Quite impressive. You know your blog is good when folks will try to take down a CDN to supress what's on it. He's also had heroin mailed to him in combination with a swatting attempt before: <a href="http://webcache.googleusercontent.com/search?q=cache:gEjqPfcbtlgJ:krebsonsecurity.com/2015/10/hacker-who-sent-me-heroin-faces-charges-in-u-s/&num=1&hl=en&gl=us&strip=1&vwsrc=0" rel="nofollow">http://webcache.googleusercontent.com/search?q=cache:gEjqPfc...</a>
Still not a good move for Akamai, though.<p>I get him speaking out for them about the hosting having been free, but Akamai is now the CDN that got bullied into kicking someone of their service against their own will.<p>Terrible PR, and that mud will stick in tech circles. Akamai folds under pressure.<p>I know it's a crude comparison, but we don't negotiate with terrorists for a reason.
Isn't this the point at which Cloudflare is supposed to gain a handful of PR points for putting him back online, pro bono, and then doing a write up on how effortlessly they handled the bandwidth with eBPF?
Here's a "philosophical" question with regards to the internet, and perhaps even it's future. Given that a currently anonymous attacker, and likely not a "state" player (i.e. not a governmental entity with almost unlimited resources) has managed to DDoS a single website, does this portend that unless there are significant changes to the way the internet infrastructure works, we are seeing the demise of the WWW?<p>Kind of like a reverse wild-wild-west evolution, where the previously carefully cultivated academic and company site presence, gradually degenerates into misclick-hell? And the non-technical, non-IT savvy masses, in a bid to escape this all, end up in a facebook-style future where media is curated and presented for consumption (or perhaps in future, facebook-type entities end up with their own wild-wild-west hell)?<p>I have a strange feeling that we are seeing the decline of a city/civilisation; once you used to feel safe walking out at night, knew everybody in the neighbourhood, could leave your doors unlocked... and now, you don't dare to go down the lane to the left in case you pick up a nasty virus, and if you hear a knock on the door at night/email from DHL, you don't dare to even look through the peephole/preview the JPG!
I would like to see stats from Tier1/Tier2/IX for that.
Krebs claims it's 665Gbit/s <a href="https://twitter.com/briankrebs/status/778404352285405188" rel="nofollow">https://twitter.com/briankrebs/status/778404352285405188</a>
Such attack must be visible in many places, however not a single major ISP reported that in mailing list. Previous smaller attacks were reported 'slowing down' some regional ISPs. Perhaps ISPs got better.
This recent talk about DDoS attacks is worth a watch if you're curious about why it's a hard problem to solve: <a href="https://www.youtube.com/watch?v=79u7bURE6Ss" rel="nofollow">https://www.youtube.com/watch?v=79u7bURE6Ss</a>
This is bad PR for Akamai and a tactical error for them to boot Krebs even if they were providing free service.<p>To some, the implication would will be "they couldn't handle it" so why should I trust the DDOS they are heavily promoting on their site?<p>At minimum they should comment on the situation, at best restore his service and learn how deal with high profile clients.
The first thing a lot of people are thinking (and saying) is "switch to Cloudflare". But there's another name I think needs to be said - OVH. OVH can withstand a Tbps scale attack as far as I know, and it provides this to pretty much anyone. They have a pretty good interface and some of their plans are extremely cheap. They're also great at standing up for free speech, which I really appreciate.
> “I likely cost them a ton of money today.”<p>But more specifically, whoever launched the attack cost them that money.<p>Also, ha:<p>PING krebsonsecurity.com (127.0.0.1): 56 data bytes
It would be interesting to try out some of these new p2p website technologies like IPFS/WebTorrent with these high profile sites who are frequently attacked.
I tried to get to an article on Krebs' site from a Bruce Schneier blog post, and couldn't, then bumped into this post in HN.<p>It's a pity Akamai booted him off; on the one hand, I can understand that it would significantly impact on their SLAs to other customers, but on the other hand it's a shame they don't have a lower impact network to re-host him on, and use this as a learning lesson on how to better mitigate such DDoSs...
<a href="https://twitter.com/briankrebs/status/779111614226239488" rel="nofollow">https://twitter.com/briankrebs/status/779111614226239488</a><p>"Before everyone beats up on Akamai/Prolexic too much, they were providing me service pro bono. So, as I said, I don't fault them at all."
I'd love to learn more about these botnets. I wonder about things like What's the average time that a compromised computer stays in this net. What is the typical computer (grandmas old PC running XP). Do the ISPs ever get involved to kill bots running on their networks?
Wow, I figured that everyone that had hired vDOS would be irritated but that is pretty impressive. Still it says a lot for how effective he has been at rooting out this stuff, not like the TierN infrastructure folks have managed to track this stuff down with their resources.
Isn't this whole thing a bit silly? I mean what's the point? They just spend time on making him the best marketing, he'll double his audience/readers, no?
These 'attackers' give Krebs' more publicity than he would ever be able to generate himself.<p>It's also useful to point out that Krebs' hasn't been the only target as half a dozen other large targets were attacked
<a href="http://www.webhostingtalk.com/showthread.php?t=1599694" rel="nofollow">http://www.webhostingtalk.com/showthread.php?t=1599694</a>
Something about the platform-centric world we're in now is that this sort of attack doesn't have the blocking power it once did: you can mirror your content on Twitter, FB, G+, etc. and cross-link so people can still read your stuff. This makes the "denial" part pretty watered down; it's a wonder people even bother with these sorts of attacks anymore for non-services (i.e., for regular media material like text, photos, etc.)<p>Of course, maybe the goal is to deny someone ad revenue, but that seems awfully low-status for such a high-profile attack: "Yeah, we really got 'em! Denied 'em AD REVENUE for a whole week!"
The ddos attacks seem to be getting larger these days.<p>I've recently seen a ~200 Gbit/s hit us.<p>Does anyone have good resources around mitigation? I was looking at the BGP flowspec but was hopefully that someone might have come across other tactics?
If you're curious what the source of the DDOS attacks are from, here is a recent one that hit OVH:<p>> This botnet with 145607 cameras/dvr (1-30Mbps per IP) is able to send >1.5Tbps DDoS. Type: tcp/ack, tcp/ack+psh, tcp/syn.<p><a href="https://twitter.com/olesovhcom/status/779297257199964160" rel="nofollow">https://twitter.com/olesovhcom/status/779297257199964160</a><p>This is much higher than the Akamai attack on Krebs too. Welcome to the wonderful side-effects of the totally insecure firmware of IoT...
Here's a link to the last post from his website. Google did not appear to have this cached:<p><a href="https://archive.fo/t94ve" rel="nofollow">https://archive.fo/t94ve</a>
I understand that this is burning bandwidth for Akamai, but seriously, taking into account what is at stake here, I think they need to do their share and continue to support Brian.
Brian Krebs is a hero. Are Akamai executives cowards for dumping him? I'd like to add that law enforcement are heroes.<p>And it's honorable he wants to meet Fly in person, recognizing him as a human being. I haven't read it yet but I'm assuming the reference to 12-step hints that Fly's having some post alcohol binge regrets.<p>I'm sure alcohol makes it easier to hurt other human beings, which is why violent people are often drunk. I'd be ashamed of myself if I woke up realizing that I'd spent my life actively trying to harm other human beings for money, feeling no remorse until Karma (here defined as law enforcement officials) finally caught up with me.
I'm wondering if the rising scale of these attacks & the seeming ease with which sites can be taken down will ultimately result in an "authenticated" internet - ie. you can't even connect without identity verification.<p>We already see publishing through FB Instant Articles etc. moving in that land on top of the current internet, to combat these types of firehose attacks, the only solution may be to take authentication one level deeper into the connection level.<p>That of course sounds good to security agencies as that's the end of anonymity online.
It's funny how my mom after reading "record cyberattack" would be wondering how many poor people died but what it means is that somebody was downloading images from website many times.
There are a number of factors that go into play (did the site use custom SSL, what edge locations were they providing caching in, etc), but had Kreb been a normal paying customer, this could easily have been a over a million dollar bill (if it was sustained long enough to alter his 95th percentile bracket) in the cheapest case. If things like custom SSL are in the mix (which Akamai charges absurdly high prices for), or lots of traffic from more expensive POPs, or lack of already having pricing commiserate with high volume traffic commitments, the bill could've been 5-10x that amount or more.
It's kind of stupid to me that the massive and advanced cdn of akamai protect something as non-important as a blog against such a major ddos attack. If they were doing it pro-bono wouldn't the prudent action be to mitigate ddos's until a certain treshold and then actually assess the value of what you are protecting? A good lesson to have learned, I believe.<p>But no, they'll drop this client which had to have continually given good referrals.
It would be interesting if he started writing on Medium (not saying technically advisable, just interesting). I wonder if he'd ever consider trying that.
Some are guessing the DDOS was because of this recent post of his, about a large DDOS network.<p><a href="http://webcache.googleusercontent.com/search?q=cache:kaymYsbcGc8J:krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/+&cd=1&hl=en&ct=clnk&gl=us" rel="nofollow">http://webcache.googleusercontent.com/search?q=cache:kaymYsb...</a>
Unbelievable, they enjoyed year of free publicity from association with him, and this is how they repay him. Its bad enough that they couldn't handle the attack, despite all the bragging about their multi-Tbps capacity...
Brian Krebs' wasn't a paying customer right? Akamai provided the service pro-bono. Perfectly acceptable for them to suspend service if it becomes more than trivial in terms of cost or it puts their paying customers at risk.
I've always wondered if your domain is under a http DDoS attack, couldn't you in theory update your DNS A record to another ip and take other servers down (maliciously)?
At this scale it must also cost a ton of money to carry out this attack, I wonder if there's a vulnerability that we don't know about that let them do this so easily?
tl;dr Akamai was hosting his site pro bono. His site was being DDOSed, which cost Akamai a ton of money, so they kicked him off since they were literally only losing money on the deal.
I think its time for some serious financial incentives for ISPs to start getting serious about routing (or rather not routing) garbage. Financial fines for every DOS originating from your AS, or blacklisting if you are a repeated offender.
Such attacks are possible because Internet is decentralized. There is no way to tell peers that you don't want to get traffic from some AS.<p>And investigation is difficult because attacking nodes might be in different countries, in some of which DDOS attacks are not illegal.<p>Maybe it is time to start building international firewalls to protect local infrastructure?