News for hackers. Stuff that matters.

A comment on Dyn Statement on 10/21/2016 DDoS Attack. Parent comment

Re:Dyn Statement on 10/21/2016 DDoS Attack by mirimir on Saturday October 22, 2016 @09:24PM (#12771385)
True. But once you have the IP, you can nmap to get the OS, right? That would probably exclude most false positives, where Mirai was implicated.
[ Parent | on HN ]
Re:Dyn Statement on 10/21/2016 DDoS Attack by Zancarius on Saturday October 22, 2016 @10:23PM (#12771551)
Probably not in cases where the device is behind a NAT/router that happens to forward remote access ports that lead to the initial compromise. Then you'd be nmapping the customer's endpoint. Plus, it'd be too time consuming. Tens of millions of participating IPs spread across countless ISPs...
[ Parent | on HN ]
Re:Dyn Statement on 10/21/2016 DDoS Attack by mirimir on Saturday October 22, 2016 @10:55PM (#12771640)
Good point. But still, even with risk of false positives, I believe that ISPs should be informed. And ISPs could acknowledge uncertainty when informing customers.
[ Parent | on HN ]
Re:Dyn Statement on 10/21/2016 DDoS Attack by NetStrikeForce on Sunday October 23, 2016 @06:11AM (#12772841)
But in many cases you don't even know if the IP addresses are spoofed or not.
[ Parent | on HN ]