Fastmail, Runbox, and Posteo under DDoS extortion attack

1

Pingly

#Email #Enterprise Communication #Email Management 1 social mentions

> how would this work for SMTP You can actually get this semi-transparently with a TOR-like system. (I'm not sure TOR itself actually implements all of this, and also TOR is perennially underprovisioned for political reasons, so this mostly won't work in practice.) First, you need a distributed DNS mechanism to publish "MX exmaple.com abcdefghijklmnop.onion". This is mostly static, so DDOS doesn't really work. You then come up with a <i>sequence</i> of rendezvous servers, which we'll number starting from 1. (I think actual TOR just assumes a single (or few) rendezvous server is sufficient, but I'm not sure.) You then try servers 1,2+rand(2),4+rand(4),...,2^k+rand(2^k),... Where rand(x) picks a random number in [0,x). (0: I'm not sure whether distinct rands should share lower bits; see below.) If a server is overloaded it just drops traffic on the floor. The main server then checks the rendezvous servers in sequence until it's gotten enough successes that any client would have tried one of the successful rendezvous servers in its random sequence ([0] above affects the distribution here). Under heavy load, the main server also sets a proof of work requirement (clientHello statisfies the standard hash-has-x-leading-zeros), which allows the rendezvous servers to drop most of the incoming traffic. Legitimate clients by definition are not spamming connections as fast as they can, so they can burn CPU to meet this requirement. DDOS clients can <i>also</i> burn CPU on this, but that reduces the rate at which they generate traffic. The end result is volumetric attacks are spread over 2^k rendezvous servers, where k is dynamicly chosen such that they can handle the load, while for faux-legitimate attacks[1], DDOS will just push up the computational costs for legitimate clients without ever actually shutting down. This works for anything TCP-like. 1: You can DDOS anything by just behaving like (absurdly many) legitmate clients, eg `while true;do wget http://example.com/;done`.

#Software Development #Software Development Tools #Web Development Tools 2408 social mentions