not.
When they can ramp this up to hit something important that's not air gapped, I wonder if you'll still be on the high horse saying it's 'vandalism'.
DDoS doesn't exist to generate money, it's used to create chaos.
Re: (Score:3)
Ok, everybody who was effected by this raise your hands! Anybody?
Me. I'm affected. I'm affected by the display of a possibility. I'm affected by the fact that this amount of bandwidth is available to someone to knock essentially any target offline. Today it's Krebs, tomorrow it's my bank.
Just because my internet wasn't slow doesn't mean that it's a very real problem that needs to be looked in and addressed, just like a bunch of vandals tagging a subway station is good and fun until the tag the windscreen of my car.
Re: (Score:1)
It is a money maker, Companies who suffer from the DDoS lose revenue, their competitors make a ton during that period
Re: (Score:2)
Short memory eh? A DDoS attack took down multiple services around oct ( https://www.wired.com/2016/10/... [wired.com] ). That one personally affected me as one of our dns providers went down, causing customers headaches for a day or two.
So yes, ddos attacks do *affect* people, in the real world, right now. And they are scary and newsworthy when they occur.
The end result should be that companies are law bound and forced to support IoT devices f
Re: (Score:1)
Ok, everybody who was effected by this raise your hands! Anybody?
It's certainly possible that with traffic to some sites disrupted, some people turned to other ... entertainments, and in the process effected someone. But I'm afraid you'll have to wait ~9 months for any of the latter group to raise their hands.
This botnet uses SYN-ACK: This helps kill it (Score:2, Interesting)
See subject: SYN Attack Protection
---
The named value to enable SYN attack protection is located beneath the registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters.
Value name: SynAttackProtect
Recommended value: 2
Valid values: 0 1 2
Description: Causes TCP to adjust retransmission of SYN-ACKS. When you configure this value the connection responses timeout more quickly in the event of a SYN attack. A SYN attack is triggered when the values of TcpMaxHalfOpen or TcpMaxHalfOpenRetried a
Not a huge number (Score:3)
10g transit ports are about the smallest practical to buy, 40 and 100 are a lot more common. This is a big attack as attacks go but not really pushing a well-built network.
Re: (Score:3, Interesting)
> This is a big attack as attacks go but not really pushing a well-built network.
This attack is 5% _larger_ than the one that was directed at Krebs's site. Krebs was forced offline because the provider that was keeping his site up could no longer do so pro-bono, and there was no way in hell he could pay market rate for those services: https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/
Also, the attack against Krebs's site was -prior to this most recent one- the largest reported DDoS, e
Re: (Score:2)
This is a big attack as attacks go but not really pushing a well-built network.
This is a larger attack that previously caused a company which defends against these kinds of attacks to cut ties with the customer under attack.
It's also a significantly larger attack than many smaller attacks which have had actual economic damage as not everyone builds your "well-built" network because surprise surprise when you provision a network you design it for maximum load under conditions based on your users, not on the entire weight of an IoT botnet raining hell on you.
Brushing this off is a big m
Re: (Score:2)
No, those networks are just not large enough to realistically defend against a DDOS lots of places sell the service few can really back that up.
Solution: change the default password on your IoT (Score:2)