Choopa, reliablesite.net, vultr, ovh DDOS attacks

eva2000 · Sep 24, 2016

OVH VAC4 is online now OVH Tasks

We are starting validation tests for VAC4, the newly added member of our VAC solution.
VAC4 is based on new hardware and software solutions, and thus we are progressively adding traffic to it and closely monitoring its behavior and load.

We are now putting vac4 fully in production
Click to expand...

OVH had 3x VACs each with 160Gbps DDOS mitigation capabilities, now they added their 4th and from what I read they're are planning to turn up 12x VACs !

deltahf · Sep 24, 2016

I've always been impressed by OVH's offerings, but they almost seem too good to be true.

I just priced a server with them and I could save money and get a lot more horsepower compared to what I'm getting with ReliableSite. How can they offer such great prices? Are they really as good as people say they are?

eva2000 · Sep 24, 2016

deltahf said: ↑

I've always been impressed by OVH's offerings, but they almost seem too good to be true.

I just priced a server with them and I could save money and get a lot more horsepower compared to what I'm getting with ReliableSite. How can they offer such great prices? Are they really as good as people say they are?
Click to expand...

they're venture funded OVH.com | crunchbase

Total Equity Funding
$278.82M in 1 Round from 2 Investors
Most Recent Funding
$278.82M Venture on August 31, 2016
Click to expand...

not many web hosts would have that size of a piggy bank

also their servers aren't the typical ones with chassis and fan cooling.. they're water cooled & open case Galerie photos les serveurs - OVH

also Green IT - OVH

Since 2010, the new OVH data centers are free from air conditioning.

The "30% air cooling + 70% water cooling = 0% air conditioning" solution is deployed in all new data centers, in France and Canada.
Click to expand...

rdan · Sep 24, 2016

OVH is really great, but except they will not provide any software support.

eva2000 · Sep 24, 2016

RoldanLT said: ↑

OVH is really great, but except they will not provide any software support.
Click to expand...

true, support you'd be on your own.

More info on these DDOS attacks Massive DDoS Attack Obliterates Krebs on Security

An absolutely massive DDoS attack that reached 665 Gbps in size has hit the website of a prominent cybersecurity journalist, forcing Akamai to drop Brian Krebs’ website,Krebs on Security, from its Prolexic DDoS mitigation service.

Huge DDoS attacks have been seen across the hosting industry this week, reportedly hitting OVH and Cogent, which to Krebs suggests that “whoever built this DDoS cannon has been testing it.” At the time of publication, Krebs on Security remains offline.
Click to expand...

and

Why the silencing of KrebsOnSecurity opens a troubling chapter for the ‘Net | Ars Technica

For the better part of a day, KrebsOnSecurity, arguably the world's most intrepid source of security news, has been silenced, presumably by a handful of individuals who didn't like a recent series of exposés reporter Brian Krebs wrote. The incident, and the record-breaking data assault that brought it on, open a troubling new chapter in the short history of the Internet.

The crippling distributed denial-of-service attacks started shortly after Krebs published stories stemming from the hack of a DDoS-for-hire service known as vDOS. The first article analyzed leaked data that identified some of the previously anonymous people closely tied to vDOS. It documented how they took in more than $600,000 in two years by knocking other sites offline. A few days later, Krebs ran a follow-up piece detailing the arrests of two men who allegedly ran the service. A third post in the series is here.
Click to expand...

Krebs said he has explored the possibility of retaining a DDoS mitigation service, but he found that the cost—somewhere between $100,000 and $200,000 per year for the type of always-on protection he needs against high-bandwidth attacks—is more than he can afford. For the past four years, he received pro bono help from Prolexic, which was later acquired by Akamai. Over that time, the service has defended KrebsOnSecurity against what he estimates are hundreds of attacks. The latest round has brought that relationship to an end. Krebs said he hopes to be back online later Friday with the help of a service he declined to discuss on the record. Still, he said, he's not sure how long the new arrangement will last.
Click to expand...

deltahf · Sep 25, 2016

Very worrying stuff.

It's just another challenge small-to-medium sized web publishers will have to face moving forward, and will eventually push people onto the major platforms and social networks if they want to be immune from these kinds of attacks.

eva2000 · Sep 25, 2016

Indeed worrying. Wonder if any of these attacks are trying to take advantage of the latest OpenSSL vulnerabilities Security - September 2016: OpenSSL 1.0.2i & Updating Centmin Mod Nginx SSL Support | Centmin Mod Community / ?

eva2000 · Sep 25, 2016

woah 1.5Tbps DDOS attack https://twitter.com/olesovhcom/status/779297257199964160

This botnet with 145607 cameras/dvr (1-30Mbps per IP) is able to send >1.5Tbps DDoS. Type: tcp/ack, tcp/ack+psh, tcp/syn.
Click to expand...

eva2000 · Sep 25, 2016

looks like Krebsonsecurity site moved to Google Project Shield DDOS Mitigation system https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/

Allow me to explain how I arrived at this unsettling conclusion. As many of you know, my site was taken offline for the better part of this week. The outage came in the wake of ahistorically large distributed denial-of-service (DDoS) attack which hurled so much junk traffic at Krebsonsecurity.com that my DDoS protection provider Akamai chose to unmoor my site from its protective harbor.

Let me be clear: I do not fault Akamai for their decision. I was a pro bono customer from the start, and Akamai and its sister company Prolexic have stood by me through countless attacks over the past four years. It just so happened that this last siege was nearly twice the size of the next-largest attack they had ever seen before. Once it became evident that the assault was beginning to cause problems for the company’s paying customers, they explained that the choice to let my site go was a business decision, pure and simple.

Nevertheless, Akamai rather abruptly informed me I had until 6 p.m. that very same day — roughly two hours later — to make arrangements for migrating off their network. My main concern at the time was making sure my hosting provider wasn’t going to bear the brunt of the attack when the shields fell. To ensure that absolutely would not happen, I asked Akamai to redirect my site to 127.0.0.1 — effectively relegating all traffic destined for KrebsOnSecurity.com into a giant black hole.

Today, I am happy to report that the site is back up — this time under Project Shield, a free program run by Google to help protect journalists from online censorship. And make no mistake, DDoS attacks — particularly those the size of the assault that hit my site this week — are uniquely effective weapons for stomping on free speech, for reasons I’ll explore in this post.
Click to expand...

Google | Project Shield | Free DDoS protection

Project Shield is a free service that uses Google technology to protect news sites and free expression from DDoS attacks on the web.
Click to expand...

Free, unlimited protection

No matter the size of your website or the size of the attack, Project Shield provides free protection for news, journalist, human rights, and elections monitoring sites.
Click to expand...

How Project Shield works - Project Shield Help

How Project Shield works
Project Shield is a free service that helps protect websites from distributed denial of service (DDoS) attacks. A DDoS attack is an attempt to make your website unavailable by overwhelming it with traffic from multiple sources.

Project Shield works by filtering out harmful traffic and passing safe traffic to your website server.

How Project Shield protects your site from DDoS
Project Shield is a reverse proxy: Project Shield servers receive traffic requests on your website's behalf and then sends safe traffic to your website's server.

This protects your site against distributed denial of service (DDoS) attacks in two ways:

It filters harmful traffic. Project Shield filters out harmful traffic using Google’s technology and DDoS tools. If someone tries to take your website down with a DDoS attack, Project Shield can identify and block harmful traffic so your website stays up and running.

It absorbs traffic through caching. Project Shield can cache — or save — versions of your content to serve to website visitors. This reduces traffic requests to your website server and absorbs potential DDoS attacks. For example, if many visitors want to view the same content on your website (or, in a DDoS attack, an attacker is trying to overwhelm your website with traffic), Project Shield will fetch the content from your website's server once and then serve a cached copy repeatedly.

Learn more about DDoS.

Who can apply for Project Shield?
News websites, human rights websites, and elections monitoring websites are eligible to apply. Project Shield individually reviews applications and invites eligible applicants on a rolling basis.

Learn more about applying for Project Shield.
Click to expand...

SeaTea · Sep 29, 2016

Another article:
Record-breaking DDoS reportedly delivered by >145k hacked cameras | Ars Technica

eva2000 · Sep 29, 2016

Yeah these IoT devices aren't really secure with their default passwords especially for web accessible devices !

Last week, security news site KrebsOnSecurity went dark for more than 24 hours following what was believed to be a record 620 gigabit-per-second denial of service attack brought on by an ensemble of routers, security cameras, or other so-called Internet of Things devices. Now, there's word of a similar attack on a French Web host that peaked at a staggering 1.1 terabits per second, more than 60 percent bigger.

The attacks were first reported on September 19 by Octave Klaba, the founder and CTO of OVH. The first one reached 1.1 Tbps while a follow-on was 901 Gbps. Then, last Friday, he reported more attacks that were in the same almost incomprehensible range. He said the distributed denial-of-service (DDoS) attacks were delivered through a collection of hacked Internet-connected cameras and digital video recorders. With each one having the ability to bombard targets with 1 Mbps to 30 Mbps, he estimated the botnet had a capacity of 1.5 Tbps.

On Monday, Klaba reported that more than 6,800 new cameras had joined the botnet and said further that over the previous 48 hours the hosting service was subjected to dozens of attacks, some ranging from 100 Gbps to 800 Gbps. On Wednesday, he said more than 15,000 new devices had participated in attacks over the past 48 hours.
Click to expand...

deltahf · Oct 2, 2016

My ReliableSite server was down again this morning... more DDoS attacks.

eva2000 · Oct 2, 2016

deltahf said: ↑

My ReliableSite server was down again this morning... more DDoS attacks.
Click to expand...

ouch .. sorry to hear

deltahf · Oct 2, 2016

Thanks, yeah, it's terrible.

Looks like the source code for the software that launched all these attacks has been published online yesterday. I bet someone was testing it out.

Source Code for IoT Botnet ‘Mirai’ Released — Krebs on Security

eva2000 · Oct 2, 2016

deltahf said: ↑

Looks like the source code for the software that launched all these attacks has been published online yesterday. I bet someone was testing it out.

Source Code for IoT Botnet ‘Mirai’ Released — Krebs on Security
Click to expand...

thanks for the heads up

Infected systems can be cleaned up by simply rebooting them — thus wiping the malicious code from memory. But experts say there is so much constant scanning going on for vulnerable systems that vulnerable IoT devices can be re-infected within minutes of a reboot. Only changing the default password protects them from rapidly being reinfected on reboot.

In the days since the record 620 Gbps DDoS on KrebsOnSecurity.com, this author has been able to confirm that the attack was launched by a Mirai botnet. As I wrote last month, preliminary analysis of the attack traffic suggested that perhaps the biggest chunk of the attack came in the form of traffic designed to look like it was generic routing encapsulation(GRE) data packets, a communication protocol used to establish a direct, point-to-point connection between network nodes. GRE lets two peers share data they wouldn’t be able to share over the public network itself.

One security expert who asked to remain anonymous said he examined the Mirai source code following its publication online and confirmed that it includes a section responsible for coordinating GRE attacks.
Click to expand...

hmm IoT devices need their own built in native WAF firewalls i think

On the not-so-cheerful side, there are plenty of new, default-insecure IoT devices being plugged into the Internet each day. Gartner Inc. forecasts that 6.4 billion connected things will be in use worldwide in 2016, up 30 percent from 2015, and will reach 20.8 billion by 2020. In 2016, 5.5 million new things will get connected each day, Gartner estimates.
Click to expand...

ouch 6.4 billion devices !

deltahf · Oct 8, 2016

A post from OVH about the attacks:

OVH News - The DDoS that didn't break the camel's VAC*

eva2000 · Oct 8, 2016

thanks @deltahf for the heads up

Then the Internet of Things arrived: from smartphones to cameras, to home thermostats, TVs and even cars, a whole bunch of devices have been connected to the Internet… without the manufacturers unduly worrying about their high degree of vulnerability.

This brings about multiple issues, starting with the respect for user privacy. Already back in 2014, the insecam.org website was launched online by a Russian hacker in order to raise awareness with customers and manufacturers regarding the low level of security found in IP cameras. It is very easy - and perfectly legal—to access the stream of inadequately secured or unsecured IP cameras around the world…
Click to expand...

However, this had an impact on some of our customers, which we would like to go over in more details. During the attacks, internet users from the Southern European countries have experienced traffic slowdowns as they were trying to access servers hosted by OVH because the DDoS coming from those regions were massive. There were congestions on our interconnections with a local ISP in Spain so we sped up investments in our Madrid point of presence, and our exchange capacities will be multiplied by 10 very soon.

Furthermore, if the VAC (a combination of technologies developed by OVH to mitigate DDoS attacks) is protecting all OVH customers by default, it only activates when an attack is detected. It then filters legitimate traffic so that the targeted server remains available. Customers with specific security needs have access to an option allowing for a permanent activation of the VAC. Their entire traffic is constantly being filtered, even when they're not under attack. During the week of September 19, we disabled this option in order to free some bandwidth inside the VAC so we could receive an attack without saturating our protective equipment. In the following days, we reactivated permanent mitigation for the impacted customers. Before the end of 2016, the first generation of anti-DDoS protection, we released back in 2013, will be replaced by a new technology developed in-house and based on FGPA (programmable integrated circuits) and codes that have been in development for the past 18 months. This will allow us to offer up a VAC capable of withstanding DDoS attacks with peaks up to 5 Tbps without slowing down our network.
Click to expand...

Log in / Register

Forums

Get the most out of your Centmin Mod LEMP stack

Choopa, reliablesite.net, vultr, ovh DDOS attacks

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

SeaTea Member

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Get the most out of your Centmin Mod LEMP stack

Choopa, reliablesite.net, vultr, ovh DDOS attacks

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

SeaTea Member

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

deltahf Premium Member Premium Member

eva2000 Administrator Staff Member

.