<story><title>Fastmail, Runbox, and Posteo under DDoS extortion attack</title><url>https://therecord.media/ddos-attacks-hit-multiple-email-providers</url></story><parent_chain><item><author>TacticalCoder</author><text>We still hear about DDoS attacks like this once in a while but it seems it&amp;#x27;s not anywhere near as common as it used to be.  What happened?  It looks like the bad guys are really having more and more trouble mounting succesful DDoS: how comes?  It also looks like, in despair, they&amp;#x27;re targetting smaller fishes.  Why?  Smaller botnets?  Cloudflare and OVH and the likes just being too good at absorbing everything and anything you can throw at them?  Simple firewall rules getting rid of 99% of the crap?  What&amp;#x27;s the reason it&amp;#x27;s not as prevalent as it used to be?</text></item></parent_chain><comment><author>__s</author><text>Botnets aren&amp;#x27;t smaller (IoT has been quite a boon to them)&lt;p&gt;&amp;amp; according to &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.comparitech.com&amp;#x2F;blog&amp;#x2F;information-security&amp;#x2F;ddos-statistics-facts&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.comparitech.com&amp;#x2F;blog&amp;#x2F;information-security&amp;#x2F;ddos-s...&lt;/a&gt; their frequency isn&amp;#x27;t declining&lt;p&gt;But yes, the larger sites have gotten their shit together so that the cost to DDoS has gone up&lt;p&gt;Also if you have a botnet you now have to ask: do you want rent out DDoS or do you want to mine crypto?</text></comment>
<story><title>Fastmail, Runbox, and Posteo under DDoS extortion attack</title><url>https://therecord.media/ddos-attacks-hit-multiple-email-providers</url></story><parent_chain><item><author>TacticalCoder</author><text>We still hear about DDoS attacks like this once in a while but it seems it&amp;#x27;s not anywhere near as common as it used to be.  What happened?  It looks like the bad guys are really having more and more trouble mounting succesful DDoS: how comes?  It also looks like, in despair, they&amp;#x27;re targetting smaller fishes.  Why?  Smaller botnets?  Cloudflare and OVH and the likes just being too good at absorbing everything and anything you can throw at them?  Simple firewall rules getting rid of 99% of the crap?  What&amp;#x27;s the reason it&amp;#x27;s not as prevalent as it used to be?</text></item></parent_chain><comment><author>300bps</author><text>A lot of the old DDoS attacks rely on the ability to spoof your IP address. Many networks are now configured to drop packets exiting their network that don’t have an address from their network.&lt;p&gt;For example, in a Smurf attack the attacker finds broadcast IP addresses by sending an ICMP request to an address and counts the number of ICMP replies that come back. A broadcast IP address is one that sends a packet to every host on a network (often with 255 as the last octet like 207.103.0.255 for a Class C network of 207.103.0.0&amp;#x2F;24).&lt;p&gt;After finding suitably large networks with an open broadcast IP address they then send the broadcast IP address packets with a spoof IP address of the victim. The attack is then multiplied by however many hosts are on the broadcast IP address network.&lt;p&gt;DNS reflection is another type of DDoS attack that also relies on the ability to spoof an IP address of the victim.</text></comment>