DDOS
EUROPEAN PEERING FORUM
PEERING
SECURITY
“The attack is coming through your peering ports”: Nokia’s talk at the European Peering Forum
“The attack is coming through your peering ports.”
That was the title of Dom Schaeffer’s (Nokia) talk at the European Peering Forum in Paris.
When you operate interconnection, it is not a title you want to see on a screen several metres wide. But it points to a reality none of us can escape.
In six months, the number of active botnet IPs has grown from 1 to 8 million, with peaks above 30 Tbps. And this change is to be found in our everyday lives: set-top boxes, devices behind the home router, connected TVs, smartphone apps.
Dig into how this explosion happened, and the answer is clear: AI.
Web services block datacenter IPs, so scraping agents go through residential connections, using the “smart” devices that sit behind our home fibre box.
And it is sometimes legal, without being an attack: many people don’t realise that by installing a free VPN, for example, they accept in its terms of use that their resources may be used for this.
This traffic is built on legitimate traffic, except that threshold-based detection no longer sees it. It comes in through every peering port and saturates links before the customer’s protection has reacted.
On 12 September, Dario Amodei called for slowing down before agents become “capable of taking over the entire internet with a persistent botnet”.
What Nokia shows is that they don’t need to take it: they rent the path, at five cents per subscriber.
IXPs are best placed to stop these attacks, because they control the paths between those who exchange traffic. That is why the quality of your interconnection can no longer be neglected today.
Illustration: Nokia, Deepfield Secure Genome
This news was first published on LinkedIn. To comment or share it, head to the original post. → See the post