Another DDoS attack on the site, Just in time for the new year Options

[SirAndy]

We were the target of yet another DDoS attack over the past few days.
https://en.wikipedia.org/wiki/Denial-of-service_attack

The attacker(s) managed to bring the server down by draining it of all resources. I've been working with our hosting company on a more permanent solution since this has become a somewhat frequent occurrence.
(IMG:style_emoticons/default/dry.gif)


Please let me know if there are any problems with the site, errors or other things not working properly.
(IMG:style_emoticons/default/beerchug.gif)

[nathanxnathan]

With all the hacker issues 914world has had over the years, I've often wondered why it's still "not secure" like it won't load as https:, and says not secure in my browser. -no ssl certificate.

I'm not sure if that would help this specific kind of attack.

One thing it does cause that seems odd is when Chrome browser puts it up on the homepage of frequently viewed sites, it won't click through because it defaults to https and https://www.914world.com oddly doesn't go to the site - it doesn't even redirect.

[SirAndy]

With all the hacker issues 914world has had over the years, I've often wondered why it's still "not secure" like it won't load as https:, and says not secure in my browser. -no ssl certificate.

I'm not sure if that would help this specific kind of attack.

One thing it does cause that seems odd is when Chrome browser puts it up on the homepage of frequently viewed sites, it won't click through because it defaults to https and https://www.914world.com oddly doesn't go to the site - it doesn't even redirect.

HTTPS does not make the site any more "secure", all it means is that the data is encrypted on the way from the site to your computer.

And since we're not dealing with sensitive information, unlike your bank for example, i don't see any reason to pay for a SSL certificate.

It literally does *nothing* to make the site less vulnerable to any of these attacks.
(IMG:style_emoticons/default/shades.gif)

[emerygt350]

With all the hacker issues 914world has had over the years, I've often wondered why it's still "not secure" like it won't load as https:, and says not secure in my browser. -no ssl certificate.

I'm not sure if that would help this specific kind of attack.

One thing it does cause that seems odd is when Chrome browser puts it up on the homepage of frequently viewed sites, it won't click through because it defaults to https and https://www.914world.com oddly doesn't go to the site - it doesn't even redirect.

HTTPS does not make the site any more "secure", all it means is that the data is encrypted on the way from the site to your computer.

And since we're not dealing with sensitive information, unlike your bank for example, i don't see any reason to pay for a SSL certificate.

It literally does *nothing* to make the site less vulnerable to any of these attacks.
(IMG:style_emoticons/default/shades.gif)

My college got hit yesterday and this morning as well. They ended up blocking several countries in order to stop it.

After 24 years I finally updated my servers to ssl last week, solely because many browsers do their best to not allow you to see old http no matter how non-sensitive the content. I get free certificates from the EFF and use the certbot to update the ssl certs automatically. I was surprised at how easy it all was. Pretty much four lines of instructions and that was done. This was on linux and apache2.

As far as the bad guys... I use a perl script to watch requests in the auth_log and when I cared the access.log for apache2. Somebody asks for something stupid I would block them from all ports in iptables. I don't really care about idiots on the webserver so I don't bother with it now but if they try to log in on ssh I block them from everything.

Even that won't protect you from ddos of course but at least it makes me feel good. I free them after a few days to keep the iptables sane.

[ClayPerrine]

With all the hacker issues 914world has had over the years, I've often wondered why it's still "not secure" like it won't load as https:, and says not secure in my browser. -no ssl certificate.

I'm not sure if that would help this specific kind of attack.

One thing it does cause that seems odd is when Chrome browser puts it up on the homepage of frequently viewed sites, it won't click through because it defaults to https and https://www.914world.com oddly doesn't go to the site - it doesn't even redirect.

HTTPS does not make the site any more "secure", all it means is that the data is encrypted on the way from the site to your computer.

And since we're not dealing with sensitive information, unlike your bank for example, i don't see any reason to pay for a SSL certificate.

It literally does *nothing* to make the site less vulnerable to any of these attacks.
(IMG:style_emoticons/default/shades.gif)

My college got hit yesterday and this morning as well. They ended up blocking several countries in order to stop it.

After 24 years I finally updated my servers to ssl last week, solely because many browsers do their best to not allow you to see old http no matter how non-sensitive the content. I get free certificates from the EFF and use the certbot to update the ssl automatically. I was surprised at how easy it all was. Pretty much four lines of instructions and that was done. This was on linux and apache2.

As far as the bad guys... I use a perl script to watch requests in the auth_log and when I cared the access.log for apache2. Somebody asks for something stupid I would block them from all ports in iptables. I don't really care about idiots on the webserver so I don't bother with it now but if they try to log in on ssh I block them from everything.

Even that won't protect you from ddos of course but at least it makes me feel good. I free them after a few days to keep the iptables sane.

I actually prefer to firewall off the outside world, only allowing HTTP and HTTPS to the server. Then forcibly redirect the HTTP to HTTPS. Any SSH access comes in from the internal network.