DOS Attack

[Oh Shoot]

Interesting TGO finally got hit. Several of the major gun forums that I know have had DOS attacks in the last year. Maybe all of them do from time to time.

I suppose it explains most of the poor performance issues with the site since first of the year ... if you're sure that the DOS is real, and not just an excuse from webhost.

- OS

[Guest joeharris]

If this is true, it is sad, i get withdrawel symptons when the site goes down. David says it started in the last few weeks, but OhShoot is talking like we have been having problems for the entire yr.

I just wonder, as to why all of a sudden there is talk of a Master-Hacker, when in many previous post's, David was always complaining about the bad service due to the new webhost.

I wonder as to what type of proof, if any there is, besides excuses maybe from the webhost?

As previously stated there are a few websites that continuously seem to go down, but many wonder if it is not simply due to the owner?admin. just not knowing, "What in the hell, they are doing"!

If the was a hacker, the webhost should be smart enough and take evasive action!

Might be time to hire a Master Tech. Consultant, $500. should get that alledged problem easily solved!

[lowbud]

If in fact it is someone malicious.. which it may be.. it can be stopped. I don't know any of the details so i can't even begin to speculate. I'm trying to find out tho..

[Guest joeharris]

:popcorn:Sound's like you are trying to catch the alledged "Master Hacker"!

[TGO David]

It is real and it's not an excuse made up by the web host. What other forums have been hit lately?

[lowbud]

Something's going on this morning. It's taking pages forever to load. Doesn't seem to be bandwidth related either. oh well. I guess you'll figure it out.

Edited April 28, 2009 by lowbud

[G27]

:popcorn:Sound's like you are trying to catch the alledged "Master Hacker"!

You do realize that a DOS attack requires zero hacking, right?

[poak]

You do realize that a DOS attack requires zero hacking, right?

Dude, I heard the DOS attacker hacked a Gibson!

[Smith]

I for one am glad I have no idea what you guys are talking about. Only thinking I know about hacking is that Angelina Jolie was in it!

[Mike.357]

i read this thread title and thought something was up with the Department of Safety. Guess I am not a big enough computer dork to catch what DOS really meant, LOL

[cadillacdude1975]

i used google and the last reported DDOS attacks on gun forums was in May of 2008. in the last 3 weeks, i would be looking at who has been banned and who they were friends with that got banend in the past. maybe someone finally got pissed off enough to do something like that. it (DDOS attacks) would explain the pain in the ass i have connecting at times when i can go anywhere else on the internets without fail. when did i mention the start of that problem? seems to be about 3 weeks ago if i remember correctly.

edit: i posted about my problem 2 weeks ago today. it had been going on for about a week, so that is 3.

[TGO David]

Guys, I've got very good records of when it started happening. We didn't just discover this last night; we've known about it for some time now. I finally decided to take the "social" route and offer a reward yesterday, that's why I made it public.

When an investigation is ongoing, the first thing you do is not run around telling everyone that something is up.

Thanks for your concern though. I'm doing my best to resolve the issue behind the scenes and we may be moving to a new web host that provides better DDoS security and is willing to cooperate in hunting down those responsible. Our current host doesn't deal very often with this type of situation and hasn't been super helpful to that end.

[SkWaShDeM]

Does the current provider at least have a decent logging system so that they can track down DDoS instigators?

[TGO David]

We log all of our traffic and when an event like this occurs, there are commands that I can use at the server's shell interface to see which IPs are involved. However, most DDoS attacks involve compromised hosts that are not owned by the person doing the attacking. Which makes it a little more difficult to track back to them.

[Guest jos2f]

Tracking a DDoS through ip logging is like trying to recover your own piss after pissing in the ocean.

[lowbud]

If they are flooding apache you can tune things to better handle the load. If it's general crap traffic use iptables to drop it.

[Guest Astra900]

Dude, I heard the DOS attacker hacked a Gibson!

I for one am glad I have no idea what you guys are talking about. Only thinking I know about hacking is that Angelina Jolie was in it!

It's in that place where I put that thing that time.

[lowbud]

Tracking a DDoS through ip logging is like trying to recover your own piss after pissing in the ocean.

Yep. Logging is a waste of time and resources. Resources are better off spent on mitigation.

[TGO David]

If they are flooding apache you can tune things to better handle the load.

I've made adjustments to Apache but if you know some things that we ought to be doing in http.conf fire them to me via PM. I'm not going to post things publicly about the server.

Thanks.

[Oh Shoot]

It is real and it's not an excuse made up by the web host. What other forums have been hit lately?

Not "lately", but defensivecarry.com had a bout with attacks just before first of the year. Pretty sure I've seen a couple of other admins discuss it but can't remember which ones...

- OS

[Guest mustangdave]

My big question...are we talking MS-DOS...or IBM PC-DOS? now thats old....

[Guest GT_Rat]

TRS-DOS. (I think that's what they called it.)

[Guest TEBISH]

Tracking a DDoS through ip logging is like trying to recover your own piss after pissing in the ocean.

Do I have to pay any type of licensing fees to use that one at a later time? Hilarious.

[Guest Mugster]

Yep. Logging is a waste of time and resources. Resources are better off spent on mitigation.

I don't know think thats true. You can examine tcp logs with a little script and gen a little firewall rule or simply drop an ip or ipblock in a hosts.deny file or something. I think some level of logging is a good idea...if for no other reason than a record of what took place.

I do think a centralized logserver makes alot of sense.

Bottom line, shut it off at the router or get another provider. Its probably not worth your time trying to track it down, imo. Unless its a principle thing...but you'll lose money doing it.

Edited April 28, 2009 by Mugster

[lowbud]

I don't know think thats true. You can examine tcp logs with a little script and gen a little firewall rule or simply drop an ip or ipblock in a hosts.deny file or something. I think some level of logging is a good idea...if for no other reason than a record of what took place.

I do think a centralized logserver makes alot of sense.

Bottom line, shut it off at the router or get another provider. Its probably not worth your time trying to track it down, imo. Unless its a principle thing...but you'll lose money doing it.

Loggin to block traffic is one thing but to track it is another. odds are people on this vary forum participate in dos attacks. Personally I wouldn't have a server on the public wire. However, sometimes funding is an issue and thus security suffers.

Typically providers will not install filters in their equipment. Most cases they will instruct you to install your own device. The problem is if the service you have is rated on bandwidth. In that case you end up paying more in usage charges (which is what they want) then it would cost to co-locate a firewall.

It really sucks. I ran IRC servers on both IRCNET and Undernet for years. You haven't seen DOS attacks untill you have dealt with that. We had a smurf attack so bad one time it took down our backbone's core router in Chicago. We had to have then NULL route our netblock for a few hours becasue the flood saturated our DS3.

Oh and by the way.. a DS3 back in early 90's was a HUGE pipe. Unlike the multi-gigabit connections of today.