Krebs Is Back Online Thanks To Google's Project Shield (krebsonsecurity.com) 149
"After the massive 600gbps DDOS attack on KrebsOnSecurity.com that forced Akamai to withdraw their (pro-bono) DDOS protection, krebsonsecurity.com is now back online, hosted by Google," reports Slashdot reader Gumbercules!!.
"I am happy to report that the site is back up -- this time under Project Shield, a free program run by Google to help protect journalists from online censorship," Brian Krebs wrote today, adding "The economics of mitigating large-scale DDoS attacks do not bode well for protecting the individual user, to say nothing of independent journalists...anyone with an axe to grind and the willingness to learn a bit about the technology can become an instant, self-appointed global censor." [T]he Internet can't route around censorship when the censorship is all-pervasive and armed with, for all practical purposes, near-infinite reach and capacity. I call this rather unwelcome and hostile development the "The Democratization of Censorship...." [E]vents of the past week have convinced me that one of the fastest-growing censorship threats on the Internet today comes not from nation-states, but from super-empowered individuals who have been quietly building extremely potent cyber weapons with transnational reach...
Akamai and its sister company Prolexic have stood by me through countless attacks over the past four years. It just so happened that this last siege was nearly twice the size of the next-largest attack they had ever seen before. Once it became evident that the assault was beginning to cause problems for the company's paying customers, they explained that the choice to let my site go was a business decision, pure and simple... In an interview with The Boston Globe, Akamai executives said the attack -- if sustained -- likely would have cost the company millions of dollars.
One site told Krebs that Akamai-style protection would cost him $150,000 a year. "Ask yourself how many independent journalists could possibly afford that kind of protection money?" He suspects the attack was a botnet of enslaved IoT devices -- mainly cameras, DVRs, and routers -- but says the situation is exacerbated by the failure of many ISPs to implement the BCP38 security standard to filter spoofed traffic, "allowing systems on their networks to be leveraged in large-scale DDoS attacks... the biggest offenders will continue to fly under the radar of public attention unless and until more pressure is applied by hardware and software makers, as well as ISPs that are doing the right thing... What appears to be missing is any sense of urgency to address the DDoS threat on a coordinated, global scale."
"I am happy to report that the site is back up -- this time under Project Shield, a free program run by Google to help protect journalists from online censorship," Brian Krebs wrote today, adding "The economics of mitigating large-scale DDoS attacks do not bode well for protecting the individual user, to say nothing of independent journalists...anyone with an axe to grind and the willingness to learn a bit about the technology can become an instant, self-appointed global censor." [T]he Internet can't route around censorship when the censorship is all-pervasive and armed with, for all practical purposes, near-infinite reach and capacity. I call this rather unwelcome and hostile development the "The Democratization of Censorship...." [E]vents of the past week have convinced me that one of the fastest-growing censorship threats on the Internet today comes not from nation-states, but from super-empowered individuals who have been quietly building extremely potent cyber weapons with transnational reach...
Akamai and its sister company Prolexic have stood by me through countless attacks over the past four years. It just so happened that this last siege was nearly twice the size of the next-largest attack they had ever seen before. Once it became evident that the assault was beginning to cause problems for the company's paying customers, they explained that the choice to let my site go was a business decision, pure and simple... In an interview with The Boston Globe, Akamai executives said the attack -- if sustained -- likely would have cost the company millions of dollars.
One site told Krebs that Akamai-style protection would cost him $150,000 a year. "Ask yourself how many independent journalists could possibly afford that kind of protection money?" He suspects the attack was a botnet of enslaved IoT devices -- mainly cameras, DVRs, and routers -- but says the situation is exacerbated by the failure of many ISPs to implement the BCP38 security standard to filter spoofed traffic, "allowing systems on their networks to be leveraged in large-scale DDoS attacks... the biggest offenders will continue to fly under the radar of public attention unless and until more pressure is applied by hardware and software makers, as well as ISPs that are doing the right thing... What appears to be missing is any sense of urgency to address the DDoS threat on a coordinated, global scale."
Off by a little bit... (Score:4, Informative)
Re: (Score:2, Funny)
On a logarithmic scale, thats a constant.
Re: (Score:1)
Re: (Score:1)
Since we're not talking about marketing department of a hard disk company nor a committee sponsored by them, the number is 1024 not 1000.
Re: (Score:2)
And you are off by 24.
That is huge.. (Score:1)
Re: (Score:2, Insightful)
Seeing as how the attacks occured after he posted a series of articles on Israeli-run company vDOS...and that the traffic was larger than practically any other DDoS attack that's been recorded?
It's pretty obvious who has the money and the motive, Israel. They co-opted one of their own, slimy companies to do their dirty work, if it ever blew up in their faces they could bring charges down on vDOS and deny responsibility. vDOS alone can't generate 600+ gigabits of traffic, that's beyond the capacity of any pu
Re: (Score:2, Insightful)
I kind of doubt that the Israeli government was involved in a company whose main customers are common internet trolls that want to (for a fee) knock video game streamers offline for 5 minutes to cause them to lose an arena match in world of warcraft. Seriously, that's the biggest revenue driver for a company like vDOS.
The fact that it was located in Israel is likely coincidence, more than anything. It wouldn't surprise me if a collection people who offer these "booter" services didn't like the thought that
Re: (Score:1)
I agree but your use of vowels is anti-semantic
Re: (Score:1)
Anti-semete
Anti-semitic, not either of the previous two spellings...although anti-semantic was ironically appropriate.
Re: (Score:2)
Although it would be convenient for someone out for fun or an enemy of Israel to attack a target that Israel could be blamed for. I think we should wait for some forensics before blaming anyone.
Re: That is huge.. (Score:2)
Agreed. But the rush to judgement is already in full swing. Camers, DVRs and routers. Oh my! Don't you dare mention Windows!!
As far as I'm concerned there isn't a shred of evidence that this was IOT based.
Re:That is huge.. (Score:5, Interesting)
From Kreb's site:
Many readers have been asking whether this attack was in retaliation for my recent series on the takedown of the DDoS-for-hire service vDOS, which coincided with the arrests of two young men named in my original report as founders of the service.
How about the folks who provide DDOS for hire? For them it costs nothing (if they're just using spare capacity), since they own the botnets. And at the same time, they're sort of advertising their wares at the same time.
This sort of thing is just going to get worse when crappy / non-existant IoT security devices exposed themselves to the web via large-capacity fiber and cable connections. It's already bad enough with compromised routers and computers. Most people won't get protected. They'll just get knocked off the web at will by people like this.
Re:That is huge.. (Score:5, Insightful)
Reading further in comments, I saw this comment from Krebs (emphasis mine):
Actually, the intel I’m gathering suggests it’s not routers at issue, but mostly DVRs and some IP cameras.
So, sounds like the Internet of Things is already biting us fairly hard these days. OS makers for computers and phones have made those platforms much harder to compromise than they used to be, and regularly patch known vulnerabilities. But I fear IoT manufacturers are going to make all the same, old mistakes that PCs went though over the past decade or so, instead of gleaming the hard-won knowledge of best security practices.
Re: (Score:1)
Aaaaand... like an idiot, I failed to notice that this information is right there in the summary. How often does one read TFA and fail to read the summary? That has to count for something, right?
Re: (Score:1)
But I fear IoT manufacturers are going to make all the same, old mistakes that PCs went though over the past decade or so, instead of gleaming the hard-won knowledge of best security practices.
Security, done properly, is expensive. When your business is based entirely on selling cheap shit, there's no room in the profit margin for proper security.
Re: (Score:1)
But I fear IoT manufacturers are going to make all the same, old mistakes that PCs went though over the past decade or so, instead of gleaming the hard-won knowledge of best security practices.
Enough PC users demanded greater security because they saw a negative impact on performance. If DVR performance is not degraded, then not many will notice or care enough to spend a few extra dollars for the security.
Verizon is continually attempting to sell me more bandwidth and higher performing equipment (router, DVR). They rarely even mention security in their pitch. They'll first sell me upgrades to accommodate the malware overhead. I expect that they'll start playing up the security angle when they thi
Re:That is huge.. (Score:4, Interesting)
[T]his sort of thing is just going to get worse when crappy / non-existant IoT security devices exposed themselves to the web via large-capacity fiber and cable connections. [I]t's already bad enough with compromised routers and computers. Most people won't get protected. [T]hey'll just get knocked off the web at will by people like this.
As noted in the article: "the situation is exacerbated by the failure of many ISPs to implement the BCP38 security standard to filter spoofed traffic"
There is something of an inverse relationship -- at least in the U.S. The bigger an ISP is, the less likely they are to give a shit.
We're all nation states now! (Score:3)
"DDoS attacks have become the Great Equalizer between private actors and nation-states."
Re: (Score:2)
Just use email to send stories to people who are interested. No web server needed. Problem solved. New subscribers from word of mouth. Cheap, easy, effective.
Useless. Without the ability for someone to link to the story it can't get large-scale play - going viral can't really happen via e-mail these days.
Re: (Score:2)
Anyone can forward an email, or have you forgotten that? It's even easier that cut-n-pasting a link.
As for the stupidity of going viral, maybe it's time to end that pointless metric of relevance.
About the only important stories going viral are about Hillary's emails :-)
Re: (Score:2)
Re: (Score:2)
Are you unclear on the fact that people generally don't use email for the majority of their online communication? Case in point, we're not communicating via email right now.
Re: (Score:2)
Re: (Score:2)
I fail to see your point. You seem to be saying that things would be better if we went back to the good old days when people used email for their online communications. It may be true, but I don't see that it's relevant to what should be done now.
Re: (Score:2)
Re: (Score:2)
All I have to do is--
c:>nslookup
default server: google-public-dns-a.google.com
address: 8.8.8.8
>set q=mx
>target-domain.com
default server: google-public-dns-a.google.com
address: 8.8.8.8
Non-authoritative answer:
target-domain.com MX preference = 0 mail exchanger = mailserver.target-domain.com
Of course, you don't HAVE to have a DNS MX record pointing to your mail server. You only need one of those
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Running a mail server without a DNS entry is normally dumb. Filters tend to reject email from such a server, and users have been told to distrust such.
Re: (Score:2)
Re: (Score:2)
If I had a trunk, I'd be an elephant (Score:2)
> If everything was done via email, so would twitter.
If I had a trunk, I'd be an elephant*. I do not in fact have a trunk, and I'm not an elephant. Twitter is not an email listserv.
* I started to say "if Hill had a dick, she'd be Bill", but somehow that analogy just doesn't work the same when talking to you. :)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Just use email to send stories to people who are interested. No web server needed. Problem solved. New subscribers from word of mouth. Cheap, easy, effective.
Useless. Without the ability for someone to link to the story it can't get large-scale play - going viral can't really happen via e-mail these days.
My crazy uncle's inbox would beg to differ.
Re: Easy back-up solution (Score:2)
What computer related site would not carry Free articles from Krebs hosted on their own site?
Re: (Score:2)
One that wanted to stay online i suspect...
Painting that target on your site would be an existential risk for most. Moral high ground is cold comfort if you don't make payroll.
Goog to the rescue. Give them their props.
Re: (Score:2)
As if we had a network of store-and-forward servers that can disperse email-like messages over the world, scalable as every server serves only local clients. Such messages could then be archived or expired based on a configurable policy. It might be less usable during a September, but since the Eternal one has ended, we can somehow wait these five days :p
Re: (Score:2)
People then have to stop their US protected free speech or find other more creative ways of getting round big multinationals and their new global "safe" branding.
Email, direct apps are just one of many great ways to totally circumvent brand management and the control of free speech on emerging social media.
The fine print about new community standards and volunteers who enforce
Re: (Score:2)
No joy in the UIK either, the site does not respond.
Re: (Score:2)
DNS-propagation can take several hours, and even longer under some circumstances.
Re: (Score:2)
No problems here, I run my own DNS and flush the cache at will if needed to query the root server and then authoritative server etc. Handy for testing sometimes when moving domains. Once the customer domain moved and the tests are conclusive, it happens that I have to tell the customer that his previous provider should have set the TTL lower than 3 weeks so people using their provider DNS could see the site a little earlier ;-)
I usually set TTL from 10 minutes (dyndns) to 6 hours depending on the domain to
Re: (Score:2)
No idea. Maybe you are missing some potentially hidden intermediate server that cashes an earlier error. I had access to the site as soon as this story was up.
Incidentally, the TTLs on my own DNS servers are down to a max of 6h as well after I initially misconfigured something and then had to wait for 2 days for the cached errors to expire. Makes the principles of DNS-caching pretty clear to you ;-)
Dynamic DNS is on 1 minute, same as dyndns.org uses (or used when I last checked).
Re: (Score:2)
too bad krebs didn't just start posting his blog to facebook instead.
While I like the sentiment, I highly doubt anybody can bring them down via DDoS.
Re: i read this as.... (Score:1)
I'm sure google can fight back. This is an opportunity to reclaim those devices. Think about it. Google will just sit there and take it?
Kudos to google (Score:5, Insightful)
.
Funny, I don't know why, but facebook was never one of the ones I thought might do it.
Re: Kudos to google (Score:1)
It was suggested to him but he said no because under the ToS Facebook would own his material and Facebook would earn the ad revenue. Which is his livelihood.
Re: (Score:2)
Could that be because Facebook don't offer this kind of service?
Re: (Score:1)
The service is actually available to anyone serving news, human rights, or election monitoring, or human rights content. A slashdotter actually suggested the service in the article that appeared here a few days ago.
Aaaaand Krebs thrashes more people (Score:3, Insightful)
Nothing like sticking your finger in the eyes of those who keep claiming they need to restrict bandwidth to their paying users while at the same time delivering slow speeds for exorbitant prices.
Apparently those hundreds of millions of free dollars generated every month by Comcast/Verizon/et al can't be used for anything useful such as implementing security filtering to slow/prevent this situation.
Re: Aaaaand Krebs thrashes more people (Score:4, Insightful)
Google could solve this in a day by flagging its search results page with a "your ISP is supporting cybercrime" warning.
I wonder how well.. (Score:2)
They would fare by using cloudflare instead.
Re: (Score:2)
That's the exact description of the cloudflare.
Except they connect to your web server when it updates, and when the site itself have an dynamic vulnerability that can be exploited, or the attacker gets the hold of your real IP number, stuff goes down.
Re:I wonder how well.. (Score:5, Interesting)
Something to think about, if you're in the market for DDoS protection...
Re: (Score:1)
It's very possible that CloudFlare is hosting the people who are responsible for the attacks against Krebs.
CloudFlare has many criminal customers. Check out this recent list of DDoS/"Stresser"/"Booter" websites proudly hosted by CloudFlare:
alphastress.com, anonymous-stresser.net, aurastresser.com, beststresser.com, boot4free.com, booter.eu, booter.org, booter.xyz, bullstresser.com, buybooters.com, cnstresser.com, connectionstresser.com, crazyamp.me, critical-boot.com, cstress.net, cyberstresser.org, darkstr
Re:I wonder how well.. (Score:4, Informative)
Cloudflare doesn't work for shit. There was a DDoS attack against Something Awful recently, and the DDoS "protection" crumbled almost completely.
site still down? (Score:3, Informative)
I just tried the two top links and get:
Firefox can't establish a connection to the server at krebsonsecurity.com.
The site could be temporarily unavailable or too busy. Try again in a few moments.
If you are unable to load any pages, check your computer's network connection.
If your computer or network is protected by a firewall or proxy, make sure that Firefox is permitted to access the Web.
Re: (Score:1)
Re: (Score:2)
Re: (Score:3)
Shouldn't the IP address be set to one of the attacking IP addresses, so the person/ISP with the compromised device has to deal with all that traffic? Collect the attacking IP addresses, find which ISP is the source of biggest share of them, and redirect the entire attack back at them. When they clean their act up (e.g. implement BCP38), move on to next ISP with the most atta
Re:site still down? (Score:4, Insightful)
Shouldn't the IP address be set to one of the attacking IP addresses, so the person/ISP with the compromised device has to deal with all that traffic? Collect the attacking IP addresses, find which ISP is the source of biggest share of them, and redirect the entire attack back at them.
And which one of the estimated 200,000 attacking IPs would you target with this? How would the ISP responsible for that IP know that the one IP was part of the problem when being hit with a DDOS from 199,999 other IPs not under their control? The correct response to criminal activity is not to continue the criminal activity.
Due to the fact that many of the nets abuse handling channels are ineffective (roughly half take no observable action in my experience), perhaps a more effective long term solution would be for the major CDNs, Google, Facebook, etc., to get together and work on notifying end users more directly. In this case, the CDNs/etc. could implement a shared/dynamic blocking list for those 200k IPs such that no content would be delivered, only an error message indicating that their equipment is compromised. The end user would still be free to use the internet and transmit traffic, but their favorite sites would be useless until they clean their equipment/submit a removal request. This provides direct pressure on the end user creating the problem, and by extension their ISP thru support desk calls, to clean up the compromised systems.
Re: (Score:2)
Re: (Score:2)
Yeah... I had to flush our DNS servers last night. The problem was not that the host record was set to localhost, but that the SOA (Start of Authority) changed from Akimai to GoogleDomains. The old Akimai SOA had a multi-day expiration lifetime and the Akimai servers are still giving out a valid A record response of localhost with a 5min expiration. So until the SOA ages out of various name servers, it will remain unreachable for some.
Re: (Score:2)
Fine for me.
Better be friendly to Google? (Score:2, Insightful)
Google's Project Shield is excellent, and will save a lot of independent journalists.
However, we probably need an alternative Project Shield for journalists that discuss topics Google wouldn't want to support (or be safe supporting).
Google (Score:1)
Dunno if that could ever possibly happen, but consider the following scenario
1. A poorly administered ISP ignores the fact that it's infested with zombie DDOS proxies.
2. Google starts returning a static web page stating "Your internet provider is unable to reach Google, please contact your Internet provider for support." message, instead of their home page, for queries from that ISP's IP address ranges.
Probably just a pipe dream for a lazy Sunday afternoon.
This will be what happens (Score:2, Insightful)
All those people who agitate against an improved internet because they fear nebulous control and because it wouldn't be "trust" based are creating a situation where the real internet will become a bunch of centrally managed corporate networks which CAN block DDOS's. Whereas the open internet build on broken by design protocols and broken by design inter-connection contracts will wither and die.
The current internet isn't build on trust, it's build on quicksand. The current internet is inherently untrustworth
Re:This will be what happens (Score:5, Insightful)
The design is solid. Your claim is like driving your car into a lake and then claiming the car is "broken by design" because it doesn't properly function as a water-going vehicle. Or that humans are "broken by design" because we can't breath a methane atmosphere.
Re: (Score:2)
Okay, let me rephrase then ... it's design is broken for it's current purpose.
Cause we are trying to drive this car on the water.
Seems Google gets publicity better than Akamai (Score:3)
I mean, what better opportunity to demonstrate the power of your solution and with free reporting on it as well? Nobody likes the DDoS terrorists (and yes, that is what they are for all practical purposes, because they are attacking critical infrastructure), so this can only go well.
Re: (Score:2)
I'm not sure that's true - Akamai has announced to the world that they CAN be beaten down if the stick is big enough. I'm not sure, but I'd think that people who want Akamai for DOS resistance are going to remember this.
Re: Seems Google gets publicity better than Akamai (Score:1)
Except they withdrew the service because they were providing it for free. Presumably if you pay, they will provide whatever extra capacity is needed as per your contract.
BCP38 filtering (Score:4, Interesting)
The only way to get BCP38 filtering widespread is to hold ISPs liable for spoofed traffic originating on and exiting their network.
Re: (Score:3)
How does "Joe" know? (Score:2)
Let's take a relatively smart, but also relatively ignorant, common man whose router, pvr, smart tv, etc have been compromised.
And if one or some of one's devices are partly responsible for this:
How would he know?
What steps can he take to find out if he's part of the problem?
And, perhaps as importantly, if he finds out he is, what can he do* to fix the problem and prevent it happening again?
There's no prize for good advice, but a detailed and thorough answer would be of use I'm sure :-).
*Yep, I can think of
Re:How does "Joe" know? (Score:4, Insightful)
Then your ISP should block them off from the internet.
Re: (Score:2)
An internet provider could then suggest an AV scan of that accounts connected "computers".
I know I'm too cynical (Score:2)
But the timing of the two stories, yesterday and today, sure comes across to me like something that's been obviously stage-managed.
Re:I know I'm too cynical (Score:4, Insightful)
If you read the comments from yesterday's article you will notice someone asking about project shield and Bruce Perens noticing it. He then reached out to Google on Krebs behalf.
Re: (Score:3)
You are too cynical. Google is well aware of Krebs (as is everyone in the security community). They will not have failed to notice his problems, and stepping in quickly enough to ride the PR wave is just a smart move on their part. No insidious plot needed.
which democracy exactly? (Score:1)
Which democracy ever came with each citizen getting control of a million strong botnet of insecure products?
This person is a tool to serve the narrative that it is a good thing in any way that Google is the one and only distributor of effective censorship 'protection' on the internet. What a racket. Literally.
Heck ya!!!! (Score:1)
TTANSTAAFL (Score:2)
Akamai should go broke? For a non-customer? (Score:5, Insightful)
"Business decision" meaning "we decided we don't want to go out of business". 600+ Gbps was enough to cause real stress on Akamai's network, so that their customers, who pay the bills, started to be affected. Increasing their costs while reducing their revenue due to losing customers is a recipe for Akamai to go bankrupt.
If Kreb's had been paying Akamai a retainer they would have some responsibility to provide services to him, if they were able to do so. They have no responsibility to put themselves out of business on a charity case.
Re: (Score:1)
Sorry to ruin your zeal but I'm not nearly smart enough to work for Google. I make my living as a lowly "business application" developer.
Re: (Score:1)
Since I neither launched the DDoS nor had any suggestions as to how to mitigate it, how did you "hand me my ass" and "get the best of me"? I offered nothing.
Re: (Score:1)
You need to go to the top of this thread. You thumb-thugged "knew it was Joogle shills the other day" right in this thread thinking I wouldn't see it. I handed you your ass and you were pissed about it.
Since the original DDoS was 600+Gbps why would you even post small scale solutions? Pay attention to the thread and respond appropriately, don't cut-and-paste boilerplate. I sense a future of "needs to improve communication" on employer reviews.