DDoS defences spiked by CloudPiercer tool - paper

A problem solved with a simple firewall rule?

Since the majority of origin sites are hosted in the cloud anyway these days, incoming bandwidth is unlikely to be a problem. A simple firewall rule allowing access only from the Cloudfare or whatever entry point servers should solve any issues.

I would have thought most competent sysadmins would have put that in place at the time they switched over to Cloudflare/whatever anyway.

Yet another example of 'researchers' who don't have real jobs publishing information that will damage those that do have real jobs.

And yes, 'security through obscurity' is a valid concept, some 'baddies' may know it but now everyone does!

not quite accurate

"Cloud security providers alter the DNS settings of a domain name to reroute distributed denial of service attack traffic through their infrastructure"

At least for the Incapsula service you have to make your own DNS changes. And as you can guess, this means all traffic for those DNS names passes through their infrastructure.

One way to find out who Incapsula's clients are is to examine the certificate you get. All of their clients' domains are listed in the subjectAltName field.

Perhaps when we all go to IPV6, if it ever happens, and IPV4 is turned off, everyone will get their own permanent IP address. Perhaps largely killing the anonymity required for ddos?

I read the PDF paper and looked at the terms of service on their cloudpiercer.org site. In my opinion, they forgot something important. They should state in these terms that their service does not welcome, nor will it protect, any domain owner whose domain promotes criminal activity. CloudFlare, for example, is full of such domains -- domains that recruit for ISIS, domains that sell stolen credit-card information, and domains that accept payment for launching denial-of-service attacks. They gave my site crimeflare.com a footnote in that PDF, so they are already aware of this situation.