Hacker News Reader

Comment by CN7R | Hacker News Reader

Ok so I don't know that much about how DDoS attacks work besides that it's basically a large influx of input that makes it impossible for 'legitimate' users to get through.

But in a block chain, a Sybil attack—imagine voter election fraud, where numerous fake IDs are made to vote for a candidate—is blocked by making the cost of generating hash values (government ID is pretty hard to counterfeit) extremely high.

Can the same methodology be applied to blocked DDoS attacks?

Like using Dyn to find a domain is similar to making a phone booth call to yellow book call center, why not just raise the price of calling from 25c to $1.00?

View on HN

Because the whole internet would become unusable if DNS lookups cost you a dollar.

In the first place, the requests are being made by owned IoT devices. So making the requests more expensive (in time, bandwidth, or actual money) would just hurt the owners of those devices. The people operating the botnet wouldn't care, they'd just get a larger botnet.

I don't mean an actual dollar cost but computing power.

Is there a way to enforce a limit on requests from IoT, or a way to increase costs of running a botnet but not have that cost transfer to the owners of IoT?

IoT botnets are a problem because they're massively distributed. Even if a single device could only issue one request per second you'd just need to own more devices. There are millions and millions of vulnerable boxes out there, sometimes dozens in one home or office.

Things get crazier once you have one compromised hole-punched device that is behind your NAT/firewall too. You can end up in a situation where you have a local C2 server on your light bulb, controlling a sub-botnet of your fridge, washing machine, and wifi controlled doorbell. It's not unreasonable to think that this could compromise orders of magnitude more devices than the original botnet itself, considering how many things are just saved by their interface not being routable or accessible from the wider internet.

Something I've wondered is how much of an impact large botnets have on other systems they rely on. If you had a million compromised CPUs in a small geographic area suddenly jump from a low power state into doing a massive amount of work, could it cause localized brown outs? Some napkin math says probably not, but it's not something I've heard considered much before.

It's certainly plausible: http://www.geek.com/geek-cetera/tea-time-in-britain-causes-p...

A kettle can draw 1500W+, so you'll need a lot of devices (or Internet connected kettles...) to cause a similar effect.

A few hundred megawatts is well within the amount of power peaker plants can produce and the vast majority are idle >> 90% of the time. You'd need millions of air conditioners to cause a brownout. Most states fine utilities heavily for any disruption of service (to the tune of $10s or 100s of millions per company per incident) in exchange for a govt granted monopoly so they all have extensive capacity built out, capable of providing for huge extended spikes in consumption.

What about other countries?

Do you know if there's companies or initiatives to provide security for IoT devices?

Reply on news.ycombinator.com