DDOS attack aimed at Absolute Hosting Networks

[r00igev@@r]

Yup, we're seeing way more ZA based IP's attacking than before

I think ISPs should do vulnerability scans on their ranges and email subscribers with p@wned routers or infrastructure. Most ISPs in ZA provide little added value.

Search your IP on beta.shodan.io

Spare a thought for this bloke....

 

[Jade @ Absolute Hosting]

I think ISPs should do vulnerability scans on their ranges and email subscribers with p@wned routers or infrastructure. Most ISPs in ZA provide little added value.

Search your IP on beta.shodan.io

Spare a thought for this bloke....
View attachment 1390362

Ultimately if the client has no idea about security and they aren't posing as a threat then its a challenge to enforce.

Despite us recommending that clients not enable RDP from the outside and use firewall available to them, most of them ignore it...

Convenience vs security....

 

[Sinbad]

Ultimately if the client has no idea about security and they aren't posing as a threat then its a challenge to enforce.

Despite us recommending that clients not enable RDP from the outside and use firewall available to them, most of them ignore it...

Convenience vs security....

There's other things that can be done.
Block spoofed packets, for a start. There's no reason whatsoever for a packet with a source IP outside your range to be permitted out of your customer networks

 

[r00igev@@r]

There's other things that can be done.
Block spoofed packets, for a start. There's no reason whatsoever for a packet with a source IP outside your range to be permitted out of your customer networks

True, I can send a packet to most places in ZA with the source being a RFC1918 IP.

 

[AfriNatic]

I think ISPs should do vulnerability scans on their ranges and email subscribers with p@wned routers or infrastructure. Most ISPs in ZA provide little added value.

Search your IP on beta.shodan.io

Spare a thought for this bloke....
View attachment 1390362

We always advise clients to make use of a firewall with a selected ip whitelist to access. Not use default RDP ports and use the build in lockout feature after 3 invalid login attempts.

Unfortunately these servers are self managed and as the ISP we only get involved when there is abuse linked to the IP.

I deal with the abuse queue every day and I take servers offline as soon as I see complaints about abuse on our hosting.

Connectivity IP's are difficult because of the number of ways it can be used in a botnet like MikroTik routers which is the MAIN contributors as well a windows computers that are compromised due to malware installed.

 

[r00igev@@r]

We always advise clients to make use of a firewall with a selected ip whitelist to access. Not use default RDP ports and use the build in lockout feature after 3 invalid login attempts.

Unfortunately these servers are self managed and as the ISP we only get involved when there is abuse linked to the IP.

I deal with the abuse queue every day and I take servers offline as soon as I see complaints about abuse on our hosting.

Connectivity IP's are difficult because of the number of ways it can be used in a botnet like MikroTik routers which is the MAIN contributors as well a windows computers that are compromised due to malware installed.

What is that box? Is it related to http://www.scode.co.za/ The payments system that defaults to non-encrypted?

 

[captainscarlet]

What is that box? Is it related to http://www.scode.co.za/ The payments system that defaults to non-encrypted?

Love how the scode.co.za site breaks when you manually type https:// XD. It's like you're misusing it by opting for a secure connection.

 

[r00igev@@r]

Love how the scode.co.za site breaks when you manually type https:// XD. It's like you're misusing it by opting for a secure connection.

We should create a separate thread for stupid security brainfarts.

 

[RonSwanson]

We always advise clients to make use of a firewall with a selected ip whitelist to access. Not use default RDP ports and use the build in lockout feature after 3 invalid login attempts.

Unfortunately these servers are self managed and as the ISP we only get involved when there is abuse linked to the IP.

I deal with the abuse queue every day and I take servers offline as soon as I see complaints about abuse on our hosting.

Connectivity IP's are difficult because of the number of ways it can be used in a botnet like MikroTik routers which is the MAIN contributors as well a windows computers that are compromised due to malware installed.

Yep, enforce segmentation and comb them off to a VM where anything goes.

 

[RonSwanson]

What is that box? Is it related to http://www.scode.co.za/ The payments system that defaults to non-encrypted?

Less system resources to DoS.

 

[Adenoid Hynkel]

Is there any light at the end of the tunnel? I have a few VPS's with you guys for some clients and they are all pushing to move to another provider :/

 

[Jade @ Absolute Hosting]

Update : As of this morning the attack is ongoing and we've exhausted our reliance on DD / Optinet to assist in mitigating the attack.
We are in discussion with a new provider at the moment and updates will be sent to all clients during the course of the day.

To all our clients, please accept our apologies for this and thanks for your support.

 

[OCP]

Update : As of this morning the attack is ongoing and we've exhausted our reliance on DD / Optinet to assist in mitigating the attack.
We are in discussion with a new provider at the moment and updates will be sent to all clients during the course of the day.

To all our clients, please accept our apologies for this and thanks for your support.

Having been at the receiving end of DD's incompetence several times, you have my sympathies.

You guys (and girls) are an amazing company and I hope that whatever sinister plot is behind this does not succeed in damaging your excellent reputation.

 

[BBSA]

Update : As of this morning the attack is ongoing and we've exhausted our reliance on DD / Optinet to assist in mitigating the attack.
We are in discussion with a new provider at the moment and updates will be sent to all clients during the course of the day.

To all our clients, please accept our apologies for this and thanks for your support.

just received this:

'The attack has manifested into a flood attack which is saturating the links leading into our network, meaning that despite our best efforts to stop the attacks at the data center firewalls - the uplinks simply cannot manage.

We are in discussions to move services to another Data Center and utilize a connectivity provider who can better defend against these types of attacks.

Thank you for your patience and we understand how frustrating this is, we have your best interests at heart.'

 

[BBSA]

I didn't have many issues on my websites. I use cloudflare dns for my sites, not sure if that is the reason why I was not really impacted.

 

[Jade @ Absolute Hosting]

CF most certainly does help but it hasn’t helped entirely

 

[PPLdude]

Maybe we'll see routes going through Voxility soon?

 

[lkswan747]

Having been at the receiving end of DD's incompetence several times, you have my sympathies.

You guys (and girls) are an amazing company and I hope that whatever sinister plot is behind this does not succeed in damaging your excellent reputation.

If it turns out to be a targeted attack from an individual or company and is provenm then I hope the culprit/s are named and shamed!

 

[Jade @ Absolute Hosting]

Paperwork has been signed for our new racks and we're expecting to take occupation of our new home on Friday.

Will post details closer to the time or on the day.

 

[Charles Chananda]

Now this when I had just settled and my website was doing well Google wise.... Keeping fingers crossed!