Re:Blacknurse – Low bandwidth ICMP firewall attack
by drzaiusapelord on Monday November 14, 2016 @11:28AM
(#12950858)
These aren't web technologies at all, but firewall issues. This doesn't have anything to do with websites being inefficient, but how some firewalls handle some ICMP edge cases. I feel like the complexity of IPv4/6 is high and stuff like this will continue to be found. If you want a world-wide networking protocol, you need to deal with complexity, and complexity comes with issues like this.
We should be geared up to fix stuff like this via quick patching. This stuff shouldn't be terribly surprising. I think the idea of "install and forget" for any internet enabled device is a dangerous line of thinking, especially for firewalls.
Re:Blacknurse – Low bandwidth ICMP firewall attack
by andy_ppp on Monday November 14, 2016 @11:39AM
(#12950976)
Yes, I know that... my point is if you wanted you could take down Hacker News for example; pretty easy if you thought about it for a while right? You don't need this bug or a massive botnet.
Re:Blacknurse – Low bandwidth ICMP firewall attack
by chillydawg on Monday November 14, 2016 @11:52AM
(#12951113)
Botnets are a lot simpler to wield and make you a more credible threat vs a website who thinks they have no "slow code", but to who 1TB/sec would certainly do the trick.
The fact is that most sites work only with some kind of caching in front of them at any scale; my guess would be on a site by site basis there will be a slow performing piece of code somewhere that can be exploited with low resources on the part of the attacker.
In a lot of cases, simply creating a session a couple of 100000 in a short enough space of time, would be enough to overload the majority of sites...