I'm not familiar with Amazon's content policies, but I couldn't see Amazon wanting this stuff hosted on their servers.
Amazon is fine with it, according to the WSJ.
http://blogs.wsj.com/digits/2010/11/29/wikileaks-using-amazo...
Wikileaks moves to Amazon's cloud to evade massive DDoS
11–20 of 70 posts
Re: Wikileaks moves to Amazon's cloud to evade massive DDoS
#12on ec2? 10 bucks that site is gone by end of this week.
Re: Wikileaks moves to Amazon's cloud to evade massive DDoS
#13This is very interesting. If Wikileaks does in fact become designated a terrorist organization by the US, then it seems Amazon will have to shut them down or run the risk of providing them "material aid". The same would be true of any other cloud provider... are there any sizable cloud providers outside the US?
The overheated rhetoric spewing from some politicians notwithstanding, I can hope that no court of law will be persuaded that there can be a terrorist organization without weapons, indeed without violence of any kind. (Even if Assange has committed some violent crime on his own -- and I am not saying he has -- this is clearly not the purpose of the organization.)
Does the government still need to go through courts when dealing with "terrorists"?
Re: Wikileaks moves to Amazon's cloud to evade massive DDoS
#14Why don't they invest some of the donation money in P2P DNS and start hosting the site as torrent ? Many people would be happy to seed.
Because Bittorrent-powered P2P DNS is a weird buzzword, not yet really existing piece of technology. And, I'd guess, WikiLeaks probably want to publish (primarily) on the mass-accessible Internet, not at some obscure place where nobody except for crypto-geeks could access it.
They could try popularizing Freenet (which is already existing and is a fairly stable technology), but, again, I'd guess they probably have their hands full of other tasks already.
WikiLeaks hosts torrents. For example see the link "Click here to download full site in single archive" at the bottom of http://cablegate.wikileaks.org/. And, I believe, the content is already copied to (and being discussed at) Freenet and other similiar P2P networks.
Re: Wikileaks moves to Amazon's cloud to evade massive DDoS
#15It looks like it's hosted in the US (ec2-184-72-37-90.us-west-1.compute.amazonaws.com). Also, the front end proxy is doing some heavy filtering to weed out the cheap hit-and-run nodes participating in the DDoS but still accepts legitimate browser-based requests (persistent). Notice how a Reset (R) is sent right away on the first try:
08:57:41.211436 IP managed.unixy.net.49467 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: S 1398247905:1398247905(0) win 5840
08:57:41.264403 IP ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http > managed.unixy.net.49467: S 1288073904:1288073904(0) ack 1398247906 win 16384
08:57:41.264424 IP managed.unixy.net.49467 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: . ack 1 win 5840
08:57:41.318642 IP ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http > managed.unixy.net.49467: R 1288073905:1288073905(0) win 16384
The Reset packet sent from the EC2 node to the initiating node is a probe to identified non-existent nodes (spoofed). Notice in the above handshake that the initiating node didn't send a packet-response to the Reset. On the second consecutive attempt though all appears well (because the EC2 node added the initiating node to the ACL).
08:57:42.961708 IP managed.unixy.net.49468 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: S 1394481180:1394481180(0) win 5840
08:57:43.016547 IP ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http > managed.unixy.net.49468: S 1406181195:1406181195(0) ack 1394481181 win 5792 08:57:43.016564 IP managed.unixy.net.49468 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: . ack 1 win 46
08:57:51.100914 IP managed.unixy.net.49468 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: P 1:18(17) ack 1 win 46
08:57:51.180674 IP ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http > managed.unixy.net.49468: . ack 18 win 724 08:57:56.206546 IP managed.unixy.net.49468 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: P 18:39(21) ack 1 win 46
08:57:56.261630 IP ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http > managed.unixy.net.49468: . ack 39 win 724
08:57:56.678942 IP managed.unixy.net.49468 > ec2-184-72-37-90.us-west-1.compute.amazonaws.com.http: P 39:41(2) ack 1 win 46
But I wonder just how long they'll be able to evade the attack.
Regards
Re: Wikileaks moves to Amazon's cloud to evade massive DDoS
#16Shouldn't we really be trying to get to the bottom of who is behind this DDoS attack? If Wikileaks is said to be a terrorist organisation, isn't this an act of war?
Re: Wikileaks moves to Amazon's cloud to evade massive DDoS
#17Shouldn't we really be trying to get to the bottom of who is behind this DDoS attack? If Wikileaks is said to be a terrorist organisation, isn't this an act of war?
I don't understand the logic - why would attacking a terrorist organization be an act of war?
Re: Wikileaks moves to Amazon's cloud to evade massive DDoS
#18This is very interesting. If Wikileaks does in fact become designated a terrorist organization by the US, then it seems Amazon will have to shut them down or run the risk of providing them "material aid". The same would be true of any other cloud provider... are there any sizable cloud providers outside the US?
Cloudsigma is based in Zurich, Switzerland and seems to be fairly big. They should be able to cope with this kind of attack:
Re: Wikileaks moves to Amazon's cloud to evade massive DDoS
#19I am curious who wants to attack Wikileaks and for what purpose. I think it's unlikely this is the USG because of the sheer pointlessness of it, plus the fallout that would occur if it were discovered. The likeliest major player I can think of is China, but I'm not sure I have a reason for that belief other than that they are the bogeyman du jour. An alternate possibility is that this is just some cracker flexing his muscle, or showing a potential client what he can do.
Re: Wikileaks moves to Amazon's cloud to evade massive DDoS
#20It looks like it's hosted in the US (ec2-184-72-37-90.us-west-1.compute.amazonaws.com). Also, the front end proxy is doing some heavy filtering to weed out the cheap hit-and-run nodes participating in the DDoS but still accepts legitimate browser-based requests (persistent). Notice how a Reset (R) is sent right away on the first try: 08:57:41.211436 IP managed.unixy.net.49467 > ec2-184-72-37-90.us-west-1.compute.amaz…
Surviving DoS attacks is not a new problem; I'm sure that Amazon has quite a bit of experience in that area. But thanks for the trace, quite interesting!