Schneier on Security

finagle • July 17, 2024 4:53 PM

Clearly they need to persuade crackers to use VPNs, IPv6 or any browser that is not the absolute latest, because they routinely put CAPTCHAs or just block any of those scenarios.
Maybe that 6.8% reflects their prejudices, and doesn’t quite align accurately with actual malicious traffic. I would imagine they can measure a DDOS quite well, but a slower, more crafted attack I doubt they would spot and log. So perhaps their stats are DDOS plus genuine traffic they block, not actual malicious traffic.

finagle • July 18, 2024 5:00 AM

Measuring DDOS traffic will give you probably the bulk of malicious traffic in their minds, because by its nature you’re measuring a large volume. I’m kind of assuming they can identify a DDOS request, but the more I think on this, I’m guessing they are just labelling traffic as DDOS, not necessarily identifying it specifically.

Like Peter A, there is definitely a constant current of lower volume but no less malicious traffic hitting all the standard and many common fallback ports looking for HTTP Server details and trying a suite of unlikely but standard attacks for badly secured servers. I put a new domain online a couple of years ago, and routed the DNS to a box that logged traffic to a huge range of ports. It was being hit within seconds, on all the usual ports, 80, 443, 8080, with requests for admin access to tomcat, apache, and all the php hosting solutions. I tracked back some of those to nation state actors. Most to 443 were trying to limit to older crypto. I’m guessing little of that is logged in the 6.8%. Though adding in all 404 and 403 responses would catch much of it.

There’s also another kind of DOS attack that is impacting sites. This one they don’t see as hostile, because it is sold to them as a good thing. That’s where middleware like Cloudflare filters incoming traffic and bins legitimate requests on spurious grounds that suit them, per my previous post. These requests are not bad, but are binned because the users have VPN, or Tor (which I didn’t know about) or are on an older device with an ‘out of date’ browser. Even if the middleware lets you in website design now is providing its own DOS. Rather than graceful degradation, serving basic HTML and enhancing it with CSS and JS, the whole site rejects traffic based on browser string parsing because the JS framework chooses to DOS. If you change the browser identification via proxy, then the sites often work fine.

So on one hand Cloudflare may protect you from DDOS, but on the other it may DOS a percentage of your users. Who may not be lucky enough to have a recent handset, or computer. Or who live in a country where you need a VPN, or Tor. Cloudflare doubtless hope that the headline at the top of this post encourages companies to buy in, with the threat that they may get knocked off the web by a passing botnet. But it comes at a cost, you are excluding legitimate traffic and users based on Cloudflare’s rules, not yours. The example of IETF here is interesting. Are Cloudflare blocking someone in a state where they have to use VPN from accessing resources that would help them backdoor a hostile regime? Not highly likely but do we want a tech company to decide the standards for the internet? Because that is what they are doing.