CEO and Khmer440 BLACKOUT!

johnnyj · Post by **johnnyj** » Wed Nov 19, 2014 3:43 am

OrangeDragon wrote:TO protect us from hacking/DDoS attempts our ISP shut us down for 3 hours. And then again. I have put in some countermeasures that will hopefully stop the attack from reaching us again... we will see.

Did they confirm it was a combined attack (hack/DDOS)?
there are some pretty clever anti-DDOS measures that can be taken at a layer 2 level, however sometimes shutting the site down is the only resort... which sort of achieves the goal of a DDOS anyway...

Any ideas on where the traffic was coming from?

YouTube · Post by **General Mackevili** » Wed Nov 19, 2014 3:46 am

That ssd scary! I'm still shook up, LoL.

YouTube · Post by **General Mackevili** » Wed Nov 19, 2014 3:47 am

johnnyj wrote:
Any ideas on where the traffic was coming from?

Please don't be from Saudi, please don't be from Saudi......

YouTube · Post by **General Mackevili** » Wed Nov 19, 2014 3:51 am

And very well done, OD!

EdinWigan · Post by **EdinWigan** » Wed Nov 19, 2014 3:51 am

I am also wondering if this event and the vicious and deliberate attack on my avatar are connected.

The attack on Cambodia's two top forums and my avatar, could be seen as attacking three of the four cornerstones of ex-pat culture in the region.

Can we expect an imminent attack on Vlads - Pun-store next? This would complete the most callous assault on our way of life.

Is there any hope for the walls of Babylon ?

I tremble with anticipation

YouTube · Post by **General Mackevili** » Wed Nov 19, 2014 3:55 am

EdinWigan wrote:
The attack on Cambodia's two top forums and my avatar, could be seen as attacking three of the four cornerstones of ex-pat culture in the region.

Haha! Now this is even ten times more worrying! Ed, I think you need to post a list of anyone you've had disagreements with over the past 2 years. Potty will weed them out, one by one.

This is bigger than I had originally thought.

I think your avatar was the main target, and the sites going down were just collateral damage.

OrangeDragon · Post by **OrangeDragon** » Wed Nov 19, 2014 3:56 am

johnnyj wrote:
OrangeDragon wrote:TO protect us from hacking/DDoS attempts our ISP shut us down for 3 hours. And then again. I have put in some countermeasures that will hopefully stop the attack from reaching us again... we will see.

Did they confirm it was a combined attack (hack/DDOS)?
there are some pretty clever anti-DDOS measures that can be taken at a layer 2 level, however sometimes shutting the site down is the only resort... which sort of achieves the goal of a DDOS anyway...

Any ideas on where the traffic was coming from?

not positive it was aimed at us both.. but that would be a shaky coincidence if it weren't. it was for sure a DDoS attack on our side, and I've now added another layer of protection at the DNS level, and will be continuing to tune my countermeasures through the day. Biggest hit was timing... they hit while i was asleep and couldn't react quickly.

and a site shutdown is only one minor impact/goal of a DDoS. They can also be used to launch man in the middle attacks, which are much much worse and can cause a server security breach. i'd rather the site shut down than some hackers gain access to it for sure.

downloading all of my logs now, and i'm going to toss them all into Splunk to review and search for patterns on. With any luck Scoby will send me the ones from 440 as well so I can do a full analysis. Depends on how cooperative they're feeling.

johnnyj · Post by **johnnyj** » Wed Nov 19, 2014 4:00 am

OrangeDragon wrote:
johnnyj wrote:
OrangeDragon wrote:TO protect us from hacking/DDoS attempts our ISP shut us down for 3 hours. And then again. I have put in some countermeasures that will hopefully stop the attack from reaching us again... we will see.

Did they confirm it was a combined attack (hack/DDOS)?
there are some pretty clever anti-DDOS measures that can be taken at a layer 2 level, however sometimes shutting the site down is the only resort... which sort of achieves the goal of a DDOS anyway...

Any ideas on where the traffic was coming from?
not positive it was aimed at us both.. but that would be a shaky coincidence if it weren't. it was for sure a DDoS attack on our side, and I've now added another layer of protection at the DNS level, and will be continuing to tune my countermeasures through the day. Biggest hit was timing... they hit while i was asleep and couldn't react quickly.

and a site shutdown is only one minor impact/goal of a DDoS. They can also be used to launch man in the middle attacks, which are much much worse and can cause a server security breach. i'd rather the site shut down than some hackers gain access to it for sure.

downloading all of my logs now, and i'm going to toss them all into Splunk to review and search for patterns on. With any luck Scoby will send me the ones from 440 as well so I can do a full analysis. Depends on how cooperative they're feeling.

I've done quite a bit of work on tracking this sort of thing down, let me know if you want a hand reviewing any logs, I'll be offering the same to Scobienz as well.

EdinWigan · Post by **EdinWigan** » Wed Nov 19, 2014 4:03 am

johnnyj wrote:
OrangeDragon wrote:
johnnyj wrote:
OrangeDragon wrote:TO protect us from hacking/DDoS attempts our ISP shut us down for 3 hours. And then again. I have put in some countermeasures that will hopefully stop the attack from reaching us again... we will see.

Did they confirm it was a combined attack (hack/DDOS)?
there are some pretty clever anti-DDOS measures that can be taken at a layer 2 level, however sometimes shutting the site down is the only resort... which sort of achieves the goal of a DDOS anyway...

Any ideas on where the traffic was coming from?
not positive it was aimed at us both.. but that would be a shaky coincidence if it weren't. it was for sure a DDoS attack on our side, and I've now added another layer of protection at the DNS level, and will be continuing to tune my countermeasures through the day. Biggest hit was timing... they hit while i was asleep and couldn't react quickly.

and a site shutdown is only one minor impact/goal of a DDoS. They can also be used to launch man in the middle attacks, which are much much worse and can cause a server security breach. i'd rather the site shut down than some hackers gain access to it for sure.

downloading all of my logs now, and i'm going to toss them all into Splunk to review and search for patterns on. With any luck Scoby will send me the ones from 440 as well so I can do a full analysis. Depends on how cooperative they're feeling.
I've done quite a bit of work on tracking this sort of thing down, let me know if you want a hand reviewing any logs, I'll be offering the same to Scobienz as well.

Great to see the brains of both sites working together for the common benefit of us all.

Thank you

OrangeDragon · Post by **OrangeDragon** » Wed Nov 19, 2014 4:12 am

Worst part is, i'd JUST downloaded the distro of Splunk last night to put on the server for monitoring this stuff live... and ended up going to bed without finishing.

*sigh*

CEO and Khmer440 BLACKOUT!

Re: CEO and Khmer440 BLACKOUT!

Re: CEO and Khmer440 BLACKOUT!

Re: CEO and Khmer440 BLACKOUT!

Re: CEO and Khmer440 BLACKOUT!

Re: CEO and Khmer440 BLACKOUT!

Re: CEO and Khmer440 BLACKOUT!

Re: CEO and Khmer440 BLACKOUT!

Re: CEO and Khmer440 BLACKOUT!

Re: CEO and Khmer440 BLACKOUT!

Re: CEO and Khmer440 BLACKOUT!

Who is online

Register/Login to CEO with your Social Media Account: