Slow Forums: PF Under DDOS Attack

[Andre]

Getting better now, but certainly not like it should. Pages load sometimes like normal, sometimes it looks like 10 seconds.

If you are under attack, then you have enemies, no?

 

[Jimmy Snyder]

It's ok now. I wasn't able to post at all last night. I wrote up what was easily the funniest post I ever made and submitted it, but nothing came of it and now I can't remember what I wrote.

 

[Pengwuino]

It's ok now. I wasn't able to post at all last night. I wrote up what was easily the funniest post I ever made and submitted it, but nothing came of it and now I can't remember what I wrote.

No one's buying it.

 

[caffenta]

No one's buying it.

Oh, I am. The exact thing that happened to Jimmy happened to me. What I wrote was http://www.youtube.com/watch?v=8gpjk_MaCGM" type funny. And now it's gone.

Thanks for making us lose the war, hackers. I hope you're happy.

 

[jwxie]

its 6:15AM here in NY
the speed is getting better.

 

[rhody]

finally got the big boys to help out, let me know if there are changes in performance

Grrr.. I just lost this post after time out, hunt them Greg, show no mercy !

6:22 am EST.

Rhody...

 

[Andre]

Grrr.. I just lost this post after time out, hunt them Greg, show no mercy !

6:22 am EST.

Rhody...

It's a good habit to hit <ctrl A> and <crtl C> (windows) before clicking 'post reply'.

then when disaster strikes <ctrl V> does the trick, unstriking.

 

[lurky]

It's a good habit to hit <ctrl A> and <crtl C> (windows) before clicking 'post reply'.

then when disaster strikes <ctrl V> does the trick, unstriking.

Yeah I do that in a hurry if I notice site problems. I learned this the hard way from another forum, though.

Anyway, from my perspective, the site is not yet back to normal but it is functional.

 

[rhody]

Yeah I do that in a hurry if I notice site problems. I learned this the hard way from another forum, though.

Anyway, from my perspective, the site is not yet back to normal but it is functional.

When posting large posts, I go into gmail, and paste and save it as a draft. Have been burned many times before. I should have known better this am, but because response wasn't bad when getting into post, I assumed, wrongly, that the problem was fixed.
Live and learn I guess.

Rhody...

 

[zorro]

PF has never been this much slow for me. Any page (of PF) rarely loads and it gets stuck on 'waiting for physicsforums.com'

 

[Andre]

A couple of hours ago it seemed much better, on and off that is. Apparantly the cyber attack has been resumed.

 

[Lancelot59]

I guess. It's horribly slow.

 

[G01]

Seriously though, what has this forum ever done to anybody?

 

[Greg Bernhardt]

Seriously though, what has this forum ever done to anybody?

if only it worked that way :) PF is big enough now that it's a target for any reason.

 

[caffenta]

Seriously though, what has this forum ever done to anybody?

Yeah, this is getting ridiculous. What kind of total loser would attack PF?

 

[caffenta]

if only it worked that way :) PF is big enough now that it's a target for any reason.

But what for? Why would a bunch of geeks attack a bunch of nerds? It’s like running a protection racket against bums. What are they going to pay you with? Dirty socks? It makes no sense I tells ya.

 

[Greg Bernhardt]

This has escalated into a very serious attack. I appreciate everyone's patience!

 

[rhody]

This has escalated into a very serious attack. I appreciate everyone's patience!

Until the US gets SERIOUS about forming a task force (Homeland Secuirty, Dept of Commerce, etc...) to identify, and take out these miscreants, this will continue.

People will continue their bad behavior unabated, until a little emotion known as fear takes over. Fear from the example of the newly formed task forces ability to identify, arrest, detain, and deport said troublemakers. Once they (the bad guys) figure out the stakes just got exceedingly high, many, if not most will change their habits. What will remain are the insane, mentally ill and terrorist types. It is in every civilized country's interest to participate, and the US could lead the way. Enough ranting, there, I feel better, well, just a little.

Rhody...

 

[pergradus]

AHHHHHH this is crazy!

Are you sure its really a DOS and not some other server problem? How can you tell the difference?

 

[Greg Bernhardt]

Are you sure its really a DOS and not some other server problem? How can you tell the difference?

http://en.wikipedia.org/wiki/Netstat

 

[ladykrimson]

Did you recently suspend or ban any users?

 

[Greg Bernhardt]

Did you recently suspend or ban any users?

we do every day

 

[ladykrimson]

we do every day

That might be a good place to begin looking for suspects.

 

[nismaratwork]

we were attacked this morning/afternoon. the firewall is still catching up, so things might still be a little slow for a bit

Was this an attack on PF itself, or its bandwidth provider? It seems... odd to attack a forum with a sledgehammer when a knife would do the job (nothing personal).

I'm familiar however, with being hosted by a company that makes the mistake of hosting some IRC channel or network, or a similar target; it gets DDOS'ed, and everyone hosted suffers.

@Ladykrimson: someone would need a botnet ready to do this, and be willing to use it up too. I've been pissed at PF before, but this is... stupid and bizarre.

edit: I'd add... it's not exactly effective, so maybe it's some exceptionally incompetant script kiddy? Who the hell can't DDOS a website anyway? I'm annoyed and disgusted.

 

[rhody]

For what it is worth:

http://www.buzzle.com/articles/free-ddos-detection-and-mitigation-tools-for-linux-servers.html"
By David Foreman
Published: 2/11/2011

From his supplied link:

David Foreman
University Of Pennsylvania graduate in 1985. Self employed real estate investor for 10 years. Now owner of Foreman and Pike Consulting, an Internet Marketing Firm.

Rhody...

P.S. Wouldn't it be cool if traceroute endroute of the responsible party(s) computer(s) were possible and to send them a little PF present of of our own.

 

[Greg Bernhardt]

Was this an attack on PF itself, or its bandwidth provider? It seems... odd to attack a forum with a sledgehammer when a knife would do the job (nothing personal).

I'm familiar however, with being hosted by a company that makes the mistake of hosting some IRC channel or network, or a similar target; it gets DDOS'ed, and everyone hosted suffers.

They are targeting PF's IP addy. We are on a dedicated server.

 

[Greg Bernhardt]

For what it is worth:

http://www.buzzle.com/articles/free-ddos-detection-and-mitigation-tools-for-linux-servers.html"

Thanks rhody. We are doing everything we can on the server and the firewall is blocking everything, but there will still be performance issues as the traffic although blocked, is still hitting the server. We need measures to be taken further up the network chain.

 

[nismaratwork]

They are targeting PF's IP addy. We are on a dedicated server.

Damn it... that's just stupid and cruel.

In my experience, there are limited ways to respond to a DOS attack:

1.) Report to authorities
2.) If you have a set number of attackers, block traffic from those subnets.
3.) Notify people and entities who's computers have been compromised
---- From here, this is speculation, hypothetical, and not an endorsement ----
4.) Compromise the botnet and sniff incoming packets directing the bots
-Backtrace... a putz like this isn't going to be on a decent networks of BNCs
-Leave a message, or disable controller
4.2) Compromise the botnet, use tools from packetstorm security, and turn it on the attacker
5.) Identify. Juno.
6.) If in a country outside of reasonable jurisdiction, identify critical resources affiliated with the botnet owner and attack them.
7.) Compromise the botnet, then shut it down without malicious means (change passwords, update, etc)
7.) Compromise with a worm.

 

[nismaratwork]

Oh, on the off chance that you don't take a militant route:

http://www.broadbandreports.com/shownews/93820

http://www.networkworld.com/community/node/42289

The first I think especially useful for such a large community of cooperative people.

 

[mugaliens]

But what for? Why would a bunch of geeks attack a bunch of nerds? It’s like running a protection racket against bums. What are they going to pay you with? Dirty socks? It makes no sense I tells ya.

Apparently, these particular geeks don't appreciate open platform discussions about some things.

Greg, have you contacted the FBI, or the RCMP? Don't know whether your server is in the U.S. or Canada. Regardless, any sustained attack like this violates some key U.S. laws of the kind the FBI takes interest. I'm also aware of certain edge (as in U.S. electronic border) tracking stations which record anything bound for any IP in the U.S. If it's routed, it can be tracked back to at least the station immediately prior. On the other hand, if it's a DDoS attack originating from virii/trojans/worms within the U.S., a call to Symantec and a couple other leading antivirus manufacturers might prove helpful. Might be helpful if it's a DDoS from the outside, as well.