Hacker News new | ask | show | jobs
by short12 1685 days ago
What is with ddos these days?

Are they doing it for money ?

It just seems silly with services like cloud flare

2 comments

If you have that much computing power at your disposal, you might as well just mine cryptocurrency, right?
Not necessarily as this is Mirai, a botnet of IoT devices. There’s probably not much else you could do with them.
You can probably do both at the same time, as cryptocurrency uses a lot of CPU/GPU/memory/... but little bandwidth, and DDoS typically uses bandwidth but little CPU/GPU/memory/...
You can hire a ddos agaisnt your across the street competitor. It could be the other pizzeria, the other hardwareshop. Use your imagination
That used to be a thing but is it anymore?

There is so much mitigation so it's pretty much ineffective

It's even worse nowadays than it used to be, due to "Serverless" and "Infinite Scalability"/"Auto-scaling".

One of the most fascinating things I've read recently is the rise of "Denial-of-Capital" attacks.

Essentially, you DDoS a competitor, but not directly in the interest of just taking them offline.

Instead (hopefully) running up a massive cloud bill and putting them out of business. Or a similarly critical financial hit.

If you don't have billing limits enforced for all of your services, and you run auto-scale/serverless workloads in any part -- if someone can pass enough traffic to your services they can cause you potentially incredible financial grief.

Most recent (publicized) one I can think of is this one. Fathom Analytics attacks:

https://news.ycombinator.com/item?id=25194795

There was an initial cloud bill, but now they're paying $3,000/mo for AWS to have a Cloud Protection team on standby for them.

  "$36,000 & my call with Fola"

    "I don’t know anybody who has signed up for this $3,000/month service from AWS… it’s called AWS Shield Advanced. The big value of this service to us is that we have access to some of the world’s best DDoS mitigation experts. In the event of an attack, we can page them, and they’ll help us mitigate the attack, creating firewall rules, identifying bad actors, and offering advice. So instead of just two of us responding to DDoS attacks, we have genius engineers we can speak with, and that feels good."
Ouch.
no such thing as billing limit in Azure, anyway.
As if anyone signing up for Azure care about pricing.
Not everyone has mitigation. If you know your competitor is hosted by a small hosting outfit you can get them banned from their webhost by directing a DOS attack at them.
Ineffective? It fuels cloudflare's business model.
what business model? cloudflare basic ddos protection is free
Cornering the whole internet is their business model. Besides, advanced DDoS protection is paid.