(07-06-2015 03:14 PM)VA49er Wrote:  Why the hell would anyone attack this site? Just a random attack?

Automated password attacks to steal accounts and post spam, and use stolen account info at places more valuable (some people will use the same credentials here that they would at their bank, laughably).

The Cold War never really ended.

I firewall ****-canned about 3-5 million ip addresses in various blocks in 4 countries. That seems to have got it.

(07-06-2015 03:20 PM)georgia_tech_swagger Wrote:  I firewall ****-canned about 3-5 million ip addresses in various blocks in 4 countries. That seems to have got it.

Thanks!!

(07-06-2015 03:11 PM)georgia_tech_swagger Wrote:  And Russia too. Joy.

I encountered CryptoWall recently, and traced the traffic back to Russia and Monaco. Nuke Russia now!

Fortunately, I had good backups.

Went ahead and setup email and text alerts in my monitoring software. I think this graph says nicely the nature of what happened with the DDOS flood:

Love the last gasp spike at the end.... as I start filtering out entire /12 blocks of IPv4 traffic ... they fail over to Amazon EC2 before I crush that too.

(07-06-2015 02:50 PM)moe24 Wrote:  Al Gore didn't build big enough tubes.

That's what Tipper said ...................

Holy ****

How does one go about blocking 3.5 million IPs?

(07-06-2015 07:08 PM)john01992 Wrote:  How does one go about blocking 3.5 million IPs?

https://en.wikipedia.org/wiki/IPv4_subnetting_reference

https://en.wikipedia.org/wiki/Iptables

https://en.wikipedia.org/wiki/Linux

(07-06-2015 07:08 PM)john01992 Wrote:  How does one go about blocking 3.5 million IPs?

Damn he forgot one

I think it all depends on the board format.. I know how I'd do it, but I'm not as tech savy as some of the mods here, so they may have an easier way of doing it. I know I've spent hours doing it on another board.

Why would somebody do something like this?

(07-06-2015 10:56 PM)HeartOfDixie Wrote:  Why would somebody do something like this?

I suspect the goal wasn't to DDOS the site, but it was more likely trying to get admin or high post count user accounts by trying common passwords over and over as fast as possible. If they get into an admin account, they can deface the entire site with advertising. If they simply get a high post count account they can change the signature to some advertising and start posting like mad. And any accounts they get into, they can try the same email and password at popular banking sites.

It's like spam. It cost nearly nothing to do. All you need to do is hit pay dirt once every 1,000,000 attempts and you make a tidy profit.

(07-06-2015 11:35 PM)georgia_tech_swagger Wrote:  

(07-06-2015 10:56 PM)HeartOfDixie Wrote:  Why would somebody do something like this?

I suspect the goal wasn't to DDOS the site, but it was more likely trying to get admin or high post count user accounts by trying common passwords over and over as fast as possible. If they get into an admin account, they can deface the entire site with advertising. If they simply get a high post count account they can change the signature to some advertising and start posting like mad. And any accounts they get into, they can try the same email and password at popular banking sites.

It's like spam. It cost nearly nothing to do. All you need to do is hit pay dirt once every 1,000,000 attempts and you make a tidy profit.

the war of the future......I'm glad you are amongst the ones that have ability.....

(07-06-2015 11:35 PM)georgia_tech_swagger Wrote:  

(07-06-2015 10:56 PM)HeartOfDixie Wrote:  Why would somebody do something like this?

I suspect the goal wasn't to DDOS the site, but it was more likely trying to get admin or high post count user accounts by trying common passwords over and over as fast as possible. If they get into an admin account, they can deface the entire site with advertising. If they simply get a high post count account they can change the signature to some advertising and start posting like mad. And any accounts they get into, they can try the same email and password at popular banking sites.

It's like spam. It cost nearly nothing to do. All you need to do is hit pay dirt once every 1,000,000 attempts and you make a tidy profit.

Dang, that's pretty amazing.

I had no idea.

So this is where it came from? One of my laptops got totally attacked with adware. Google finally caught it and shut it down for me. Took me 3 or 4 days to stop it.

(07-08-2015 11:07 AM)Fitbud Wrote:  So this is where it came from? One of my laptops got totally attacked with adware. Google finally caught it and shut it down for me. Took me 3 or 4 days to stop it.

No. Nothing malicious was put on the site that could have infected your computer. Our server was attacked, not your computer.

(07-08-2015 03:30 PM)georgia_tech_swagger Wrote:  

(07-08-2015 11:07 AM)Fitbud Wrote:  So this is where it came from? One of my laptops got totally attacked with adware. Google finally caught it and shut it down for me. Took me 3 or 4 days to stop it.

No. Nothing malicious was put on the site that could have infected your computer. Our server was attacked, not your computer.

Perhaps you are right. You haven't recently gone to streaming commercial ads have you? Because I get one every time I visit I get one and after that, I can't get rid of them no matter where I go.

(07-08-2015 05:09 PM)Fitbud Wrote:  

(07-08-2015 03:30 PM)georgia_tech_swagger Wrote:  

(07-08-2015 11:07 AM)Fitbud Wrote:  So this is where it came from? One of my laptops got totally attacked with adware. Google finally caught it and shut it down for me. Took me 3 or 4 days to stop it.

No. Nothing malicious was put on the site that could have infected your computer. Our server was attacked, not your computer.

Perhaps you are right. You haven't recently gone to streaming commercial ads have you? Because I get one every time I visit I get one and after that, I can't get rid of them no matter where I go.

No, we never have. Your computer has malware in it.