1

I have a home network, big family, with around 20 devices on it at any given time. It seems like every year or so, some device gets a virus or a security flaw is revealed, and the device starts behaving badly.

Normally the device will behave badly and try to password crack my network folders etc.

But the latest thing we have experienced this year is that the affected device will start firing off 1000's of requests to some site. Afterwards, I get on a DDOS ban list. For example, I can at this time not access

An answer below has helped me understand that this is due to Akamai Tecnhologies blocking my IP. I called Akamai Tecnhologies and they confirmed this and let me know that my IP was suspected as "Web Scraping." Meaning some sort of malware must have made tons of web requests to site(s) protected by Akamai Tecnhologies and therefore got flagged as a DDoS attacker. Not necessarily malware, it could have been some rogue software issue that caused these excessive requests too. I have contacted them trying to get the exact sites it hit so that I can debug further.

This sucks because my ISP does not allow me to change my IP address so I'm stuck banned.

I have my router's QoS feature turned on and I do not see any suspicious network behavior at this time. But that could change at any given moment.

So now the question:

What methods are there to identify this situation so that I can take immediate action?

Namely, I need a way to get an alert when my home network has suddenly become a DDOS attack node. Ideally something could be attached to the router to send me a notification - "hey device IP 192.168.1.x just started making 1000's of requests to sites so I have blocked its access until you take action."

So far this is what I have done:

  • See How do I know if my computer is being used for a botnet-based DDoS attack?
  • Changed all passwords, set up 2factor authentication on all password manager sites, etc.
  • Formatted all the windows laptops with fresh copies of windows, because Windows has a higher tendency to have viruses.
  • Virus scanned my whole network.
  • Block all TCP/UDP traffic to any devices that are meant to be used in local intranet only. Such as my security cameras and android tablets that monitor those cameras.
  • Anti-virus software on each device, make sure software updates are kept up to date, etc.
  • Make sure no one but me has admin access of devices. All user accounts on each computer are restricted to just what that person needs.

UPDATE:

I'm using a netgear R9000 router. Do you think there are any REST/SOAP api web services that I can use to create a simple program that watches for DDoS attack patterns?

  • "Block all TCP/UDP traffic to any devices that are meant to be used in local intranet only[,] such as my security cameras": was that before or after you got your IP ban? Because my guess is this should pretty much fix it, unless those cameras use methods to punch holes in your firewall. – Ben Sep 19 '18 at 15:17
  • Have you checked/reflashed your externally facing router itself? – ximaera Sep 19 '18 at 15:18
  • @Ben Yes I blocked those devices after the issue. So i'm hoping this helps. And ximaera I was a couple versions back on my netgear R9000 firmware updates. hopefully that helps too. but yeah... looking for ways to react to this in the future. i think i can fix the issue and be proactive just fine. – Nicholas DiPiazza Sep 19 '18 at 15:36
  • I probably won't have time to expand this to a full answer, but you can configure an outgoing firewall to block outgoing traffic that looks like a DDOS attack. This should be easy enough to detect because such traffic is very distinct - repeated rapid requests to the same IP address. It's almost like fail2ban but in reverse. Here is a related question: security.stackexchange.com/questions/76507/… – Conor Mancone Sep 19 '18 at 16:57
  • 2
    You'll just have to make sure the firewall is in between all of your devices and the internet. Probably the best way to do that is with a router that gives you full control over firewall rules, which may require an router running open firmware. – Conor Mancone Sep 19 '18 at 16:57
3

Set up a Pihole to block ads, malicious sites and to log DNS requests. When the numbers spike you'll know where to block and who is causing the issue.

As explained in the pi-hole documentation (and video documentation) you configure your router to use the pi-hole machine as a DNS server. See this video circa 0:57 seconds: youtube.com/watch?v=vKWjx1AQYgs

Any Linux box will do, not necessarily a Raspberry Pi. I added block lists for Microsoft Telemetry and Spybot immunization list.

Screen grab from phone https://pi-hole.net

  • 1
    interesting. but how does this work if it's not part of the router? In my situation a lot of the devices in question are android, camera, iphone, etc. – Nicholas DiPiazza Sep 19 '18 at 17:50
  • I see. I would have to set up pi-hole as my dns server. very interesting. – Nicholas DiPiazza Sep 19 '18 at 17:55
  • Here is what I really need: discourse.pi-hole.net/t/can-i-run-pi-hole-directly-on-my-router/… – Nicholas DiPiazza Sep 19 '18 at 17:57
  • 2
    As explained in the documentation (and video documentation) you configure your router to use the pi-hole machine as a DNS server. You don't install it on your router... at least not in the documented basic installation... See video circa 0:57 seconds: youtube.com/watch?v=vKWjx1AQYgs – hft Sep 19 '18 at 18:07
  • 2
    Not every DDoS malware does DNS resolution (though we've figured out before that it's not an actual DDoS attack in this case). – ximaera Sep 19 '18 at 18:55
0

Sorry for disappointing you (because your intention to be a responsible Internet citizen is very commendable), but there's no easy way to do what you want to do.

The simplest of the suggestions though would be to write an e-mail to a DDoS mitigation service provider which is denying you access and to kindly ask for support and clarification. A DDoS mitigation provider probably knows what kind of malware you should expect to see in your network out of its network fingerprint that is left.

Looks like the provider in question is Akamai Tecnhologies in your case, because three of four domain names you've provided point to Akamai IP addresses. USPS probably either has some dedicated equipment bought and deployed or is serviced by AT&T, in either case, Akamai would be easier to reach.

Other methods are a lot more complicated. However, one thing you've apparently forgotten to do is to check your externally facing gateway router (or just to reflash it and update it to a latest firmware version). SOHO routers are a common target for malware.

Also, it might not as well be your fault. Some DDoS mitigation services implement a technique that could best be described as "network redlining", i.e. preventing access from whole networks which seem suspicious, blocking entire ISPs or countries (e.g. China, if we speak of a U.S.-based network service), and so on. To make sure you aren't affected by this, ask your friends and neighbours, try to figure out if other customers of your ISP experience the same set of issues.

  • Yeah I called Akamai already and they said it was due to my ip address participating in what they believed to be web scraping. I've already done most of the proactive things you have suggested. But it's the reactive that I'm asking about here. I think the only way I can think of is to somehow monitor the router's QoS, and respond with an email to my cellphone's txt email address when it sees unusual behavior. but the QoS doesn't track number of requests. It only really tracks Mbps up/down. – Nicholas DiPiazza Sep 19 '18 at 16:03
-1

There are multiple ways to solve this. Network based detection / interception may be a good start. E.g. installing a firewall that will throttle and or block suspicious traffic.

  • can you elaborate? I need a bit more specifics. – Nicholas DiPiazza Sep 19 '18 at 15:14
  • In case of a botnet-based DDoS, profiling or throttling traffic might not help a lot. – ximaera Sep 19 '18 at 15:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.