Basecamp was under network attack
gist.github.com
Basecamp was under network attack
1–10 of 194 posts
Re: Basecamp was under network attack
#2Is it just me or are these attacks becomming more and more common? I hope we can get some more details on the attack like the origination of it, type used, and what steps were take to mitigate it. I always use information like this as a learning opportunity :)
Re: Basecamp was under network attack
#3Would CloudFlare help here?
Re: Basecamp was under network attack
#4Although a smaller service, we were in a similar situation a couple of years ago. We assumed it was a competitor because there were not monetary requests, just a massive DDoS via torrents that lasted almost a week. Data center didn't help us in any way... it was crazy. Worst thing is that 90% of customers have no clue what a DDoS is and how hard it is to handle.
Re: Basecamp was under network attack
#5Some great language there: framing it as an attack by criminals (gains sympathy from users), explains in plain-terms what a DDOS is (front door analogy), emphasizes (twice!) that user data is safe, apologizes for the likely downtime, informs people where to get updates.
Probably worth bookmarking this for when you [hopefully never] have to deal with this same situation.
Re: Basecamp was under network attack
#6Would CloudFlare help here?
I've been wondering myself, if CloudFlare helps against DDoS attacks when the page is dynamically generated for each user. For static pages it should help.
Re: Basecamp was under network attack
#7Would CloudFlare help here?
Probably. Mitigating a DDOS (from my understanding) has two important things that need to happen. (1) You need a larger incoming pipe than the data being sent to you. (2) you need to ignore invalid requests so you don't flood your outgoing pipe as well.
Properly ignoring invalid requests can be a challenge, the process of doing so will depend on the type of attack being used. SYN floods can difficult since the src IP is most likely invalid. The attacks we've seen with DNS and NTP amplification are difficult as the attack isn't trying to get your servers to respond, they are just flooding your incoming pipe with data. If they are trying to abuse some page within your application you can more easily mitigate it as you'll know the source IP of the request so it can be blacklisted.
EDIT: a few more details:
SYN flood: http://en.wikipedia.org/wiki/SYN_flood
DNS Amplification: http://blog.cloudflare.com/deep-inside-a-dns-amplification-d...
As for mitigation, while we hear about Cloudflare a lot, AT&T and other large providers can provide DDOS protection for leased lines[0]. Basically what happens, before the data gets to your leased lines, traffic headed to you will go through AT&T's DDOS detection/prevention systems that attempts to filter bad traffic. This type of service would apply more to companies like Linode or possibly the datacenter that they are housed in.
[0] http://www.business.att.com/enterprise/Service/network-secur...
Re: Basecamp was under network attack
#8Would CloudFlare help here?
I've been wondering myself, if CloudFlare helps against DDoS attacks when the page is dynamically generated for each user. For static pages it should help.
If the attack is working by essentially flooding Basecamp's network links until they reach capacity, then yes, it could. CloudFlare could simply filter out malicious traffic and only pass on legit requests to Basecamp.
That's obviously very much dependent on the kind of attack and whether CloudFlare has more network capacity than Basecamp (which I would imagine is highly likely).
Re: Basecamp was under network attack
#9Although a smaller service, we were in a similar situation a couple of years ago. We assumed it was a competitor because there were not monetary requests, just a massive DDoS via torrents that lasted almost a week. Data center didn't help us in any way... it was crazy. Worst thing is that 90% of customers have no clue what a DDoS is and how hard it is to handle.
How is torrents protocol used to DDoS you? I never came across torrents being used as a DDoS. I would appreciate more details on what sort of torrent attack it was, and whether you found any ways of partially neglecting damage.
Re: Basecamp was under network attack
#10Would CloudFlare help here?
I've been wondering myself, if CloudFlare helps against DDoS attacks when the page is dynamically generated for each user. For static pages it should help.
CloudFlare does more than just caching. Even on non-cached pages it can filter and otherwise mitigate traffic that it has identified as malicious.