Another DDoS attack on the site, Just in time for the new year Options

[SirAndy]

We were the target of yet another DDoS attack over the past few days.
https://en.wikipedia.org/wiki/Denial-of-service_attack

The attacker(s) managed to bring the server down by draining it of all resources. I've been working with our hosting company on a more permanent solution since this has become a somewhat frequent occurrence.
(IMG:style_emoticons/default/dry.gif)


Please let me know if there are any problems with the site, errors or other things not working properly.
(IMG:style_emoticons/default/beerchug.gif)

[nathanxnathan]

With all the hacker issues 914world has had over the years, I've often wondered why it's still "not secure" like it won't load as https:, and says not secure in my browser. -no ssl certificate.

I'm not sure if that would help this specific kind of attack.

One thing it does cause that seems odd is when Chrome browser puts it up on the homepage of frequently viewed sites, it won't click through because it defaults to https and https://www.914world.com oddly doesn't go to the site - it doesn't even redirect.

[SirAndy]

With all the hacker issues 914world has had over the years, I've often wondered why it's still "not secure" like it won't load as https:, and says not secure in my browser. -no ssl certificate.

I'm not sure if that would help this specific kind of attack.

One thing it does cause that seems odd is when Chrome browser puts it up on the homepage of frequently viewed sites, it won't click through because it defaults to https and https://www.914world.com oddly doesn't go to the site - it doesn't even redirect.

HTTPS does not make the site any more "secure", all it means is that the data is encrypted on the way from the site to your computer.

And since we're not dealing with sensitive information, unlike your bank for example, i don't see any reason to pay for a SSL certificate.

It literally does *nothing* to make the site less vulnerable to any of these attacks.
(IMG:style_emoticons/default/shades.gif)

[emerygt350]

With all the hacker issues 914world has had over the years, I've often wondered why it's still "not secure" like it won't load as https:, and says not secure in my browser. -no ssl certificate.

I'm not sure if that would help this specific kind of attack.

One thing it does cause that seems odd is when Chrome browser puts it up on the homepage of frequently viewed sites, it won't click through because it defaults to https and https://www.914world.com oddly doesn't go to the site - it doesn't even redirect.

HTTPS does not make the site any more "secure", all it means is that the data is encrypted on the way from the site to your computer.

And since we're not dealing with sensitive information, unlike your bank for example, i don't see any reason to pay for a SSL certificate.

It literally does *nothing* to make the site less vulnerable to any of these attacks.
(IMG:style_emoticons/default/shades.gif)

My college got hit yesterday and this morning as well. They ended up blocking several countries in order to stop it.

After 24 years I finally updated my servers to ssl last week, solely because many browsers do their best to not allow you to see old http no matter how non-sensitive the content. I get free certificates from the EFF and use the certbot to update the ssl certs automatically. I was surprised at how easy it all was. Pretty much four lines of instructions and that was done. This was on linux and apache2.

As far as the bad guys... I use a perl script to watch requests in the auth_log and when I cared the access.log for apache2. Somebody asks for something stupid I would block them from all ports in iptables. I don't really care about idiots on the webserver so I don't bother with it now but if they try to log in on ssh I block them from everything.

Even that won't protect you from ddos of course but at least it makes me feel good. I free them after a few days to keep the iptables sane.

[SirAndy]

... Somebody asks for something stupid I would block them from all ports in iptables ...

The problem with the IP based approach is that they have hundreds of thousands of different computers at their disposal. Each one having a different source IP. And that's before taking IP spoofing into account.

For example, last nights attack came from about 280,000 unique IPs.
Not sure your iptable would be able to handle that.

I've given up on IP based rejection or filtering a long time ago and moved on to other measures.

The one last night did catch me by surprise though as they have been changing their tactics lately.
(IMG:style_emoticons/default/shades.gif)

[Shivers]

... Somebody asks for something stupid I would block them from all ports in iptables ...

The problem with the IP based approach is that they have hundreds of thousands of different computers at their disposal. Each one having a different source IP. And that's before taking IP spoofing into account.

For example, last nights attack came from about 280,000 unique IPs.
Not sure your iptable would be able to handle that.

I've given up on IP based rejection or filtering a long time ago and moved on to other measures.

The one last night did catch me by surprise though as they have been changing their tactics lately.
(IMG:style_emoticons/default/shades.gif)

This may be a silly question Andy, but why would they do this to you? Because they can?

[SirAndy]

This may be a silly question Andy, but why would they do this to you? Because they can?

Answered above:
http://www.914world.com/bbs2/index.php?s=&...t&p=3191875
(IMG:style_emoticons/default/bye1.gif)