121–130 of 194 posts
Earlier quoted context omitted.
Claiming it was against the terms might be an easy out for them but is silly since being a target is outside of your control, for the most part. Hosts will usually null route customers without sympathy to protect other customers so it's the price of doing business.
It makes a DDoS an even better extortion. "Pay up or we'll get you kicked from your hosting provider."
A speculative thought: Apart from being distributed, the insidious power of DDoS appears to lie in "subscriber-calling-server". Why not go the other way around? At least only for specific subscription services, not general purpose web access. The situation of a DDoS attack is first communicated by the web service provider texting a subscriber, who texts back their present IP address. The web service provider then "ca…
Is there something like cloudfare but more aggressive? Like something that tries to find exploits on the machines used in the attack and try to shut them down, close their internet connection or inject a self-targeting DNS or something of the sort?
I'd imagine any business providing that is likely to get shut down pretty sharpish...
I wonder if there will be a day where on-premise solutions will be touted as the solution to the DDoS vulnerability of cloud-based solutions, in much the same way that there seems to be an ebb and flow between fat and thin clients over the course of computing history.
Because on-premise solutions are even more vulnerable to DDoS. A large data centre will have large amounts of connectivity, giving you a lot of head room for most types of attacks. But in this case 20Gbps of extra traffic was too much too. What on-premise solution can handle 20Gbps of extra traffic? And I don't think Basecamp is technically "cloud", but collocated. They appear to own most or all of their servers.
Earlier quoted context omitted.
They use "criminals" 5 times in that short statement. IMO the overuse of emotive language is unnecessary and belies the emotional state of the author. Stay professional and detached—it's a DDoS, I've no doubt it's frustrating but they happen. I prefer Github's recent response [0], clear and helpful but without the rhetoric. [0] https://github.com/blog/1796-denial-of-service-attacks
It is criminal behaviour. It reinforces to clients that the attack is not legal, and that they are not to be tolerated. (and as a message to the DDOSer - they're likely to be reading this too and reminding them it is criminal and law enforcement is involved might make them reconsider the attack)
A perfect time for those affected to test drive BaseCamp's competitor https://www.teamwork.com/
Is there something like cloudfare but more aggressive? Like something that tries to find exploits on the machines used in the attack and try to shut them down, close their internet connection or inject a self-targeting DNS or something of the sort?
Some great language there: framing it as an attack by criminals (gains sympathy from users), explains in plain-terms what a DDOS is (front door analogy), emphasizes (twice!) that user data is safe, apologizes for the likely downtime, informs people where to get updates. Probably worth bookmarking this for when you [hopefully never] have to deal with this same situation.
I'm going to play devil's advocate and completely disagree with you here :) Customers, especially non-technical ones, don't give a crap. What they want to know is when the service will be back up, and what steps you're taking to prevent it happening in the future, although I'm sure a certain percentage would be interested in why this is happening in the first place (not as in the technical breakdown, but why you didn…
Basecamp is actually the name of the company now, they aren't 37Signals anymore.
I was hired as a CEO at an company ($200m+ revenue) and we were hit by this type of attack.
Every second of being down cost us literally $10k, so we quickly negotiated with criminals for $5k one time payment and they stopped the attack.
Unfortunataly a few weeks later we were hit by 3 new attacks. Apparently the word had spread and these new attackers demanding $50k.
We were not going to pay $50k but I was also unable to stop the attacks. I was let go a few days later as we had a down time of 2 days and I wasn't able to fix this problem.
Crap.
Earlier quoted context omitted.
If you're going to make accusations like that, you should really back it up with extensive proof.
http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb... > As I noted in a talk I gave last summer with Lance James at the Black Hat security conference in Las Vegas, a funny thing happens when you decide to operate a DDoS-for-hire Web service: Your service becomes the target of attacks from competing DDoS-for-hire services. Hence, a majority of these services have chosen to avail themselves of Cloudflare’s fr…
The krebs story was interesting thanks, the forum posts less so. I understand why cloudflare are reluctant to start rejecting customers based on content, but surely it's illegal to sell DDOS services? Perhaps they should change their TOS to exclude any sites which sell attack tools/services, because it looks really bad for them to be protecting sites that promote DDOS, which then provides them with repeat business.
Are there still sites up protected by cloudflare which promote this sort of activity?