Re:Say Cheese: a snapshot of the massive DDoS attacks coming...
by majke on Tuesday October 11, 2016 @05:47PM
(#12688792)
To my knowledge most of the C&C protocols are unsophisticated [0].
For now there is little evidence that says the bots are behind NAT's. I'm pretty sure this will come though. In the blog post I stated that there is indication that port 23/telnet is or was in past open.
Blacklisting IP addresses is indeed effective for L7 attacks. It's harder for L3 when the source IP's could be spoofed.
For now there is little evidence that says the bots are behind NAT's. I'm pretty sure this will come though. In the blog post I stated that there is indication that port 23/telnet is or was in past open.
Blacklisting IP addresses is indeed effective for L7 attacks. It's harder for L3 when the source IP's could be spoofed.
[0] https://medium.com/@cjbarker/mirai-ddos-source-code-review-5...