<div dir="ltr">Yea was talking about something sustainable though, not just launch an attack for a few minutes and be done with it. The thing is that all the NTP 'amplifiers' are going to be spread over lots of networks, so in fact said dodgy host might not have too much troubles, as in they won't be being blasted on their abuse or NOC addresses by people like level3 or whatever, since 99% of the hosts will be spread around and only receiving a little bit of NTP traffic, even if they contribute a few hundred Mbit as a result.<div>
<br></div><div>Anyway, I'm sure Arbor and Cloudflare and co could comment more on the CnC side of things, far better than itnews :/</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Feb 11, 2014 at 10:17 PM, Jayden <span dir="ltr"><<a href="mailto:peer@peer.id.au" target="_blank">peer@peer.id.au</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-AU" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Three Syllables: AWS. Or even vanilla vps hosts, there are enough cheap ones out there to grasp a few hundred and destroy them before anyone is the wiser. To sustain the attack you’d need some /very/ dodgy upstreams. (enzu *<b>cough</b>*)<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri","sans-serif""> AusNOG [mailto:<a href="mailto:ausnog-bounces@lists.ausnog.net" target="_blank">ausnog-bounces@lists.ausnog.net</a>] <b>On Behalf Of </b>Joshua D'Alton<br>
<b>Sent:</b> Tuesday, 11 February 2014 9:40 PM<br><b>To:</b> Dobbins, Roland<br><b>Cc:</b> <a href="mailto:ausnog@lists.ausnog.net" target="_blank">ausnog@lists.ausnog.net</a></span></p><div class=""><br><b>Subject:</b> Re: [AusNOG] NTP reflection used for world's largest DDoS<u></u><u></u></div>
<p></p><p class="MsoNormal"><u></u> <u></u></p><div><p class="MsoNormal">In OP case yes, but just saying were someone like Scott Weeks wish to perform said attack, they could probably do it with just 7 servers as previously mentioned. Or maybe even a single 10Gbit server, though aforementioned 'dodgy' providers don't do 10Gbit that cheap. That is part of the scariness of these sorts of attacks, they are a lot easier to carry out with minimal knowledge and funds (comparatively).<u></u><u></u></p>
</div><div><div class="h5"><div><p class="MsoNormal" style="margin-bottom:12.0pt"><u></u> <u></u></p><div><p class="MsoNormal">On Tue, Feb 11, 2014 at 9:41 PM, Dobbins, Roland <<a href="mailto:rdobbins@arbor.net" target="_blank">rdobbins@arbor.net</a>> wrote:<u></u><u></u></p>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm"><div><p class="MsoNormal" style="margin-bottom:12.0pt"><br>On Feb 11, 2014, at 1:47 PM, Joshua D'Alton <<a href="mailto:joshua@railgun.com.au" target="_blank">joshua@railgun.com.au</a>> wrote:<br>
<br>> Though, 7 x 1Gbps full linerate servers with a provider who won't complain about the usage would only cost about $2000AUD per month.<u></u><u></u></p></div><p class="MsoNormal">The servers are likely compromised, and there are likely more than seven.<u></u><u></u></p>
<div><div><p class="MsoNormal"><br>-----------------------------------------------------------------------<br>Roland Dobbins <<a href="mailto:rdobbins@arbor.net" target="_blank">rdobbins@arbor.net</a>> // <<a href="http://www.arbornetworks.com" target="_blank">http://www.arbornetworks.com</a>><br>
<br> Luck is the residue of opportunity and design.<br><br> -- John Milton<br><br>_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><u></u><u></u></p></div></div></blockquote></div><p class="MsoNormal"><u></u> <u></u></p></div></div>
</div></div></div></blockquote></div><br></div>