Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Basecamp was under network attack

gist.github.com

Post reply on HN
Print view View original

151–160 of 194 posts

Re: Basecamp was under network attack

#151

Post by Danieru »

JeremyBanks wrote: post #143
Danieru wrote: post #41

Earlier quoted context omitted.

A malicious tracker, or a peer if using DHT, can claim an IP, the victim, is active in the swarm and has valuable bits of the torrent. Then torrent clients will try to connect to the victim. The attack is pretty clever, being indirect it is hard to trace and because bittorrent allows arbitrary ports you can hit a specific ip & port pair. The one downside is the victims can be sure it is a bittorrent DDOS by checking…

or a peer if using DHT Please confirm my understanding: this would be by inserting yourself into the DHT with an address near/equal to a target high-volume torrent, so that you're frequently queried by clients looking for peers? If so, I guess it could be possible in some cases to identify the peers who initiated the attack. The non-malicious peers attempting to make BitTorrent connections to your server will provide…

It sounds like you have a better understanding of DHT than me and tt sounds like DHT isn't vulnerable like traditional tracker. My knowledge of the attack method is served to what I read in a research paper 2 years back.

Re: Basecamp was under network attack

#152

Post by joevandyk »

belorn wrote: post #37
Karunamon wrote: post #35

Earlier quoted context omitted.

Rhetoric? You've got people who just attempted to blackmail you and then take your service offline when you refuse. The descriptive term "criminal", i.e. one who breaks laws, is perfectly valid IMO.

While I agree, the term blackmailer or extortionist would had been better.

Not all blackmail is a crime.

I blackmail my kids all the time... ("Wash your hands after using the bathroom or you will put 25 cents in this jar")

Re: Basecamp was under network attack

#154

Post by devicenull »

jackgavigan wrote: post #146
devicenull wrote: post #114

Earlier quoted context omitted.

http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb... > As I noted in a talk I gave last summer with Lance James at the Black Hat security conference in Las Vegas, a funny thing happens when you decide to operate a DDoS-for-hire Web service: Your service becomes the target of attacks from competing DDoS-for-hire services. Hence, a majority of these services have chosen to avail themselves of Cloudflare’s fr…

CloudFlare's CEO, Matthew Prince, has made his stance on this matter very clear: CloudFlare is firm in our belief that our role is not that of Internet censor. There are tens of thousands of websites currently using CloudFlare's network. Some of them contain information I find troubling. Such is the nature of a free and open network and, as an organization that aims to make the whole Internet faster and safer, such i…

Well, do you believe that suppressing someone else's right to free speech is still free speech?

Information isn't really the question here. These aren't sites telling people how to conduct DDOS attacks, these are sites where you pay them, and they run a DDOS for you. This effectively silences someone until they either give up on their message, or sign up for expensive DDOS mitigation packages (or Cloudflare).

You may consider that to be free speech. I don't.

Re: Basecamp was under network attack

#155

Post by akassover »

akassover wrote: post #64

We got hit by a DDoS about a year ago. Rackspace (who normally has amazing support) quietly null routed us and went about their day. No heads-up, trouble ticket, or any other form of notification. They didn't even put a note in our account so when we contacted their support to figure out why our servers were unresponsive outside their network the poor guy who answered the phone was just as confused as I was. We've ta…

It's worth adding that when we got hit, we were relying on "security through obscurity". I slept well at night because I thought nobody would be interested in DDoS'ing little ol' us when there are plenty of big fish out there to go after.

I'm sure a few of you out there are readying this thinking "too bad for Basecamp, but this will never happen to us because we aren't an interesting target." That's what we thought too...

Re: Basecamp was under network attack

#156

Post by PeterisP »

filet wrote: post #129

I've had really negative experience with these type of criminals. I was hired as a CEO at an company ($200m+ revenue) and we were hit by this type of attack. Every second of being down cost us literally $10k, so we quickly negotiated with criminals for $5k one time payment and they stopped the attack. Unfortunataly a few weeks later we were hit by 3 new attacks. Apparently the word had spread and these new attackers…

That's a good reason why it's never a good idea to pay for DDOS threats - in many other popular extortion scenarios such as kidnapping, blackmail w. secret info or mafia 'protection money' for storefronts, the deal generally doesn't allow other, new attackers to make the same demands, so you actually are getting some protection - but here it does simply mark you as vulnerable.

Re: Basecamp was under network attack

#157

Post by xxdesmus »

kalleboo wrote: post #25
singlow wrote: post #10

Earlier quoted context omitted.

CloudFlare does more than just caching. Even on non-cached pages it can filter and otherwise mitigate traffic that it has identified as malicious.

Correct, many times I've had to fill out a captcha to load a CloudFlare-protected page.

The sensitivity/frequency by which the captcha challenge page gets displayed is dependent on the security settings selected by the website owner.

Re: Basecamp was under network attack

#158

Post by xxdesmus »

bybjorn wrote: post #98
devicenull wrote: post #92

Earlier quoted context omitted.

I personally wouldn't do any business with cloudflare, while they're still hosting the various booter sites where you can pay to run these attacks.

CloudFlare is hosting booter sites?

CloudFlare does not host any website or it's content actually. They are not a web hosting service.

Re: Basecamp was under network attack

#159

Post by PeterisP »

grey-area wrote: post #130
devicenull wrote: post #114

Earlier quoted context omitted.

http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb... > As I noted in a talk I gave last summer with Lance James at the Black Hat security conference in Las Vegas, a funny thing happens when you decide to operate a DDoS-for-hire Web service: Your service becomes the target of attacks from competing DDoS-for-hire services. Hence, a majority of these services have chosen to avail themselves of Cloudflare’s fr…

I could post more, but why bother? The krebs story was interesting thanks, the forum posts less so. I understand why cloudflare are reluctant to start rejecting customers based on content, but surely it's illegal to sell DDOS services? Perhaps they should change their TOS to exclude any sites which sell attack tools/services, because it looks really bad for them to be protecting sites that promote DDOS, which then pr…

Sell service of running a DDoS for you? Probably illegal.

Selling attack tools, however, is explicitly legal in most places, it's just software just as a port-scanning tool, DeCSS or zero-day vulnerability data.

"Promoting this sort of activity" again is free speech issue, no matter what "that sort" is. For example, there are posts right here in HN that "promote this sort of activity", and it would be ridiculous if having such content is even close to allowing someone to take down a server.

In short, unless the actual site is performing illegal activities (implementing the DDoS or uploading childporn&stuff), I'd say that they're correct in explicitly ignoring whatever else the site is doing.

Re: Basecamp was under network attack

#160

Post by elwell »

swanson wrote: post #5

Some great language there: framing it as an attack by criminals (gains sympathy from users), explains in plain-terms what a DDOS is (front door analogy), emphasizes (twice!) that user data is safe, apologizes for the likely downtime, informs people where to get updates. Probably worth bookmarking this for when you [hopefully never] have to deal with this same situation.

Actually, I see the word 'attack' as an emotional trigger and maybe not ideal. I much preferred their analogy that assures non-technical users (on github???) and makes sense:

> This is like a bunch of people blocking the front door and not letting you into your house. The contents of your house are safe -- you just can’t get in until they get out of the way.

Post reply on HN