Re: Reflection DDoS last week

[Denys Fedoryshchenko <nuclearcat () nuclearcat com>]

On 2019-08-28 02:23, Damian Menscher via NANOG wrote:
> On Wed, Aug 21, 2019 at 3:21 PM Töma Gavrichenkov <ximaera () gmail com>
> wrote:
>
> > On Thu, Aug 22, 2019 at 12:17 AM Damian Menscher <damian () google com>
> > wrote:
> > > Some additional questions, if you're able to answer them (off-list
> > is fine if there are things that can't be shared broadly):
> > > - Was the attack referred to law enforcement?
> >
> > It is being referred to now.  This would most probably get going
> > under
> > the jurisdiction of the Netherlands.
>
> Deeper analysis and discussion indicates there were several victims:
> we saw brief attacks targeting some of our cloud customers with
> syn-ack peaks above 125 Mpps; another provider reported seeing 275Mpps
> sustained.  So presumably there are a few law enforcement
> investigations under way, in various jurisdictions.
>
> > > - Were any transit providers asked to trace the
> > > source of the spoofing to either stop the attack
> > > or facilitate the law enforcement investigation?
> >
> > No.... tracing the source was not deemed a high priority task.
>
> Fair enough.  I just didn't want to duplicate effort.
>
> The source of the spoofing has been traced.  The responsible hosting
> provider has kicked off their problem customer, and is exploring the
> necessary filtering to prevent a recurrence.
>
> If anyone sees more of this style of attack please send up a flare so
> the community knows to track down the new source.
>
> Damian

One of my clients suffered from such attacks.
And you know what the secondary harm is? Typical false flag issue.
Even if you have decent DDoS protection setup, it is highly likely that 
involuntary reflectors administrators will not puzzle what to do with 
this, they will simply block your subnet/ASN.
For example attacker spoof hosting operator subnets, did SYN flood to 
all credit card processing gateways, and sure legit hosting gets 
SYN+ACK.
And this hosting after suffering to block this SYN+ACK reflection will 
find an unpleasant thing - not a single credit card processing gateway 
is available from his subnets.
Good example is EAGames, Rockstar, fs.com of those, who just set static 
ACL