Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!


Bad week for the internet it seems
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

Bad week for the internet it seems

It could just be me, but this weeks to have been rather bad network wise for the internet. Multiple services (youtube, steam, etc) have gone down 1 or more times this week, and now it seems like multiple different BW providers are having pl/higher pings out of nowhere..

Comments

  • eddynetwebeddynetweb Member
    edited March 2014

    EDIT: fail (double post, heh). And you're right.

  • In the past few days I've seen "attack" traffic from many different IPs to my VPSes, where the source port is always 6000, but destination ports are many. Wondering why.

  • jbilohjbiloh Administrator, Veteran

    The power of NTP based attacks is still a major concern. Thankfully most carriers are modifying their standard policies to allow for techniques to limit their exposure to certain protocols like NTP, etc.

    Thanked by 1TheHackBox
  • @jbiloh said:
    The power of NTP based attacks is still a major concern. Thankfully most carriers are modifying their standard policies to allow for techniques to limit their exposure to certain protocols like NTP, etc.

    Any service that runs on UDP and sends more bytes in response then in the request is able to do an amplification style of attack. What make DNS and NTP special is the fact there are a lot of them out there on the internet they dont apply rate limits and all the setup guides for the lat 10+ years are for insecure setups.

    Thanked by 1Mark_R
  • jbilohjbiloh Administrator, Veteran

    @wojons said:
    Any service that runs on UDP and sends more bytes in response then in the request is able to do an amplification style of attack. What make DNS and NTP special is the fact there are a lot of them out there on the internet they dont apply rate limits and all the setup guides for the lat 10+ years are for insecure setups.

    Yup, bingo. Just about everyone on the internet is guilty of running at least 1 (in most datacenter cases, thousands) of devices that are susceptible to participating in amplification attacks.

  • @jbiloh said:
    Yup, bingo. Just about everyone on the internet is guilty of running at least 1 (in most datacenter cases, thousands) of devices that are susceptible to participating in amplification attacks.

    Until people start doing more monitoring on whats going on they will never notice take the fact of the guys that get leb server run some small web site on it they are not monitoriing if they are sending out dos attack and part of a bot net. if people cared and stuff bot nets would be quickly ineffective.

  • jbilohjbiloh Administrator, Veteran

    The ColoCrossing network automatically detects NTP flows and disables them when they match a malice footprint. Both inbound and outbound.

  • @jbiloh said:
    The ColoCrossing network automatically detects NTP flows and disables them when they match a malice footprint. Both inbound and outbound.

    If there is one thing i have learned about people that wanna mess with you they will find away to get around these sort of things with enough time. Unless colo's invest in teams and i mean teams to play war games every day there will always be a new vector

  • Can't we just agree to show up at the same time in front of Ecatel's doors carrying fork pitches and other tools. This would significantly decrease the rate and volume of attacks on the internet and would make it a better place.

  • MaouniqueMaounique Host Rep, Veteran

    @rds100 said:
    Can't we just agree to show up at the same time in front of Ecatel's doors carrying fork pitches and other tools. This would significantly decrease the rate and volume of attacks on the internet and would make it a better place.

    Bah, they will only move elsewhere. But you are free to block their ranges at BGP :)

  • Ecatel and Root(luxembourg) IP range bandwidth is already rate-limited on some USA ISPs.

  • @rds100 said:
    Can't we just agree to show up at the same time in front of Ecatel's doors carrying fork pitches and other tools. This would significantly decrease the rate and volume of attacks on the internet and would make it a better place.

    Nope, I like democracy & freedom of speech.

    PS: It's called "pitchfork" :D

    Thanked by 1Mark_R
  • @kerouac said: PS: It's called "pitchfork" :D

    True, but "fork pitches" just has a certain...je ne sais quoi to it

  • @user123 said:
    True, but "fork pitches" just has a certain...je ne sais quoi to it

    We call that "aura" in Turkish.

    Also, fork pitch sounds like it has to be the name of this, IDK why:

  • MaouniqueMaounique Host Rep, Veteran

    Here it is called furca. The peasant great army of steven the great, for example, managed to beat the turks 1:10 with mainly axes and those, while the mounted poles (hussars) were taken down with "coasa", by cutting the horse feet. Coasa is the thing the traditional image of the death is carrying, dunno in English.

Sign In or Register to comment.