DNSMadeEasy under major (over 50Gbps) DDoS Attack out of China

by KrisJordan • 16 years ago

110 48 16 years ago

makmanalp2• 16 years ago

I'm interning at a major managed DNS provider and this actually happens more often than you think. Most of the time it ends by working with telcos like level3, cogent etc, blackholing routes, sacrificing a certain geographical location in favor of keeping others alive and basically just waiting it out. It's interesting how because of the nature of the internet, DDoSes are hard to deal with.

drivingmenuts• 16 years ago

Too bad we can't just permanently sacrifice China.

dnsworks5• 16 years ago

There's an anti-DDOS service out there, Progent or something. Part of their solution adds all of APNIC's ip addresses into your router's bogon list when you're under attack. It turns out for most DDOS's if you turn off china, the attack just ends.

vkdelta• 16 years ago

If we want, we can :)

mrtron2• 16 years ago

It is easy to say that now - would you have said that about US cable modem accounts 10 years ago?

tptacek2• 16 years ago

From 2001-2003 I led development on Arbor Peakflow DoS, which (when I left, at least) was far and away the most popular tool tier-1 ISPs used to manage these kinds of attacks, and my the experience I can relate is:

* These attacks happen with shocking frequency (the major incentive ISPs have to mitigate them is not angry customers, but rather the drag it creates on their third-tier engineering staff to hunt down DDoS sources and craft ACLs for them)

* There is actually not a whole hell of a lot you can do about them, even if you light up a whole tier 1 core network with mitigation tools. At the end of the day, a well-crafted DDoS attack looks pretty much identical to normal traffic; if you can black-hole China to defeat an attack, it wasn't very cluefully done.

makmanalp2• 16 years ago

Regarding your statement that it wasn't very cluefully done, isn't that sort of a hit and miss area? You can't really control much where your malware spreads (and thus where your bots are).

As a sidenote, I've been reading your posts for a while now and it seems you always have something insightful to say - cheers!

leftnode• 16 years ago

No wonder most of my sites were down or not functioning very well this morning. Hope they get everything operational soon, DNSMadeEasy is a great provider.

cliffchang• 16 years ago

Can anyone give an idea of how large, compared to other DDOS attacks, 50 GBPS is?

dnsworks5• 16 years ago

50gbps is pretty massive. Clearly somebody did something horrifically insulting to China like mention that they could maybe possible consider treating Tibet a little bit more humanely and stop turning it into one big whorehouse.. make a statement like that, and all of china ddos's you.

dogas• 16 years ago

Sarcasm aside, is that really what motivates people in china to regularly pull off attacks like this?

lsc• 16 years ago

it's fairly large. There are really two factors in a DoS, though, total throughput and packet size. Obviously, your incoming pipe can only handle a certain total throughput, I mean, that's what most of us get billed on.

However, most routers and firewalls also have a limit on packets per second they can process, on top of the throughput limits. I've got a 100Mbps commit on a 1000mbps pipe, and I can handle 1000Mbps of 'normal' traffic... but I got taken out a month back by a 200Mbps DDos that used very small packets. My router couldn't handle it. (now, if I had spent money on a better router, it wouldn't be a problem. As far as I can tell, even, a reasonable software router could have handled it.)

Another way to measure this is the capacity required to absorb the attack. You can get he.net bandwidth for around a thousand dollars a month per gigabit, and he.net is about as cheap as bandwidth gets, so to soak a 50 gigabit attack, you'd have to have fifty thousand dollars a month of spare capacity.

(I'm sure there are further discounts available between the 1GiB and the 50GiB tier... but you get the idea. )

ttimrawi2• 16 years ago

Considering the fact I've seen this attack first hand. I can tell you a couple of things about it's strength. It's very flexible one minute they are sending packet size 1500 bytes udp, the other they are sending 48 bytes syn tcp 80. However, filtering them with a Firewall is not hard at all since they do have packet patterns you can detect, but even if you can find a firewall and have it on the edge of your network traffic is STILL reaching your network and if you can handle 50Gbps of traffic all coming from a couple of different ASn than "wow".

jacquesm8• 16 years ago

It's serious but not the end of the world. Of course if your uplink is smaller than that it might be a real problem. Then you'll have to talk to your upstream provider to do the filtering job for you.

davidu2• 16 years ago

No, sorry.

50gbps would rank as one of the largest attacks I've ever heard of on the Internet. And I hear about quite a few of the really big ones. :-)

wehriam• 16 years ago

What motivates an attack like this?

Steve0• 16 years ago

Probably some motive against one of the customers. If you can extort some cash out of a gambling site with short dns-ttl it could be worth your effort.

Maybe the target's data center is more ddos-proof than the one from easydns, extortionists go for the weakest link.

mrtron2• 16 years ago

Back in the olden days of IRC, there was times when entire regions of the internet were taken offline resulting from a ddos for personal vendettas. For exactly that reason too - they attack the weakest link and often it isn't the host directly.

In this case - it really could be anything. The cost of one of these attacks is next to zero. Rarely will the botnet owner lose any machines resulting from an attack. The unfortunate thing after one of these attacks is you have no way of preventing it or going after the source.

quizbiz• 16 years ago

Can someone please explain to me what DNSMadeEasy actually does?

Is a domain provider like 1and1 a client of theirs or is my hosting provider a client?

This entry on Hacker News led me to wikipedia where I went from an article about Level3 to an article about Tier 1 Network to Internet Backbone. I feel like I'm on the verge of understanding more about how the internet works but it's all a bit above my head.

geocar• 16 years ago

They're an anycast dns provider- basically the only kind of third-party DNS service that's worth anything at all. They have some neat domains-related tools that hook into their infrastructure that's kindof a pain to do yourself (even if you've got your own anycast-capable network)

FooBarWidget• 16 years ago

I'm wondering what the implications of DDOS are for website owners. What if you're on EC2 for example, will you be charged for the 300 TB of traffic? If so that would be an easy way to bankrupt a startup.

dennisgorelik• 16 years ago

The implications for website owners are that their web sites were temporary unavailable. Traffic simply does not reach the web site. Even normal traffic. For example, you type in your browser www.mywebsite.com. DNSMadeEasy would normally resolve it to your IP address (e.g. 111.222.123.12). But because of the DDoS attach -- mywebsite.com cannot be resolved into any IP address and you cannot open www.mywebsite.com at all.

dan_manges• 16 years ago

That's the implication is there is a DDoS attack on your DNS provider, but I think FooBarWidget was inquiring about the implications of a DDoS attack on your website, and specifically if you would be charged for the bandwidth consumed by the attack.

peterwwillis2• 16 years ago

get akamized. you can also build traffic limits into your web stack or OS or network gear if you're afraid of traffic ramps hurting your wallet. like tptacek said, a good DDOS looks like normal traffic, so this could happen if you got slashdotted by 10 different news sites.

nhnifong• 16 years ago

My policy for this is to simply lock the doors and hide for an hour if my network traffic averages over 2 Mbps for 5 minutes. I would also send myself an email. So far this has never happened.

ximeng• 16 years ago

(Brief) discussion on webhostingtalk:

http://www.webhostingtalk.com/showthread.php?t=970837&hi...

Another 30 gbps attack, discussion on webhostingtalk.com:

http://www.webhostingtalk.com/showthread.php?t=966658&hi...

Edit: interesting thread, apparently the reason it's 30gbps is that it's maxing out the link from China telecom, so legitimate Chinese customers are getting traffic dropped. FBI are involved. Suggested solution by some is to get traffic routed over more intercontinental links possibly via peering agreement with China Telecom, and beyond that political pressure.

petercooper2• 16 years ago

I wonder if, long term, DDOS attacks will be to net neutrality as spam was to nice-and-easy e-mail setups. Now ISPs are running spam blacklists, blocking entire other ISPs at times, and it's a nightmare to run your own SMTP server and deliver mail reliably without jumping through hoops. If DDOS attacks become more and more annoying, they could be used as an excuse to violate net neutrality.

SoftwareMaven• 16 years ago

I'm not clear on how that would work. A good DDoS attack is nearly indistinguishable from normal traffic. How would net neutrality play into it?

petercooper2• 16 years ago

Really good spam e-mail is nearly indistinguishable from normal e-mail. Crazy layers of whitelisting/blacklisting/new DNS settings/laws/software and policies have been piled on top of the mail system to reduce the nefarious effects of spam sent en masse.

While spam and DDOS attacks aren't directly comparable in terms of what they are, I'm speculating in terms of what negative effects continued and escalating DDOS attacks could have again in terms of laws, policies, white/blacklisting of entire networks/countries, and so forth.

est• 16 years ago

The GFW of China has a known vulnerability to amplify a UDP traffic to 2x to 3x as much.

meric• 16 years ago

I wonder if they're going to change the text on their website: "A DNS service with a 99.9999% uptime history is just the start! DNS Made Easy is so confident of it's uptime record that we offer the best service level agreement in the industry. That is why all businesses that require stable DNS decide to use DNS Made Easy. We have an industry leading 100% uptime gaurantee and will credit all accounts 500% of the downtime."

Maybe its a rival DNS provider behind the attack?

DNSMadeEasy under major (over 50Gbps) DDoS Attack out of China

Related Stories