AlexSSD7
commented
4 years ago How severe it is?
Let's assume that the eth2 network has 5000 validating nodes out there, and the average internet speed worldwide is 11 mbps.
Attack scenario:
To be sure that the node would be DDoS'ed - we will dedicate 22 mbps (2x speed) to each one.
Note that in real world speed would be adjusted for every node by determining the ISP's average speed (is it a home ISP, hosting, business, etc).
DigitalOcean's average droplet speed is 300mbps, so it should be enough to just rent 5000*22/300 = 36 cheapest droplets ($5 a month) to perform a massive attack.
So the total price of a day doing the attack is 36*5/30.5 = $5.90.
Please note that this is just an example. A real world attack would look a bit different.
protolambda
nisdas
prestonvanloon
djrtwo
Description
Prysm nodes are vulnerable to L4 DDoS attacks. The attacker can stop finality for any amount of time.
Attack scenario
There are 4 nodes on this network, and I've rented 4x10 DigitalOcean droplets and started the L4 DoS utility on each of them. It was enough to break the whole network P2P connectivity.
Impact
The nodes were unable to normally communicate with each other. As a result, new nodes were unable to sync, and validators submit their attestations.
Details
Attack period: 2109-2125 epochs
Attack requirements
Attack log
Proofs
How to mitigate?
Prysm nodes should temporarily ban IPs that flood their P2P port with the garbage traffic.
Note:
Lighthouse and teku are likely vulnerable too.