A Botnet Accidentally Destroyed I2P(sambent.com)
76 points byCider99865 hours ago |10 comments
jjmarr4 hours ago
From the main article, I2P has 55,000 computers, the botnet tried to add 700,000 infected routers to I2P to use it as a backup command-and-control system.

https://news.ycombinator.com/item?id=46976825

This, predictably, broke I2P.

infogulch3 hours ago
That's an interesting stress test for I2P. They should try to fix that, the protocol should be resilient to such an event. Even if there are 10x more bad nodes than good nodes (assuming they were noncompliant I2P actors based on that thread) the good nodes should still be able to find each other and continue working. To be fair spam will always be a thorny problem in completely decentralized protocols.
sandworm1012 hours ago
No. They should not try to survive such attacks. The best defense to a temporary attack is often to pull the plug. Better than than potentially expose users. When there are 10x as many bad nodes as good, the base protection of any anonymity network is likely compromised. Shut down, survive, and return once the attacker has moved on.
conradev17 minutes ago
This is why Tor is centralized, so that they can take action like cutting out malicious nodes if needed. It’s decentralized in the sense that anyone can participate by default.
martin-t2 hours ago
Why would an attacker move on if it can maintain a successful DoS attack forever?
xmcp1232 hours ago
Because botnets are mostly there to make money nowadays. Or owned by state actors.

Either way, it’s opportunity cost.

01HNNWZ0MV43FF1 hour ago
Finding good nodes is a thorny problem for human friendship, too!
gnabgib4 hours ago
This seems to lack the full story, despite the headline.. Krebs' coverage is more in-depth (39 points) https://news.ycombinator.com/item?id=46976825
pmontra40 minutes ago
This seems to be a better post about what happened, from the same site https://www.sambent.com/i2p-2-11-0-ships-post-quantum-crypto...
nneonneo19 minutes ago
Those are some weird-ass visualizations. I can only assume they were AI-generated.
KennyBlanken11 minutes ago
I'll save everyone else a click: AI slop text coupled with the strangest, most pointless visualizations I've ever seen.
charcircuit36 minutes ago
>hostile nodes

>they accidentally disrupted I2P while attempting to use the network as backup command-and-control infrastructure

So were they hostile or were they using it normally?

kace914 hours ago
Man, I feel so out of depth with cybersecurity news.

Why does i2p (per the article) expect state sponsored attacks every February? Where are those forming from, what does the regularity achieve?

How come the operators of giant (I’m assuming illegal) botnets are available to voice their train of thought in discord?

WaitWaitWha2 hours ago
> Why does i2p (per the article) expect state sponsored attacks every February?

Because The Invisible Internet Project (I2P) allows government dissidents to communicate without the government oversight. Censorship-resistant, peer-to-peer communication

> Where are those forming from, what does the regularity achieve?

At least PR China, Iran, Oman, Qatar, and Kuwait. censor communication between dissidents.

> How come the operators of giant (I’m assuming illegal) botnets are available to voice their train of thought in discord?

How would you identify someone as 'operators of giant botnets' before they identified themselves as 'operators of giant botnets'?

please read https://en.wikipedia.org/wiki/I2P

margalabargala1 hour ago
Sure, but why February and not the other 11 months?
Zambyte2 hours ago
This answer is missing the key "regularity" part of their questions, which I would love to know more about.
braingravy1 hour ago
That’s a great question… Currently we’re in the main Chinese holiday period with the Lunar New Year/Spring Festival/Chinese New Year, so perhaps people traveling back home from foreign lands might use the service more during this time?
OgsyedIE4 hours ago
Many state bodies involved in adversarial action have dedicated budgets for offensive cyber-warfare, credential thefts, supply chain compromises and disinformation. If they haven't used all of their budget by the end of the budget period, they'll be allocated a smaller budget for the next budget period.
kace913 hours ago
Oh ffs. Whenever I think my opinion on the state of the world can’t get any lower, things somehow manage to get dumber.
bryanrasmussen3 hours ago
I mean this is a common pattern in many large organizations, governmental and non, if you didn't use your budget it means we can save money, yayyyy! I hadn't really considered it would apply to state-backed hacking but makes sense.
hoppp2 hours ago
Isn't I2P java? The botnet uses java? I thought python or C is preferred for that kinda stuff
rippeltippel3 minutes ago
Communication between bots use network protocols, it doesn't matter in which language those protocols are implemented.
mhitza1 hour ago
The official router implementation is Java. i2pd is an alternative written in C++.

Once established communication can transparently be processed through a socks proxy, or integration with SAM or similar https://i2p.net/en/docs/api/samv3/

monero-xmr1 hour ago
Computers are so fast it doesn’t matter
Cider99861 hour ago
The video seems to be a bit more in-depth.
illusive40803 hours ago
Why does Discord allow a server for a botnet owner?
xmcp1232 hours ago
Ever tried to ban a botnet owner from a service they want to use?

It’s basically impossible. They have money, IPs, identities, anything you could possibly want to evade.

bee_rider37 minutes ago
It would be pretty funny if the age verification stuff blocked some of these folks.
charcircuit38 minutes ago
If you just look at the messages in those kinds of discords. It's blatant. They aren't even trying to hide it.
Cider99861 hour ago
They are rich in regard to the tools needed to abuse services haha.
ddtaylor3 hours ago
Discord has a lot of terrible servers. This is one of the reasons they were not trusted when they came out and wanted to do identity verification. They already have a lot of information yet fail to do meaningful enforcement at scale.
chmod7753 hours ago
There's servers where they just hang out, but which themselves are legitimate. Cybersecurity related ones etc. You can ban them and they'll just switch to another account within a minute. Occasionally discord or a server owner does, but everyone knows its pointless. There's probably other servers that are mostly used by cybercriminals, maybe command-and-control backups, and security researchers may stumble upon these when taking some malware apart, join them, and end up getting in contact with the owner.

In general I don't think law enforcement wants discord to take these down or ban them. These guys would have no problem to just make some IRC servers or whatever to hang out on instead, which would be much harder to surveil for law enforcement - compared to discord just forwarding them everything said by those accounts and on those servers.

bawolff2 hours ago
I imagine because banning these things is both whack-a-mole and like finding a needle in a hay stack.
fragmede3 hours ago
botnet owners don't typically come forwards and say they are trying to run a botnet, so there may be some difficulty in detecting them there.
fragmede3 hours ago
botnet owners dying typically come forwards and say they are trying to run a botnet, so there may be some difficulty there.
cookiengineer1 hour ago
This was one of the worst writeups I ever read. Even a LinkedIn Premium post would have had more technical details, lol
richardfey2 hours ago
I wonder how cjdns would have handled this