4

CloudFlare (known for fighting DDoS-attacks) is explaining quite a lot about DDoS on their website cloudflare.com/ddos. In an article named The DDoS That Almost Broke the Internet they write about a DDoS attack of 300Gbps that they mitigated. Also the following is written on the CloudFlare page on Wikipedia:

CloudFlare reported a new record for the largest ever recorded DDoS attack with independent media sites being targeted at 500 Gbit/s.

Since it's all about who has the most resources, CloudFlare has to be able to have more resources in order to "win" (read: mitigate the attack). I assume they can upscale their infrastructure flexibly and they pay for those resources from the collective money (earned by their payed contracts) to mitigate (big) attacks, like some kind of collective insurance. "All-for-one".

I'm wondering about the following unlikely and so theoretical scenario. What if CloudFlare has to deal with multiple DDoS attacks of 500Gbps at the same time or with multiple DDoS attacks of 1Tbps. In this example I used CloudFlare but I assume that the answer applies to other DDoS protection solutions also, right?

Also, isn't the only actual limit, financial resources? What if one or multiple DDoS attacks of 500Gpbs or more, continue for more than months. Will this bankrupt them?

  • The longer the DDoS goes on the more likely that some one (read isp/tier1/2 provider ect.) will take action to stop it. It costs them money as well. – AstroDan Jul 20 '16 at 13:12
  • No, it wont bankrupt them. Such reasoning is based on the thing it's not possible to defend against it, and another one that if it's possible to defend, then it cannot be automated after it becomes notorious while it can be. It would rather put network operators out of job if they could not handle it and they'd be sold off to someone who can solve this problem, e.g. introduce resilience. The cost of something like that would be still very, very small margin of profits. – Aria Jul 20 '16 at 13:59
  • 3
    "(earned by their quite expensive pricing model)" CloudFlare is absolutely not expensive compared to alternatives, if anything it's strangely cheap. We do not charge based on bandwidth or # of requests unlike many of our competitors. "Also, isn't the only actual limit, financial resources? What if one or multiple DDoS attacks of 500Gpbs or more, continue for more than months. Will this bankrupt them?" Someone would need to be able to maintain an attack of that size for that long which is nearly impossible to do. Disclaimer: I work at CloudFlare. – xxdesmus Jul 20 '16 at 14:57
  • 3
    @EvanderConsus most DDoS mitigation providers charge based on the bandwidth your attack consumes. We do not -- that's a major difference. Your will with CloudFlare is the same every month, even if you get attacked for 2 weeks. Our competitors can't claim that. Your bill can fluctuate wildly if you get attacked. – xxdesmus Jul 20 '16 at 15:00
  • 3
    I worked for a large CDN a while back that handled some very high profile customers. The bandwidth and infrastructure is already in place, so even "large" attacks end up being nothing more than a slightly more impressive spike in the Router Traffic Graph.If the attack went on for a very long time, the network engineers might start contacting some of the more problematic upstream providers to do something about it, but it's really just not an issue, and if the business is run well, capacity will be planned well in advance so it never becomes an issue.. – PushfPopf Jul 20 '16 at 16:28
10

I work for CloudFlare so maybe I can shed some light on how we do things.

Fundamentally, CloudFlare uses an Anycast network design; this means that network traffic has no control to where it is routed and it is automatically routed to the closest available host. Computers compromised by botnets are typically distributed throughout the world in different geographical regions. Because of using an Anycast network we increase the surface area of our network such that it is harder for a distributed attack to take us down. The traffic cannot merely overwhelm a single datacenter, in order to grow out this protection we now have 86 data centers around the world and we plan to add more.

CloudFlare's global Anycast network

We also operate an open peering policy where we are willing to directly interconnect with ISPs (PeeringDB). By removing the middle-men we are able to have the shortest path from the source of the attack to where we can filter the attack. Today, we have the single highest participation in Internet Exchanges globally, of any network. By having a direct path form attacker to destination we can prevent collateral congestion on our network.

Yes, we need a large network to come with attacks, we need big pipes so people can't congest them - to that end our network is 96% bigger than the largest DDoS attack ever recorded.

This is despite the fact we have seen a whopping increase in attacks. There are some interesting characteristics about these attacks; they predominantly happen on weekends (attackers busy with something else on the weekday?), they happen against largely benign websites indicating that anyone can become the target of an attack and also these attacks are massive in capacity.

Almost all of our Layer 3 attack handling is now autonomous, we use a range of strategies to protect against attacks. When attacks come to our Edge we have worked out strategies in order to ensure we are able to reduce the impact of such malicious traffic; we then seek only to pass on safe traffic to the origin.

In many ways CloudFlare has become the DDOS filtering method of last resort; for Business and Enterprise we have advanced protections against DDOS attacks backed by a full SLA, we offer this at a flat rate to ensure that DDOS attacks aren't successful in bankrupting their victims. For at risk public interest sites we have Project Galileo offering this technology for free to those public interest websites who need it.

Currently one of the largest risks to the internet lies in open DNS resolvers, which can be used for DNS amplification attacks by hijacking insecure DNS resolvers; I would highly recommend looking at the Open Resolver Project to learn more. Finally, an article from about 3 years ago on our blog goes into detail about how the DDOS attack against Spamhaus almost broke the internet.

  • Very educational answer. Thanks for that. Nevertheless, the article you mentioned in the end was also mentioned in the original question itself. Also "...have worked out strategies in order to...", would you be able to give us some insight in those strategies you're referring to? – Bob Ortiz Jul 21 '16 at 12:15
  • 2
    We have quite a few strategies; some of which can be found by looking in our patent "Determining the likelihood of traffic being legitimately received at a proxy server in a cloud-based proxy service": google.com/patents/US8646064 – mjsa Jul 22 '16 at 11:41
  • Great information and the schemas in the patent look interesting as well. Can you please add this valuable reference in your answer? – Bob Ortiz Jul 22 '16 at 11:45
2

Large scale DDoS attacks usually aggregate at a target's access router where their impact is strongest. Whether multiple DDoS attacks of 500Gbps or multiple DDoS attacks of 1Tbps should be handled by network providers' DDoS defenses ideally.Here's an interesting article on the professionalisation of attacks and service providers/managed service providers mitigation efforts automated DDOS IDS systems.large-scale DDOS attacks

In addition, SDN technology can also be used to guard againstlarge DDoS attacks by automating their network routing and scaling procedures.

1

You are right in saying the ability to stop ddos attacks are a function of finance. Cloudflare's use of anycast DNS returns DNS answers based on geography. You can quench attacks by nxdomaining clients that exhibit high bursty connection or DNS queries.

There are a few ways to return DNS queries based on geographic fencing. One way is to incorporate geoip data into bind and reply based on where incoming queries are from. The other way is to use anycast to offload route processing to the routing layer to determine geo boundaries. With this in place, you can partition large ddos streams according to regions and sinkhole them before they hit the site. Assuming you wish to ddos cloud flare, you would have to saturate their links, from everywhere, but as they have shown, they have the capacity to withstand it.

  • 1
    Can you explain something about "anycast DNS returns" in your answer? – Bob Ortiz Jul 20 '16 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.