1
I have recently been the victim of some Dos attacks.
The facts : I received a very high amount of packets saturating my connection and preventing me from accessing the Internet during one hour (average). They have been performed by players on Xbox live who first threatened me, told me which IP I had and then launched the attack from a load test website, a "booter".
I often write some shell scripts so I made some investigations and tried to write a script which would detect the bad packets and DROP the IPs. I made several attempts. The problem is that after 8 seconds and over 300,000 packets (from 1,000 different IPs) received, I stop receiving anything. Not a single packet. So my script logs tell me it was able to drop those IPs but it can no longer perform its task because nothing comes in my connection.
Does anybody have an idea where the packets got stuck ? Could it be my ISP not forwarding such traffic ? In that case, there is nothing I can do. If I do not receive the packets, I cannot filter them.
What can I do ?
Thanks a lot for your advice.
Alexandre Luioli
Posted 2014-09-26T14:10:55.717
Reputation: 11
At which level do you try to stop the packets? PC (meh) or router (better)? You could possibly also stop them at the ISP or at the source, but that would involve law enforcement. – Peter – 2014-09-26T14:44:42.507
I have a box provided by my ISP which is used both as a modem and a router. But there is no way I can add some scripts on this router, the only things I can configure on it is port forwarding and DHCP.
So for my tests, I stopped the router so that the entire traffic passes through it and reaches my PC.
I did this because the scripts I wrote to filter the packets are run on my computer. Also, I can run wireshark to record the packets and see what they look like.
If I let the router, it will just not be able to make the difference between the "good" packets and the "bad" ones. – Alexandre Luioli – 2014-09-26T14:51:36.257
I contacted my ISP complaining about my static IP and they told me it was technically not possible to switch to a dynamic IP... – Alexandre Luioli – 2014-09-26T14:54:07.993
When I looked at the attackers IPs, they come from machines located in China, South east Asia, North America, middle east and Europe. So there is no way any authority can stop the attack. – Alexandre Luioli – 2014-09-26T14:59:59.837
"They have been performed by players on Xbox live who first threatened me" - "there is no way any authority can stop the attack". Of course they can. They might not want to, though. – Peter – 2014-09-26T15:48:29.367
@Peter I mean, as soon as the attacking IPs come from several countries, law enforcement could act only if there were agreements between all those countries.
Imagine the guy uses Tor to connect to a booter and launch the attack, How on earth could any authority find out the origin of the attack, the IP connected to the Tor entry relay ?
Of course, if Microsoft recorded the threats, they could act and ban people, but it would not prevent them from attacking my static IP, unfortunately... – Alexandre Luioli – 2014-09-26T18:28:17.110
@Ƭᴇcʜιᴇ007 I'm gonna have a look. – Alexandre Luioli – 2014-09-26T18:31:01.060
1Well, it seems that my infrastructure is too weak and just can't handle the flow, nothing I can do, or maybe spending a lot of money to purchase a connection offering a larger bandwidth. Not an option. If those attacks continue, I will change my ISP and find one who provides dynamic IP so that when I get attacked, I can change my IP and the attacker can just *** and eventually stop. For now, I purchased a VPN and connect to Xbox live through the VPN through a shared connection on my PC. So my IP is no longer shown. – Alexandre Luioli – 2014-09-26T18:37:41.963
"How on earth could any authority find out the origin of the attack, the IP connected to the Tor entry relay ?" - Why would they even have to? You have a written threat linked to the attack, and the threat is linked to an gamertag, which is linked to a credit card, which is linked to a name. If law enforcement wants to help you, it's quite easy for them to do so, although it may take some time. Depending on where you live they may not want to help you because cybercrime has no priority there, or the necessary laws are not in place. Easy to find out with a single call. – Peter – 2014-09-27T14:44:10.277
You're right Peter, I made complaints at Microsoft through the menu option but I doubt it will lead to something serious. Microsoft is a US company, I am in France... And in my country, the police laughs at you when you complain about a cyber attack, they just suggest you to ask help from your ISP... – Alexandre Luioli – 2014-09-28T08:12:14.233