Back to Home11/17/2025, 5:39:15 PM

Azure hit by 15 Tbps DDoS attack using 500k IP addresses

478 points
297 comments

Mood

heated

Sentiment

negative

Category

tech

Key topics

DDoS attack

Azure security

IoT botnet

Debate intensity80/100

Microsoft Azure was hit by a record-breaking 15 Tbps DDoS attack using 500k IP addresses, sparking discussions on cloud security, IoT vulnerabilities, and the motivations behind such attacks.

Snapshot generated from the HN discussion

Discussion Activity

Very active discussion

First comment

50m

Peak period

157

Day 1

Avg / period

80

Comment distribution160 data points

Based on 160 loaded comments

Key moments

  1. 01Story posted

    11/17/2025, 5:39:15 PM

    2d ago

    Step 01
  2. 02First comment

    11/17/2025, 6:29:39 PM

    50m after posting

    Step 02
  3. 03Peak activity

    157 comments in Day 1

    Hottest window of the conversation

    Step 03
  4. 04Latest activity

    11/19/2025, 2:10:07 AM

    17h ago

    Step 04

Generating AI Summary...

Analyzing up to 500 comments to identify key contributors and discussion patterns

Discussion (297 comments)
Showing 160 comments of 297
ChrisArchitect
2d ago
1 reply
dang
2d ago
1 reply
Switched above. Thanks!
shoddydoordesk
2d ago
1 reply
FWIW I think this is a bad practice.

The Microsoft article reads like a corporate press release. The original link contained additional pertinent information and research which is good for discussion.

dang
1d ago
OK, I've swapped them back.

The principles here are clear: we prefer the best third-party article to corporate press releases (https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...), but at the same time we don't want blogspam (i.e. ripoffs that don't add anything interesting).

TZubiri
2d ago
4 replies
We should make residential proxies illegal
teeray
2d ago
1 reply
...and suddenly no one is allowed to VPN back through their home router.
rjdj377dhabsn
1d ago
How would that be enforced?
dongttebayo
2d ago
1 reply
We really shouldn’t - this seems like perhaps one of the worst ideas one could propose in an era of rising authoritarian rule. Seems like a bad time to be putting silly restrictions on how folks route their traffic.
derwiki
2d ago
1 reply
Tinfoil hat says it’s the gov’t doing it for those reasons /s
meowface
2d ago
I will disregard your cowardly "/s" and say: no, I bet it isn't.
kachapopopow
1d ago
1 reply
breaking the law by using wireguard to access my home network, hmm, great idea.
TZubiri
1d ago
2 replies
Ok, I'll be a bit more specific, banning businesses and the trade of proxies that are purposefully marked as residential, in order to evade firewall blocks, and even to evade proxy blocks.

You gotta draw the line in the sand somewhere, VPNs are already morally dubious, but if you ban the most shady of VPNs, residential proxies, then you can at least guarantee service providers the right to deny service to proxy users, while allowing proxy users to use the proxy everwhere they are welcome in.

potwinkle
1d ago
1 reply
But the botnets don't use VPNs, they use IoT devices owned by people who don't even know there's a computer inside. It seems like you just don't like the idea of VPNs in general and are using an unrelated attack to argue for deprivatizing (And thus, surveilling) the citizenry.
TZubiri
1d ago
Hey.

The way it works is that these pwned IoT devices sell themselves to paying customers as proxies. So the pwners are not the ones actually running the DDoS service/Ransomware distribution/malicious activities. Rather it's an economy where each malicious actor offers their specific service.

In this case IoT device pwners pwn the device, install a VPN server and place their devices on a marketplace where they charge cents per hour using cryptocurrency. Then whoever needs an anonymous IP address pays for a couple of hours of 10k ip residential addresses, and sends their traffic wherever they need to.

So both are true: DDoSers (and malicious actors in general) use pwned devices, but they also use VPNs

kachapopopow
1d ago
yah, but how else am I going to create millions of youtube accounts to spam sex bot ads >:(
jeroenhd
2d ago
Making them illegal seems far-fetched, but at this point something like email blacklists but for web services is becoming inevitable.

At the moment, that's what Cloudflare is doing. They're just not obvious enough, leading to people on forums (and here) asking "why do I constantly need to fill out captchas to enter websites".

drcongo
2d ago
1 reply
Imagine how much of that traffic was just the bots following the endless redirects.
siva7
2d ago
Those redirects would crash Azure, i'm betting a grand
bluedino
2d ago
4 replies
IoT is just wave after wave of unsecure devices. There's gotta be a better way.
rdtsc
2d ago
2 replies
The "S" in IoT stands for "security".
Razengan
1d ago
Internet of Thingsecurity?
N19PEDL2
1d ago
We need IoST!
heresie-dabord
1d ago
1 reply
> There's gotta be a better way.

Until then... There's gonna be a bigger wave.

tclancy
1d ago
You’re gonna need a bigger boat.
kachapopopow
1d ago
3 replies
fun fact, part of the reason this botnet exists is because europe required the ability to install security updates unattended that you cannot disable and they compromised one of the servers that had the capability to push these updates compromising hundreds of thousands of routers.
Razengan
1d ago
1 reply
Wait when was this?? Did it fly under the news??
kachapopopow
1d ago
it's one of the (i believe) hundreds (at this point) of zero-days that is used to build this botnet, at this point they are using funds that they get from selling this botnet to purchase new zero days
cyberpunk
1d ago
1 reply
That's really impressive finger pointing.

If the vendor can't even secure their update server; how long do you think it would be until some RCE on these 100k un-patchable routers gets exploited?

The only people to blame for this is the vendor, and they failed on multiple levels here. It's not hard to sign a firmware, or even just fetch checksums from a different site than you serve the files from...

kachapopopow
1d ago
3 replies
the problem is that these laws just make the problem bigger - instead of having to compromise 100 thousand routers they can just compromise a single update server from a vendor that doesn't care about security.
mmooss
1d ago
1 reply
Or the law makes the problem smaller, by making the routers secure.
kachapopopow
1d ago
1 reply
ok, let's redo this: instead of routers it's an IoT device. The router protects the IoT device from direct access so it is secure from majority of attack vectors - now an IoT device provider gets their server compromised and hundreds of thousands of IoT devices are now bots in a botnet due to the ability to forcefully push a security update.
mmooss
1d ago
1 reply
I understand the risk, but the existance of risks doesn't mean they outweigh the benefits. Everything has risks.
kachapopopow
1d ago
1 reply
I don't think it does outweigh the benefits, the real benefits would be punishing or/and banning vendors that do not secure their devices since using laws such as "timely updates" just promotes them to include sloppy (insecure) implementations for pushing said updates just to do bare minimum to comply with the law.

relevant law here: EU Cyber Resilience Act (CRA).

mmooss
1d ago
> I don't think it does outweigh the benefits

Fine, but that is the real discussion to have. Not 'it has this risk and therefore is bad'.

> banning vendors that do not secure their devices

I think the goal is to encourage positive behavior, not try to monitor everyone and evaluate their updates.

> promotes them to include sloppy (insecure) implementations for pushing said updates just to do bare minimum to comply with the law

I imagine the law is more than just one clause ?

efreak
17h ago
I tried to read this page, but it keeps refreshing itself and resetting the scroll position to the very top. Since I'm on mobile, I can't do anything about this easily and it's worse because it takes longer to figure out where to scroll to to continue.
LinXitoW
1d ago
But that's already true for most cases and devices. Most people using most devices let auto updates just happen.

And the other option isn't that much better, because "don't do autoupdates because maybe the update server is compromised" leads to a bunch of unsecured devices everywhere.

The only "real" solution is also completely unrealistic: Every private person disables auto updates, then reads the change log, downloads updates manually, and checks them against some checksum.

The better solution would be to simply increase fines until morale improves.

alphager
1d ago
1 reply
That's just not true. I'm in Europe and all of my routers allow me to disable unattended updates and most don't enable it by default.
kachapopopow
1d ago
might be too old, my asus router updated and I could no longer disable updates.
rconti
1d ago
1 reply
I suppose ISPs could be more restrictive about which routers they allow their customers to use, but I'm not sure I'm a fan of further lockdown in that department.
mghackerlady
1d ago
1 reply
I doubt that would do much, most people don't even know they can use a non ISP provided router
rconti
23h ago
What do you mean "do much"? Wouldn't negatively impact users, or wouldn't help the botnet problem?

The article makes it sound like the issue is largely compromised routers and cameras -- and presumably cameras are less likely to be publicly-accessible to get compromised in the first place.

ISPs are able to update firmware on the routers they own, so it's my guess that it's customer-owned routers that are the main issue here.

esafak
2d ago
1 reply
Is this Aisuru growing? How can it be dismantled?
SLWW
2d ago
1 reply
Yes.

Only way is to secure your IoT devices/routers/cameras/etc.

esafak
1d ago
2 replies
Through personal responsibility? That is not scalable; look at how many compromised devices there are. We need a better solution as an industry.
rollcat
1d ago
2 replies
Yep. Manufacturers / distributors should be held responsible. Aligning the incentives is half the battle.
qiqitori
1d ago
1 reply
Yes, need to protect Azure from those evil manufacturers.
catlikesshrimp
1d ago
Azure AWS and cloudflare will survive, then everything else will pay them for protection; when all of the internet is captive, they will lobby for regulation to reduce the costs.

It would be better to get the regulation set up before stronger gatekeepers are created

fch42
1d ago
A "do not connect to the cloud" physical flip switch on the IoT device is what I want. Where can I sign the petition for that?
userbinator
1d ago
"a better solution as an industry" = "corporate authoritarianism"

I'd rather these attacks continue, than they not exist at all, because the latter is only possible in a world without any freedom.

dainiusse
2d ago
1 reply
/sarcasm Another ai crawler...
m00x
2d ago
Anthropic agent went a little haywire on the tool use
supportengineer
2d ago
22 replies
I will never understand why there isn’t an international law enforcement agency with teeth, which can get rid of the bad actors.
trollbridge
2d ago
2 replies
I mean, America can’t do anything about scam phone calls aimed at seniors who forge caller ID of local hospitals.
morkalork
2d ago
1 reply
Can't or won't?
trollbridge
1d ago
I’ve decided there isn’t a difference.
lossyalgo
1d ago
1 reply
As alluded to by morkalork, they definitely could if they wanted to, as the (most? of the) rest of the world doesn't seem to have this problem. As long as spammers keep paying telecoms & no law(s) forbidding this exist, it will continue.

edit: grammar

toast0
1d ago
> As long as spammers keep paying telecoms & no law(s) forbidding this exist, it will continue.

That's the trick. A lot of countries bill calls to cell phones at 10 cents a minute; in the US, calling is near zero cost. The US makes a great market for scammers to target because of low operating costs, penetration of globally usable payment cards, minimal language diversity.

Of course, these scams are forbidden by law, but that doesn't change the economics. Very few scam shops get busted; especially when most of them run from outside the US. STIR/SHAKEN helps a bit, but not much... without a effective mechanism to report unwanted calls that leads to those callers being ejected from the network as well as ejecting providers that are unresponsive to reports, there's not really hope of progress.

m00x
2d ago
1 reply
How would you even enforce this if the offending country doesn't agree?
dijit
2d ago
2 replies
Limit their upstream connection to the rest of the internet via allied countries.

Literally the same as economic sanctions. The internet is a network of peers “trading” bits and bytes after all.

m00x
1d ago
1 reply
This won't do anything. The attacks are not from the offending countries they're from botnets of compromised devices.

North Korea doesn't care if you limit their internet they already allow people to go outside their own.

dijit
1d ago
1 reply
perfect, then we just nullroute at source with Flowspec, even if we change the goalposts a thousand times in this thread there does exist a technical solution to this problem.

Just not enough economic or political incentive to pay for it.

m00x
1d ago
1 reply
It's not changing the goalpost. You're just describing a solution that are heavy-handed, yet incredibly easy to circumvent.
dijit
1d ago
> How would you even enforce this if the offending country doesn't agree?
immibis
1d ago
America already limits its upstream to China and Russia through a private companies such as Cloudflare and Spamhaus. It's often the case that for Chinese users seeking to escape censorship, once they've worked their way through the Chinese Great Firewall, they find themselves in front of the American one.
Thaxll
2d ago
2 replies
Because it's not technicaly possible, I mean we're on HN, we all know how internet works.
dijit
1d ago
1 reply
You should talk to a network engineer before making claims like this. There are mechanisms to curtail DDOS attacks at origin.

For a few reasons (political, economical) there’s little will to enact them, these attacks are so few and far between and you can pay your way out of them in most cases, so the incentives aren’t there for ISPs (whom are a commodity judged primarily on price and bandwidth)

m00x
1d ago
1 reply
How exactly would you keep the origin from sending a command to a botnet?
dijit
1d ago
2 replies
you don’t?

You detect the behaviour downstream and send a signal to the ISP that there is traffic that needs to he rate limited.

One mechanism for this is called RTBH (Remote Triggered BlackHole) which relies on community tagged prefixes of addresses exceeding rate limited to be blackholed from forwarding traffic further in to the internet.

There’s also things like flowspec but a lot of things rely on proper trust between ASNs.

Thaxll
1d ago
2 replies
How do you know where it comes from, if they use UDP and change the src of the packets.
Fabricio20
1d ago
1 reply
IP spoofing is pretty uncommon nowadays because everyone has anti-spoofing mechanisms in place and most ASNs often don't forward spoofed addresses outbound.

But as the sibling mentioned, even with spoofing, you can still follow the packet trail from your border routers upstream. I think the main thing we are lacking is just responsibility on the ISP side, if someone reaches out complaining that half of your customers are sending ddos attacks, maybe you need to do something about it. Most of these huge attacks are compromised routers or IoT devices (remember Mirai Botnet?).

esseph
1d ago
1 reply
This is clearly not true, or the CAIDA anti-spoofer project wouldn't exist.

https://spoofer.caida.org/summary.php

Fabricio20
1d ago
Just because SOME ASNs don't have it in place doesn't mean it's not uncommon. In the link provided, 80% of all tracked network blocks for ipv4 are blocking spoofing. Though they only track 1000 ipv4 /24 blocks and their data is highly biased towards having spoofable ranges, considering their end goal is identifying spoofable networks!
toast0
1d ago
The Microsoft blog suggests there was miminal source spoofing (although I don't knnow how they determine that). But if you can't trust the IP source, packet samples from your border router should indicate which upstream is sending those packets ... then you ask them to find the source... eventually you'll get somewhere ... but when the sources are distributed, it's not so helpful to find the source, unless there's a mechanism to stop the source from sending it.

When I was running servers that would routinely attract DDoSed at ~ 10 Gbps, I ended up always running a low sample rate packet capture. Anytime I noticed a DDoS, I could go and look at the packets. If you've got connectivity to sink and measure 15 Tbps of DDoS, you can probably influence your providers to take some sampled packet captures and look at them too.

Even without clear information from packet captures, 15 Tbps is going to make an impact on traffic graphs, and you can figure out sources from those, although it might be a bit tricky because the attack duration was reported at only 40 seconds, so if someone only has hourly stats, it might be too small to be noticed; but once a minute stats are pretty common.

esseph
1d ago
It's not that simple and hasn't been for awhile.

There's layer upon layer of relays now, and meshed C2C networks.

Lots of DNS fastflux too

SirMaster
1d ago
I heard it's a series of tubes.
Y_Y
2d ago
3 replies
The international organisation for stopping wars, human trafficking, money laundering, drug distribution etc. however capable they might be, haven't managed to stamp out any of those things.

I'd say a putative UN NetWatch would suffer from the same issues of funding and corruption and politics, but still we might have something better than this wild west lawlessness.

halapro
1d ago
1 reply
> have something better than this wild west lawlessness.

Careful what you wish for. Before you know it you can't have an IP without your ID.

immibis
1d ago
2 replies
This is already the case in Germany and many other countries.
bak3y
1d ago
1 reply
Yes, surely the German government telling it's people what to do has never gotten them in trouble in the past...
immibis
1d ago
what does any government do besides tell its people what to do, and cause inflation?
fc417fc802
1d ago
If spam calls is the price I have to pay to avoid censorship then I'm okay with that. We need resilient decentralized protocols, not centralized authoritarian bodies.
c0balt
1d ago
> putative UN NetWatch

But who will suppress attempts to go beyond the blackwall then?

mmooss
1d ago
> The international organisation for stopping wars, human trafficking, money laundering, drug distribution etc. however capable they might be, haven't managed to stamp out any of those things.

They've never been expected to "stamp out" those things, any more than a city police department is expected to stamp out all crime and doctors are expected to stamp out all illness. Their mission is to reduce those things:

For warfare, they have been extremely successful relative to human history. War has actually become taboo and illegal, and very few happen. Look at history before the UN - it's a miracle. Think of the vision and confidence of people who, looking at 10,000 years of human history, immediately after two world wars, thought it was even possible, came up with effective strategy, did the hard work, and accomplished it.

I don't know the details of the other fields.

> I'd say a putative UN NetWatch would suffer from the same issues of funding and corruption and politics, but still we might have something better than this wild west lawlessness.

Politics and funding, and corruption, come with every human institution over a certain size, and especially with governments which can't exclude undesireable people: Democratic governments are the least corrupt, but if the people elect a corrupt representative or executive, then nobody can kick them out (unless they commit prosecutable crimes). And now imagine an association or confederation of governments, which is what the UN is.

So yes, the goal is to make something better. Otherwise, we might as well quit on everything.

sva_
1d ago
1 reply
Since this is a distributed attack, I'm not really sure how that enforcement would look like? Am I missing something, are all these bots/zombies easily selectable and blockable?
toast0
1d ago
Investigative powers should be able to at least find and seize the command and control servers, and hopefully track down people operating the command and control servers.

Some sort of international clearing house for ISPs to help identify and sequester compromised customers might be nice, too; but that doesn't need law enforcement powers; and maybe it already exists?

miohtama
1d ago
2 replies
It's national interest of China and Russia to see the West to fail. Why would they co-operate? They are willing to murder people, West and their own, so "law" enforcement means a bit different in international context.
mkoubaa
1d ago
1 reply
It is absolutely not in China's interest to see the West fail. This is propaganda
strangegecko
1d ago
1 reply
China (or at least the CCP, I find the equivocation of the CCP with the country disagreeable) has had the desire or even need to get revenge for their "century of humiliation" for a long time.

They have a fundamentally different government and social model, basically a one person dictatorship that feels the need to micromanage and control their populace.

They absolutely love seeing democracy and businesses associated with it fail because it reinforces their perspective of the CCP model being superior and thus strengthens their perceived legitimacy of CCP control over China.

mkoubaa
1d ago
A rivalry, wanting to score points, wanting to gain standing at the expense of another, are all things that do not have much to do with wanting your opponent to collapse
tw1984
1d ago
1 reply
Typical brainwashed view.

It is China's national interests to see a stable America that can continue to maintain the post WWII world order that benefited China so much for so long. Without the US, who is going to maintain peace in the middle east, Africa and other places? without such peace, how could China export its goods and services?

"West" != America.

Your claim also implies that China and Russia are operating on the same level. That is laughable at best - Russia is a failed rogue state with the economic size comparable only to a Chinese province, it is left behind in ALL modern techs and its military hardware are aging fast. It is the complete opposite of the path took by China.

kjkjadksj
1d ago
The whole sentiment with that is china uptakes the mantle. It already is in terms of infrastructure investments, selling goods and arms, import and export agreements. The same neoliberal playbook that made the US what it is. Only from a much more focused regime with little in the way of internal division or even external threats at this point.
bsder
1d ago
2 replies
If we were all running IPv6, we could just block this crap.

But here we are in 2025 still running IPv4 with CGNAT, so we can't.

kundi
1d ago
1 reply
What difference would it make?
bsder
1d ago
1 reply
You can block the specific offending IPs without collateral damage.

CGNATs reuse IPs so any IP block rule fairly quickly becomes somebody else's IP that you shouldn't be blocking.

If, however, you use IPv6, you don't need CGNAT and, while addresses may change, a blocked address won't suddenly get recycled to an unsuspecting user. In addition, if the allocation is static, you can block the whole network range and the problematic devices can't change their allocation sufficiently to escape the IP block.

mrweasel
1d ago
1 reply
[delayed]
bsder
1d ago
> it would entail blocking 500.000 IPs, or more. That quickly becomes unmanageable as well.

Companies don't seem to have a tough time managing the blocks for all the various ranges of all the VPS providers to prevent you from using VPNs to access their services. Somehow, I don't think blocking 500,000 IPs is a technical problem.

I also suspect that once you start getting effective IP blocking, that 500,000 number will drop quite rapidly as it simply won't be so profitable to commandeer a device.

> What I'd love to see is a service where websites could report abuse to ISPs, who would then take the misbehaving customers offline, until their system or behavior is fixed.

IPv4 CGNAT is part of that problem, too. Because of CGNAT, the offending IPs get "tumbled" and are more difficult to identify from outside the ISP. Consequently, it makes it difficult to punish the ISPs. Without IPv4 CGNAT, those IPs are more stable over time and can be identified outside the ISP boundary. If ISPs start losing customers because everybody in the universe has blocked various ranges, the ISPs will start blocking devices at origin.

throwaway_ab
1d ago
Not sure how this would work, if you blocked those IPv6, the mostly innocent companies and people that are now blocked will be in short order getting a new IPv6 assigned by the ISP after a support call.

I was under the impression that these botnets still rely on vulnerable computers, which have a human that will be calling support asking for the issue to be resolved.

Then it needs an ISP to figure out the issue and ask the client to sort out their compromised computer, but unlikely the ISP will stop a paying customer from internet access especially if it's not clear why their original assigned IPv6 is blocked.

dylan604
1d ago
1 reply
Because every single nation would have to sign on to it allowing said agency to ignore sovereignty of each nation to come in and do their policing.

You'd also need to have every country not actively involved in these types of schemes yet we know some governments are directly benefiting from the scams/theft their citizens are perpetrating.

You'd also need to have every country think the things you want to police against are wrong. Again, we know that's just not true.

jazzyjackson
1d ago
2 replies
How did we (USA) so it with copyright law?
robocat
1d ago
Because there were large corporations using their political clout to make it a number one issue for your administration.

Your administration then made copyright law changes a central goal of many agreements - essentially a non-negotiable requirement for say a trade agreement to proceed.

potwinkle
1d ago
We didn't. The WTO copyright framework is a joke that only goes after sports rebroadcasting and people who watch Disney movies for free. Meanwhile every valuable piece of US science and industry has been replicated on the other side of the planet and used for great success.
victorbjorklund
1d ago
2 replies
do you really think for example America would allow say Chinese prosecutors to arrest Americans on American soil and take them abroad to sentence them in a court that America has no influence over and then throw them in a prison which America doesn’t control?
Aachen
1d ago
1 reply
When the deed is illegal in both places, they can be tried under either jurisdiction and convicted instead of continuing to roam free and fuck up the open web for everyone else. Yes I do think we'd want that

Borders currently get in the way but we needn't have law enforcement on foreign soil to solve that. Exchanging information and reliably acting upon it could be all these agencies need to do in their respective countries. When this proves effective aside from crime states that have no interest in upholding even their own laws (since dual illegality would probably be a prerequisite for any of this), they may eventually find themselves increasingly cut off and distrusted until they, too, cooperate or self-isolate like NK

anonym29
1d ago
1 reply
Bad news, implied criticism of CCP policy (by acknowledging you'd change it) is an imprisonable offense. You're under arrest for violating the laws of China. You are not granted a trial. A joint unit comprised of the Ministry of State Security and the FBI will be at your house to pick you up and fly you to a Chinese black site tomorrow morning.
fragmede
1d ago
That’s the cartoon version of China you’ve been trained to believe. I’m talking about dual illegality and cooperation between states. You’re talking about a fantasy mashup of MSS and FBI black sites. Not the same thing.
discordance
1d ago
1 reply
Who would they take orders from?
unnouinceput
1d ago
from those who pay them. They are a service for hire. you can hire them if you want and have the dough.
Aurornis
1d ago
International DDoS busts and arrests do happen all the time.

Law enforcement takes time. The perpetrators of these attacks aren't hanging out in the open with their full names shielded only by the hope that their country won't extradite for political favor.

By the time the perpetrators are identified and a case is built, getting them charged isn't bottlenecked on the lack of an international agency. Any international law enforcement agency would be beholden to each country's own political wills and ideals, meaning any "teeth" they had would be no more effective than what we currenly have for extraditing people or cooperating with foreign police organizations.

2OEH8eoCRo0
1d ago
What countries do you think these bad actors reside? Russia, China, Iran, and NK will wipe their ass with any law enforcement request.
stackedinserter
1d ago
Who is going to elect and oversee them? I don't want to be governed by China or Russia.
Hikikomori
2d ago
America gonna allow someone else to regulate them?
0xbadcafebee
1d ago
> international law enforcement agency

You mean Team America, World Police?

Besides the fact that not much happens in the international public sector, law enforcement is more about deterrence than prevention. Criminals aren't deterred by law enforcement, so the bad actors never stop. Human nature's a bitch.

If they did focus on prevention instead, most of this could be... prevented. Create a treaty that mandates how critical infrastructure technology is created/sold. Consumer routers will stop being shit at security, and home devices are slowed-down in upstream spamming. That's a good chunk of the denial-of-service market gone, with no need to police the world.

...but the criminals are smart and intentionally avoid attacking the powerful, so nobody cares. Same reason organized crime still exists. It's poor people caught up in gang violence and crime, not rich people, so it persists.

kachapopopow
1d ago
the real reason why these are a problem in the first place is because of cgnat and transit providers not implementing flowspec.

but these bad actors are not possible to track down in the first place since internet is unfortunately decentralized and things as simple as transactions submitted to bitcoin or etherium blockchain can be used as c&c

zipy124
1d ago
Because countries benefit from conducting cyber warfare, the most publicised of are north Korea and Russia which have large state sponsored hacking groups.
morkalork
2d ago
I'm sure you could come up with at least few ideas why it hasn't happened
poszlem
1d ago
Perhaps because, in many cases, the very governments responsible for enforcing it include the bad actors themselves.
mkoubaa
1d ago
Those exist but they might have a different idea of what makes an actor bad than you and I. Just look at what happened to Julian Assange.
mihaaly
1d ago
Legal systems are so convoluted and so colossally heterogenous - also very protective of their ways - around the globe that miniscule collaborations require grandiose efforts to initiate and maintain. No chance these fast paced adversaries will be caught by the interplay of several dozens of reluctant dinosaur legal systems.

Tangential: once I was targeted by a pretty primitive scam. More than 10 years ago (after someone I love was naive and inexperienced, having a medium amount stolen in a sensitive and stressful time of this person's life). I recognised fast and having time and will I sarted to play along, pretending I bite the bait. Collecting info while acting. In parallel trying to connect local and international authorities to report an ongoing scam effort. I believe I tried 4 organizations in 3 different countries apparently involved, I believe one was dedicated to online scams, also trying to warn Western Union, they are about to be used for scam. I even went personally to a police station locally to get some advice on how to assist catching the criminals. Since all I encountered insisted to report my damages, so they could start an investigation on an actual loss happened, I furiously gave up and decided whenever I will be having financial trouble I will invest my efforts in scamming others. No-one cares catching those in act! So the thugs can be incredibly bold and dumb, like the one I encountered, it is no effort doing better.

daedrdev
1d ago
many countries sponsor these attackers
shoddydoordesk
2d ago
5 replies
> it suddenly ballooned in size in April 2025 after its operators breached a TotoLink router firmware update server and infected approximately 100,000 devices

This is scary. Everyone lauds open source projects like OpenWRT but... who is watching their servers?

I imagine you can't run an army of security people on donations and a shoestring budget. Does OpenWRT use digital signing to mitigate this?

sam_lowry_
1d ago
1 reply
This is exactly why OpenWRT has no unattended updates by default )
shoddydoordesk
1d ago
1 reply
You are dismissing the seriousness of this. Their package manager is widely used. One would only need to compromise their build servers to wreak havoc.

Didn't they have a vulnerability in their firmware download tool like a minute ago?

The difference between OpenWRT and Linux distros is the amount of testing and visibility. OpenWRT is loaded on to residential devices and forgotten about, it doesn't have professional sysadmins babysitting it 24/7.

Remember the xz backdoor was only discovered because some autist at Microsoft noticed a microsecond difference in performance testing.

jacobgkau
1d ago
1 reply
I'm confused why you're so honed in on OpenWRT as a third-party open-source project here when the vulnerability you quoted (TotoLink) was the official firmware update server of a brand of devices.

Is it "scary?" If you get scared easily, sure. Is it relevant? Not exactly. Are companies' official servers more secure than an open-source project's servers? In this case, apparently not.

danudey
1d ago
1 reply
What's scary is that OpenWRT is a project created by people who wanted a better solution than what was out there, and are therefore largely driven by a desire to create a good product.

Meanwhile, corporations are driven entirely by profit motive, so as long as it's more expensive to be vigilant about security than it is to be lax about it they will never improve.

Until companies which produce (and do not update) vulnerable equipment are penalized (e.g. charged with criminal negligence) for DDoS attacks using their hardware then the open-source projects are going to continue to be far more trustworthy and less vulnerable than corporations which mass-produce the cheapest hardware they can and then designating it as obsolete and unsupported as fast as possible to force more updates.

AnthonyMouse
1d ago
The disappointing thing is that the companies don't just ship the open source firmware on their devices from the factory. They rarely if ever have any marketable features the open source firmware doesn't -- it's more often the other way around -- and then you don't have a zillion unpatched devices when they decide to stop caring because the community continues to maintain the code.
whatshisface
1d ago
1 reply
As always, hundreds watch the open repositories, maybe one watches a company's build servers, if they're lucky. :-)
TylerE
1d ago
1 reply
Hundreds watch, but how closely?

Plenty of stories of fairly major projects having evil commits snuck in that remain for months.

alphager
1d ago
2 replies
Name a few.
anonymars
1d ago
Shellshock, log4j, heartbleed, that Debian entropy bug--wait, what was I supposed to be remembering again?
immibis
1d ago
2 replies
Digital signing wouldn't defend you from a compromised build server.
mbilker
1d ago
1 reply
What in that act says OpenWrt would be made illegal? If anything, OpenWrt would roll out automated security updates for a supported branched release to comply with these regulations.

Also, if you actually read it, there are exceptions for open source software!

majorchord
1d ago
OP claims almost daily that some benign thing is actually illegal but almost never provides useful proof when asked.

(please prove me wrong, Alex)

pabs3
1d ago
Reproducible Builds and multiple distributed builders would though.

https://reproducible-builds.org/

tempest_
1d ago
2 replies
I don't follow.

> run an army of security people

Do you think these private companies do this? They don't. They pay as little as humanly possible to cover their ass.

Botnets comprised of compromised routers is common and commercial/consumer routers are a far juicer target than openwrt.

bigiain
1d ago
> They pay as little as humanly possible to cover their ass.

They probably spend more on the team who ends up writing the "We take your security very seriously" breach notification message than they do on "security people". At least until then get forced into brand-name external Cyber Security Consultants to "investigate" their breach and work out who they can plausibly blame it on that's not part of the C suite.

Aeolun
1d ago
> They pay as little as humanly possible to cover their ass.

It’s probably helpful that open source teams aren’t hampered by standards and 20 year outdated audit processes either.

nine_k
1d ago
3 replies
Why, OpenWRT firmware and packages are both signed, of course. You can manually and independently check the image signature before flashing an update.

The build infrastructure is, of course, a juicy target: infect the artifact after building but before signing, and pwn millions of boxes before this is detected.

This is why bit-perfect reproducible builds are so important. OpenWRT in particular have that: https://openwrt.org/docs/guide-developer/security#reproducib...

tetha
1d ago
5 replies
Bit-Reproducible infrastructure could also result in some of the wildest build distribution architectures if you think about it. You could publish sources and have people register like in APT mirrors to provide builds, and at the end of the day, the build from the largest bit-equal group is published.

I do see the Tor-Issue - a botnet or a well-supplied malicious actor could just flood it. And if you flip it - if you'd need agreement about the build output, it could also be poisoned with enough nodes to prevent releases for a critical security issue. I agree, I don't solve all supply chain issues in one comment :)

But that in turn could be helped with reputation. Maybe a node needs to supply 6 months of perfect builds - for testing as well - to become eligible. Which would be defeated by patience, but what isn't? It'd just have to be more annoying to breach the distributed build infrastructure than to plant a malicious developer.

This combination of reproducible, deterministic builds, tests across a number of probably-trustworthy sources is quite interesting, as it allows very heavy decentralization. I could just run an old laptop or two here to support. And then come compromise hundreds of these all across the world.

smt88
1d ago
1 reply
[delayed]
cluckindan
1d ago
1 reply
And if someone invests in having >90% of the peers offer a malicious file and serve DHTs matching that file?
smt88
1d ago
1 reply
[delayed]
pabs3
1d ago
1 reply
IIRC BitTorrent still uses SHA-1, which is becoming more problematic.
vhcr
1d ago
BitTorrent v2 uses SHA-256, but in any case SHA-1 is still second-preimage resistant. And the BitTorrent piece hashes are included in the .torrent file, so you would need to find a double collision.
charcircuit
1d ago
>It'd just have to be more annoying to breach the distributed build infrastructure than to plant a malicious developer.

It really wouldn't. You don't even need a powerful build server since you can mirror whatever someone else built. You can also buy / hack nodes of existing trusted people.

pabs3
1d ago
Reproducible isn't quite enough, you also need bootstrap from almost-zero binaries.

https://bootstrappable.org/

HumanOstrich
1d ago
Sounds overly complex and completely unnecessary. Like some kind of blockchain/defi scheme shoehorned onto distributed builds.
nunez
1d ago
> Try building some common pieces of software in a network isolated environment and you will likely be surprised at how poorly it goes.

I have yet to experience a straight shot install or build of anything in an air gapped environment. Always need to hack things to make it work.

contravariant
1d ago
2 replies
This exchange is somewhat hilarious. Oh how on earth do we keep things safe and secure if everyone can see the code and verify what it does! Who would keep us safe if we turn our backs to unverifiable, unvetted, unprofitable security fixes, by for-profit companies!
fc417fc802
1d ago
3 replies
> how on earth do we keep things safe and secure if everyone can see the code and verify what it does!

That's not always the silver bullet you seem to think it is. Have you ever tried to build something like Chromium, Firefox, or LLVM yourself? It's not realistic to do that on a mid tier let alone low end device.

Even when you go to the trouble of getting a local build set up, more often than not the build system immediately attempts to download opaque binary blobs of uncertain provenance. Try building some common pieces of software in a network isolated environment and you will likely be surprised at how poorly it goes.

If projects actually took this stuff seriously then you'd be able to bootstrap from a sectorlisp and pure human readable source code without any binary blobs or network access involved. Instead we have the abomination that is npm.

Karliss
1d ago
LLVM isn't so bad compared to the browsers. Relatively standard CMake build with mostly self contained c++ codebase and few third party dependencies. You don't need a crazy thread ripper system to do a build in reasonable time. A somewhat modern 8-16 core desktop CPU should be able to do it in 10-20 minutes or faster. Based on compilation benchmarks I have seen even some of 15 year old 4 core CPUs or 5year old mid/low tier mobile CPUs do it under hour.

Most importantly you need to pay attention to RAM usage, if necessary reducing parallelism so that it doesn't need to swap.

Etheryte
1d ago
For context, I once found a bug in Chromium and fixed it, the initial build took a few days on and off on my development laptop that was pretty beefy for the time. I say on and off because I had to interrupt the build if I wanted to do anything else computationally taxing. They have incremental builds and caches all properly set up so you can just continue where you left off after the fact. After the initial build it's pretty fast, 5 minutes or so per build for me. On a low end device you're easily looking at a build time of a week or more.
pabs3
1d ago
Debian manages to build Chromium, Firefox, and LLVM on servers of multiple architectures, including quite slow riscv64 machines, without any network access to the builds for any architecture.

https://buildd.debian.org/status/package.php?p=firefox-esr

See Bootstrappable Builds for starting from almost nothing, so far only GNU Guix and StageX have worked out how to start from the BB work to get a full distro. Should be fairly trivial for other distros too if they cared.

https://bootstrappable.org/ https://guix.gnu.org/blog/2023/the-full-source-bootstrap-bui... https://stagex.tools/

teitoklien
1d ago
The biggest joke is most of the proprietary routers both consumer and enterprise grade often are running some old outdated version of custom tuned openwrt lol, this goes for tp-link, and everyone else almost.
elAhmo
1d ago
1 reply
> You can manually and independently check the image signature before flashing an update.

Of course you can. You can also read the ToS before clicking accept, but who does that?

baobun
1d ago
I'm sure there are dozens of us.
dang
2d ago
Related. Others?

Cloudflare scrubs Aisuru botnet from top domains list - https://news.ycombinator.com/item?id=45857836 - Nov 2025 (34 comments)

Aisuru botnet shifts from DDoS to residential proxies - https://news.ycombinator.com/item?id=45741357 - Oct 2025 (59 comments)

DDoS Botnet Aisuru Blankets US ISPs in Record DDoS - https://news.ycombinator.com/item?id=45574393 - Oct 2025 (142 comments)

alpb
2d ago
Funny enough just got an error trying to reach to the blog

        Proxy Error
        The proxy server received an invalid response from an upstream server.
        The proxy server could not handle the request
        Reason: Error reading from remote server

137 more comments available on Hacker News

ID: 45955900Type: storyLast synced: 11/19/2025, 7:14:53 PM

Want the full context?

Jump to the original sources

Read the primary article or dive into the live Hacker News thread when you're ready.