Dear viewer, these subtitles were generated by a machine via the service YouTube and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/2565 Thanks!
[Music]
okay welcome to Milly ways Welcome to
our next talk um we all know how hard it
is to set up some kind of service on the
connected
intertubes
um but it's even harder keeping it
running you know with lots of people
wanting to access your service uh
malicious intent or not uh and on next
speaker cck will give us uh some
insights on the uh history
of Dos attacks and how you can handle
them please give him a warm
Applause okay thank you so at first so
you know a little bit about about me I
have lots of it experience and for 20
years I'm already doing working in it
and doing CCC events so the interesting
thing maybe is that I'm also with a CCC
knock the internet manufacturer um so
the the area I'm talking about is mostly
in the premium managed hosting area
because that's where I'm employed so
it's a high security environment mostly
web hosting we host some government
websites which you surely know and of
course due to that we get a fair share
of
DS so parts of this talk I have to uh
give a short disclaimer I will do a very
short introduction to DOS talk about the
changing landscape from 2012 to uh just
now um talk about surviving application
layer dos and then we'll have a short
few key
takeaways so the disclaimer everything I
say is publicly available knowledge
maybe you don't know where to find it
but if you look you can find it in who
DS Trace rout R bgp TOS from Ben JoJo in
public biddings there are often
technical specifications which explain
what they're expecting from doas
mitigation there's news articles
sometimes our own customers have been
leaking some kind of information to the
Press you can find stuff on mailing list
GI Hub our blogs there's actually been
some C an in the Bund talk about dos so
it's funny because we're also hosting
the site that has the PDFs for that
which is funny uh for
us so yeah we also have a privacy policy
on the websites which explains some
cookie stuff we're doing of course you
can just dos us and then you will find
out that we have mitigation and how it
works of course some xais values have
been
removed and some of the information I'm
talking about is not directly from the
company but from for example Cloud FL
quarterly reports of stuff so it's not
internal secret knowledge and of course
I'm talking about dos in
general so what is Doos of course
there's an XKCD for it so it says like
hackers briefly took down the website of
the ca yesterday people hear that the
website have been has been hacked but
what computer experts like you here is
someone tore down a poster hung up by
the CIA so it's not hacking it's not
infiltrating the systems it's using a
service that are that is offered by the
website just too much so that no one
else can use it
anymore right so you send too much uh
you overwhelm the Target by sending too
much Network traffic too many sessions
too many requests too make Dynamic
requests to searches for example and
just think of it of too many people
visiting a shop and ordering food which
we've actually done at the chaos
communication um event at the end of the
year there were just two many people
visiting uh the dunking donuts and then
there was just no possibility for random
normal people to get the donut anymore
right so some questions for you so that
I get to know the audience a bit better
uh who of you has been
dosed well quite a
few who was down as a
result
okay who is confident they can survive
dos at at work oh someone like maybe
okay yeah and who has done
Doos I see some hands good luck you're
not being videotaped um so yeah okay I I
also did it but against our own uh
websites of course so let's talk about
pre 20102 the good old days as I call it
there wasn't uh many issues with DOs uh
we had Pro probably less than one attack
uh per year no proper doas protection
but why didn't we have proper doas
detect uh protection well our customer
said well this is not in the public
bidding budget so it's an a public
bidding and it's not part of it so you
don't have to provide it so if you're
down because of Dos that's all fine with
the customer well okay and they also
said they don't mind if they're
offline so my boss also back then uh he
said yeah we're within SLA dos is not
our responsibility of course why should
we build something that's uh not being
paid for and they always stop after an
hour anyways so we still I still asked
the mitigation provider so back then it
was like 30 terabytes traffic per month
or like €30,000 that's less than 100
megabits so very expensive back then
then came 20 2012 so anonymos um
gathered and they used Twitter to
distribute um like uh pictures like this
so they had a um um they yeah they
published this and people were supposed
to go on a website to uh attack some
sites with web Lo so which is a a pretty
easy to to use and of course we uh also
followed the invitation to the channel
and monitored what they were doing and
how they were attacking us back then we
didn't have good protection so basic so
actually we were down for a few minutes
due to one of these attacks but they
said uh quite uh well that's the red
part so they said oh let's try it again
tomorrow with web so thank you for
telling us uh about the tooling so we we
could just mitigate it easily
and unknown to us G gchq dsed Anonymous
like Anonymous chat IRC uh with rolling
thunder which is their own dos platform
they were using and people got searched
and arrested because they took part in
these attacks from their home computers
um so yeah people people got arrested
and as a result attacks became less
powerful even so 2013 to 2014 there was
lots of uh Innovation going on new trend
was UDP reflection so spam house uh got
dsed for several days Cloud got dsed
they were actually offline for some
longer time at the US uh this the caesa
um published a report about these
attacks and that made them even become
uh more widely used so how to survive
that well have UDP filters from an ISP
um for us as a Hoster uh I'm hosting
HTTP websites https why would I need UDP
on that so that was really really easy
for us to
filter so 2015 other things happened and
2014 the Ukraine donbas war and on the
7th January 2015 the Ukrainian prime
minister visited Berlin and that they
wanted to some money and as soon as he
lands there the foreign foreign office
is down the German bundar the chancellor
merkel's website everything's down and
they have a uh prepared message that
they are responsible for this due to
uh the Ukrainian
war and they don't want us don't want
Germany to give any money to
Ukraine so back then we didn't have um
because of the public bidding thing we
only had very small connectivity the
knock from our ISP actually removed the
UDP filters we had gotten previously we
got black hold in Frankfurt uh we got
black hold everywhere we don't have much
spare Hardware no General layer 7even
mitigation uh solution so to survive we
just used Cloud flare there were some
online protection origin protection
issues but after like six to eight hours
we were online again which was fine for
us our customer was also happy about
this but not of course not Everyone
likes Cloud flare well they they can
look into your traffic you have the
privacy concerns there was some press
article on netp politic dorg which was
taken uh very seriously and layers the
ability to look into all layer 7 traffic
uh was an argument um for doing
something else and not using them
anymore so we started our own very small
modus mitigation it's not like we we're
not trying to be Cloud flare we try to
do the on-prem part very well and if we
need a partner to do something more like
big traffic qdp attacks that's
outsourced to um well not outsourced but
they Implement filters we tell them to
implement so 2015 to 2016 there was also
some more Innovation going on on the Dos
front layer three layer Forex became
more popular um we saw small SPO syn
Flats usually maybe around the one one
gigabit which is the typical size of a
rented server and uh of course low and
slow attacks also got popular like slow
post things there you can see um the
referer actually it's pretty nice of
them to send the referal so it's easier
to block um and how to survive this of
course you just increase capacity always
make sure you can handle line rate um
and well have an upstream that can
filter for you and you need of course
need to rethink all timeouts if someone
connects to their web server why would
would they be idle for like 5 minutes
right that takes up valuable
resources so 2016 to
2017 the previous attacks um continued
but there were uh WordPress pingback uh
attacks which are ALS Al pretty easy to
filter out they're pattern based cannot
be changed but of course when the first
attack like this hits you uh you need to
implement a filter previously you didn't
know about this and there's lots of
different other layer 7 attacks that can
hit you so you need to know about these
in order to filter
them 2017 to 2021 not it's getting more
recent um there were more and more
mostly Dynamic requests so for example
you use a slash question mark ID and
some random thing because then it has to
hit your backend server um and uh your
cash can't deliver it so um yeah it's
targeting backend uh resources actually
there were also new sources like squid
proxies microti router botn Nets and uh
I think one of the first botn Nets with
more like 10,000 Bots uh attacking us uh
with layer 7even
attacks so from 2021 to Fe about 2022
there was um even more layer 7even
attacks more HTTP more pipelining also
due to the me spot net uh using
pipelining High request per second
attacks and again random um random
parameters in order to bypass caching of
course lots of new sources hack gitlab
servers um which are usually pretty
powerful which is uh way worse than
having a iot botn net attch you because
these servers are just so much more
power ful bigger residential bot Nets
and a lot more attacks via tour and also
rented IP space was now being used um
yeah so they would just rent IP space
and use it for a while just to perform
layer 7
attacks so February 2022 to now well of
course the uh the second uh Ukrainian
War started and uh well what do you
think did we get more dasas
of course we did so there are there are
new sources now which is also in the
cloud flare quarterly report there's
dozens of clouds using at the same time
so suddenly you have like oh uh Google
is attacking us Microsoft cloud is
attacking us uh Len not and everyone is
uh is just uh doing Li 7 requests
attacks through tour also increased
Google published some information about
that they had an Tech that had
1.3 uh million request per second of a
tour and then um this is from source of
team sumu I hope I pronounced it right
um they found out that uh noname uh this
noname uh Russian actor um that they had
two interl hosting providers and these
providers are only used to perform layer
7 D
do
so um there's also now the d doia
project uh project by no name they run
kind of paid dos they are promising that
they will at a later uh point they will
pay for people who have performed dos
attacks so they pay like a few cents per
request that they have been sending and
of course again this is an old uh um an
old method also used by Anonymous before
they use well now they use telegram
instead of Twitter but you see um
they're asking other people to help
attack and some of these people um
already have bought so you have a lot of
different bot Nets suddenly attacking at
some point and they are also Now using
paid expensive proxy so behind all of
this there's there's some money and this
costs some money to implement if you um
rent proxies that cost like a few
thousand EUR per
day so um yeah they actually managed to
take down lots of sides that got a lot
of media attention and there really a
serious threat and Anonymous sud even
took down Microsoft right there were
these issues with teams which some of
you may have experienced and um they had
very good um powerful layer 7even
attacks and of course current attacks
current events cause attacks so when
Ukraine with ukra
off. uh got online um you saw on the on
the other slide there were immediately
they were starting attacks or if they
when they decided to deliver tanks to
Ukraine of course the attack start
again so but how to survive this we've
seen that lot uh more and more attacks
are layer seven but why is it
problematic so oh something flew away
okay um so it's a bit
windy okay so why is this problematic
well it's it's hard to distinguish from
a residential botnet and proxies and
cloud like is it a legitimate Source um
and these sources there they're doing
full HTTP requests to your site which
can uh which use up some
resources this all this causes high load
and they're uh querying Dynamic websites
which means they try to um attack your
backend
capacity so should we block on known
patterns is that a good idea or maybe um
requests per IP what about proxies like
a telal uh car grade nut proxy or should
we limit band perp also bad with the
proxy probably how do we distinguish uh
an attack from real traffic or should we
just use more capacity at more VMS have
kubernetes horizontal pot Auto scaler
and just spawn up a thousand uh
instances what what what's the best way
to understand this I have some some uh
details um this is the HTTP that's sent
by the classic web Lo web Lo attack
which I shown before that was the
interface and this is what it actually
sense to you so this is the interesting
part um the impact is you you'll get a
cash bypass you will be they trying to
hit backend servers and well cause
backend server load of course so what
happens if you block on WE Legend well
this happens they just use uh this
parameter it's the basically the same
just uh yeah you don't need the second
parameter to do a cash bypass what about
this one if you decided to filter on on
the ID thing well they can just rotate
it instead of k u y they will just write
something else again you have a cash
bypass what about this one this even
looks valid it's not valid um because
the correct one would be 61 but 62 will
also hit the back end if you don't have
any filters in your caching and your
load baning front and so and it even
looks valid it's uh harder to see even
what about this one one you use a search
term uh you just send queries to the
search all the time if you have 50,000
Bots and each bot does a request per
second H well you're very probably
you're you're down
immediately and this is of course
valid even this this is a valent uh
backend query maybe your lot balance
here can handle 30,000 um of these
requests but what about 300 or 3 million
then uh you will you will have an issue
with bandwidth um POS possibly to um or
with memory pressure or things like that
on your lot
balancers and what's the an engineering
solution well just increase capacity now
how to do one attacker with a hack
gitlab server can maybe do 30,000
requests per second one server how how
many search uh queries can it answer per
second 30,000 well you can have one
server for each attacker right so
horizontal pot autoscaling is not a good
option the only thing the top priority
is stopping abusive clients from
reaching backend
servers how are we going to do that so
um I'll quickly introduce uh you to a
typical uh setup so well you have the
internet traffic flows from top to
bottom you have the internet your rout
is attached to it you maybe you have a
mitigation Appliance a firewall load
balancer application server and you're
able of course to do mon uh to monitor
everything so should we use a mi
Appliance what about TLS 1.2 TLS 1.3 te
if you terminate it on the mitigation
device it has to have this performance H
usual mitigation devices that can handle
like 10 gigabits or or more of traffic
per second or um let's say 100,000
handshakes per second they're super
expensive they're not scalable you can't
just horizontally put 10 there so you
can handle let's say a million requests
or something they don't have a good API
generally no custom settings you can't
build custom stuff they're super
expensive so of course not an option
well let's use data we already have so
from monitoring we already know um how
many requests um
uh usually happen on which side how many
traffic is transferred um how much
request my backend can do what's the
usual Baseline for my back end uh we all
have that data um but should be block
someone who's um doing more more traffic
what about the proxy user for example in
a company and then there's like 10
people going to your site immediately
that would be higher
right so the solution is you verify the
clients you don't use an appliance you
use your load balancer inspect the
queries and if it's over a certain limit
you can just redirect it to service that
verifies that the client is valid of
course you have to write some code um
there's some solutions available not but
not um very good ones so we had to write
our own
actually so I hope this is not too small
um yeah I'll just quickly go over it so
basically it works like this if an
unknown client um has done too many
queries he's being redirected to this
inoda solution it looks if there's a
valid query well yes then um it can
access the back end if it doesn't have a
valid cookie it's being redirected by
the load balancer uh yeah to to the
inoda system it presents a task the the
task has to be solved it can be a
JavaScript button click a capture
whatever you want to do and then if the
solution is uh correct sends an error if
if it's not correct it sends an error if
the solution is correct a token is being
sent back as a cookie and then it starts
from the beginning and the client gets
authenticated if it's it's trying that
too often of course it also gets
blocked so this is the the usual one
ours is a bit ugly so I just uh stole uh
the the pr the look from cloudfare which
you probably all have seen before so
this is the usual thing what happens
there they do some cryptographic
operations a proof of work in the
background and after your computer has
done it it's
authenticated so what else can we do so
so um we can use a control plane so we
have uh data in the load balancers about
the people who are doing too many
requests already like there's a client
doing 10,000 requests per second why
would we continue to serve it we just uh
from the load balancer we push VI an API
to the firewall and we can drop the
client on layer um three already in the
firewall so there's no no load on the
load balancer
anymore and then also um you can import
block lists for IPs asns uh it can be
hard or soft blocking so if you have a
very suspicious um Russian as which only
sends a bad traffic to you you can soft
block it and it will always go through
verification of course this all should
be built with cicd so you check if if
there's a net that's too big sanity
checks all of that but the important
thing is you can also block as ends
because have we seen some of these layer
7even attackers they they have fixed
asns they're using to
attack so this is an example for abuse.
CH for their bot net tracker um so we
just uh create a little bit of Json we
have the cicd pipeline and then it just
gets deployed into the
firewalls another thing um that's a bit
new maybe that uh we haven't really seen
before is dos box so that's an unknown
stability issue so your servers are or
your software is becoming unstable only
under very high load con uh
reconnections um and with certain
configs which maybe wasn't tested um by
the software vendor so does this happen
of course it does otherwise I wouldn't
have put it here so there just two
examples uh for ha proxy so layer 7
requests weren't locked so you didn't
see all these requests that were um
being performed so an attacker would do
this special kind of request you would
look into your server lock and there was
nothing there your CM your all your
analy analyzer systems they wouldn't see
anything but the request still happened
and there was another walk that h a
proxy instances were getting
crashed so reproducer is interesting
this is from the GitHub issue around
200k curent connections are doing a get
slash at the same same time hm what
could that have been well of course
under DS this uh feature became in
unstable but all of these are fixed now
of
course so what else to do you need to do
your homework you need to um have all
your data you need visibility you need
uh every you need to know everything
your HTTP front end error codes back end
requests latencies bandwith packets per
second TTL from where is your traffic
arriving what are the ASN sources um you
need to look into your systems about the
load pressure stall discy memory usage
just monitor everything so that if
something happens you can have a look
afterward super important so how to
survive this of course if you have all
this data you do an excessive postmortem
even if it takes 10 people a whole week
you do the postmortem because you don't
want to get crashed by that again you
analyze of course the whole attack you
build test cases so have a reproducer
you give it the reproducer to the
software vendor so they will fix it of
course you report that Upstream because
you want to have it fixed for everyone
so this means we will add your technical
distinctiveness to our own your zero
days burnt if you attack us we will we
will make sure you can't use it
again so key key takeaways engineer
General solution for issues so layer 7
defense is essential
nowadays um capture and use all the
system data you have like I said
everything needs to have an API so
different systems can talk to each other
um of course do postmortem for DS and
also test your systems dos your own
systems um or have someone do it for you
there are some providers that will do
that for
you well sometimes also for us sometimes
you lose this is an old picture um but
sometimes you win we also monitor them
and they said in the channel after they
attacked us why are all websites fast H
we won this
time thank
[Applause]
you so so just one more thing well maybe
You' already read it you can use dust
uh- test.com to non-invasively test your
websites it looks at timeouts and things
like that so uh it's a neat Tool uh you
can use to improve your own
defense thank you very much Craig so uh
as you mentioned um we've got some time
for Q&A are there any questions in the
audience okay um we have a pretty Lively
microphone stand over here here please
everyone who has a question line up over
there so uh yeah you can ask your
questions from a centralized Point make
a nice
queue okay let's get
started can't hear you
sorry can you hear me no hello oh no
it's working okay so mainly your talk
was about a GTP other product codes are
more robust against uh or or have other
yeah attch vectors or something and
additionally what what about
HTTP uh 4 uh three sorry
HTT yeah HTTP 3 is really tricky because
it's based on UDP uh which is annoying
um because then you can just easily
apply all these filters and there's
still lots of reflectors out there right
so um there's different options you
could do um for for example um you could
fail gracefully which means if you're
getting attacked via UDP you could stop
serving HTTP 3 and just only serve http2
if if that's what you choose um yeah
there's some some other ideas some hor
istics you can work on so yeah I I don't
have a very good solution for that too
it's a problem uh many people will face
um and it will be good for cloud flare
and other providers because if people
get dsed with this stuff they will move
move to the cloud maybe yeah hard to
defend next question please um yeah have
you thought philosophically about what
you're doing in terms of you're building
a system which encourages the
competition to sort of compete in a
touring test situation to differentiate
Its Behavior from the machine to a human
who actually wants access to your
website so are they just going to keep
getting better how do you deal with that
problem well it's for for mosters they
also need to spend time on you right
there are these um these bocher websites
which is basically DS for higher and
they offer Cloud flare
bypasses so but we don't we if we were
using Cloud flare we would probably have
been hit been hit by that but our
solution is different we can't use the
cloud because of the customers we have
so ours is different so people would
have to invest a lot of time to um to
engineer a circumvention for that
um yeah it's worth spending like a few
weeks on engineering time on cloud flare
but is it worth spending on us like um
that's maybe an advantage but yeah of
course um they could
try using an interactive browser then we
can enable button click then we can do
captures there's a lot of other tricks
you can do like um um yeah there's lots
of other client verifications these are
just some examples yeah there's like a
dozen other
methods hi Craig um I'm wondering uh as
an
ISP now my former problem was my pip
were were filled by the attackers now
it's going to be my server who is going
to be attacked so should I go and move
my Protection Service to uh match those
IP sources and so on plus what the
servers uh are doing and getting like
with dhxy because obviously we've got
like two sorts of data who are uh useful
for our metrics what's you thinking
about that uh I think I didn't didn't
get that right I'm I'm not sure you mean
like if you're getting attacked by Lego
7 you have a tech piece or well I'll
still get my uh Source ASN Source uh IP
sources and so on so do you match those
two informations to get uh a decent um
oh so you like like metric for your
protection ah so you mean um if it would
be useful to match maybe the link that
traffic's coming from for instance and
maybe also does the rpki is good for
this traffic do does the signing is good
does v and those kind of stuff yeah that
should should be some some things that
you should do of course match on Bon
match on your own IP space why would uh
you get that from externally and stuff
like that so yeah yeah sure of course
next question
please hello so basically trying to
compare your Solutions one to three uh
versus using uh Cloud flare during uh
crisis situations so basically you're
saying okay you don't have a cookie um
throw a capture but uh my concern with
that is do you think that most of the
teams in different companies would be
able to implement captas um that can
counter uh basically Bots used in these
attacks yeah it depends on on the team
of course yeah um if you if you have an
engineering department that can do
something like this um but you can use
uh existing Solutions already um you can
you could just use um Google recapture
for example or H or H capture you don't
have to implement and code the capture
and everything by yourself just uh
present the page and then get the um the
proper information the proper
verification back so that that would be
possible to do also
yeah your turn from the resource uh
balancing perspective like you have your
servers and you have all your
observability tooling your Telemetry and
so on and then uh I observed that some
kind of request uh used an an high
amount of observability output compared
to others and in the end we were our
conclusion was with the telemetry back
line so how do you balance we then at
one point decided just to cut off the
Telemetry because it was decided that
it's more important that some requests
were at least answered but how do you
balance this or is there a good General
solution or is this really domain
specific uh you mean you had too many
requests or uh maybe I didn't get that
properly but we we got mayil from uh
mayil requests and the requests caused a
lot of telemetry output and this
telemetry outry outut uh then this
traffic actually did damage internally
this was the issue
uh well I guess our back bonus uh
internal network is maybe bigger than
yours then we have enough internal
capacity to to handle that well of
course you see the spike and if you
collect like everything then you have
several terabytes of data but I can buy
a server that host that
so I have budget so sorry that's always
nice to have yes and you have a question
yeah thank you that was a great talk um
thanks do you ever see issues with web
sockets cuz I know that's becoming more
of a thing that web developers like to
use because I can imagine people could
then pipe data in yeah websockets are
long lift and we really hate them so uh
uh we don't have many customers that are
using them so um and there's customers
that attract dos traffic a lot and
fortunately
the customers that are using web socket
web sockets they're not the ones
attracting the Dos so yeah it's a bit
it's annoying
yeah okay any more questions there yes
please thank you for your great talk um
rest apis are more common now how do you
protect them from Doos without such
methods as the challenges you showed us
ah yeah
um there's probably different different
methods for that um
maybe maybe you have another Endo for um
the first request to authenticate and
then you feed that back with an API to
the other system like you have a lockin
thing uh on on one
subdomain uh and if that's verified only
then you can access the other one
because there's a layer four uh filter
on it or something like that this very
quick idea I I don't know um there's
there's probably some other better
methods
too all right your
question so if you're already uh
redirecting these attackers to a capture
service um have you maybe looked into
doing any um more offensive uh
mitigation techniques like Tar Pits or
gzip bombs once the attacker fails the
capture I've with this Anonymous attack
back then web blog runs in a
browser if you redirect that browser to
someplace else it will go there so uh
you can redirect it to I don't know well
it would be really evil to redirect them
to your competition or but uh yeah you
you can redirect them and do stuff with
them if it's browser based also if they
use a headless browser to to do some
stuff but um yeah it's better to detect
and block them tarping yeah it's an it's
an option but yeah thank
you all right one more question yes
please um so commercial products are
quite mature now so do you see which
product commercial product hard
commercial products which you think
so well the vendors are saying that
right uh do you see any limitations in
then I I mean why would you go this
route when let's say you have the budget
and you can yeah take some I mean what
are the advantages on this one yeah so
um a solution you buy is often not
scalable right so then you have one box
it can do 100 GBS on prime or something
like that and then if you want to add
another one they say oh no uh you can't
just add an a second box you have to buy
this bigger box it can do a terabit and
it costs small like a house so um it's
it's not really scalable I think um and
also you always need two because what
happens if there's a software update uh
of course you need twice the capacity
all the time or if you have three well
you you well you you get the point um
and also I think um some of these
mitigation Solutions aren't really
Market ready because we had a solution
and tested it uh and we had another one
in production and it had issues with uh
it could serve capturas but it can't
look into TLS 1.2 traffic well well yeah
not very helpful anymore right and then
um it also would serve the captas which
with an HTTP 200 code which means if the
Google bot is coming it's indexing all
these sites and then um the index is
[ __ ] so yeah and with our own solution
we can just uh adjust it uh what
whatever we want to do and have
different levels of um um uh
verifications for example or we can do
start with easy verification and it's
like a maze that an attacker would have
to go through like start with a simple
proof of work then some redirect
JavaScript uh and and all these and they
have to code something for that in a row
and when they think they have finished
they will meet they will see uh the next
thing all right there's one last
question in the que please so I've seen
um H proxy in in your presentation so I
assume you're using H proxy as a load
balancer uh um what would be your
recommendation for for example for the
firewalls or the other
components yeah well Everyone likes open
source uh so I would recommend using
some some open source things that you
can debug actually uh for H AO you have
the source code uh even if you don't buy
the professional version you have very
very good support because they're really
interested in getting uh having a good
product right so some of these fixes
they're done in less than 24 hours um
which is really great so I would always
recommend using open source and not buy
a very big box from a vendor but also
including apis as you recommended right
yeah for for apis usually um if if you
have a more complex system it's very
specific to your environment because for
us it's web hosting I'll just block UDP
who cares right uh but if you're a
gaming provider you can't block UDP
because your games use it so you need to
to design very differently so in the end
it's a whole system that's being
designed with different components and
of course this is not everything we have
it's a lot more stuff that's
interconnected and giving and sharing
information so
yeah all right right behind you another
question
spawned you said about coding something
for the proof of work protections are
you talking about like Computing it on
the attacker nodes or some form of
bypassing it uh some some what bypassing
some form of bypassing the protection
for formal form of form of okay well it
could could be anything if if you have a
really big botn net and you have a um
computational proof of work um your Bots
would have each bot would individually
have to calculate the the formula and
stuff so you could code that of course
yeah or have a have a headless browser
executed um and then you have the result
and feed that into the client but that
also requires you to code a lot of stuff
so your Bot net can attack and then uh
we will just use another mitigation for
that all right thank you very much for
the questions if you have any questions
later I'm pretty sure Craig will stay
around and you can ask him later but for
now uh let's thank him again for his
great insights on D do
[Applause]
thanks