IOL hit by DoS attack

[Redeemed]

Whether he deserves to be ridiculed and put on trial for his crimes is not the issue here. There are obviously people who believe he's doing a good job in Zimbabwe, and its MY RIGHT to read those opinions and then form my own. Your beliefs are irrelevant to that. If we're going to approve of terrorist censorship on articles we don't want to see published, where exactly do we draw the line?

Exactly, brilliant! We don't need anybody to close our ears and eyes to what's going on in the world as though we were babes, we have minds of our own with which to judge.

 

[MagicDude4Eva]

The scary part is that underground market places exist where you can purchase 80,000-120,000 hosts capable of launching DDoS attacks with up to 100Gpbs attack patterns for USD1000 for a day.

 

[Keegan]

The scary part is that underground market places exist where you can purchase 80,000-120,000 hosts capable of launching DDoS attacks with up to 100Gpbs attack patterns for USD1000 for a day.

It's not scary, it's a reality... there is sooo much more to the internet than just Google, (The underground,Dark side to the internet) that not many of us see.. But it is definitely there...

I only discovered it recently (knowing it existed but just didn't have time to research) I was also "shocked" or "scared" but got over it... not many people will ever see that part, well not in this era...

Also it's not "internet" as such its more of a VPN (tunnel) to underground PC's/Servers...

Still get goosebumps tho when I think about it

 

[Keeper]

It's not scary, it's a reality... there is sooo much more to the internet than just Google, (The underground,Dark side to the internet) that not many of us see.. But it is definitely there...

I only discovered it recently (knowing it existed but just didn't have time to research) I was also "shocked" or "scared" but got over it... not many people will ever see that part, well not in this era...

Also it's not "internet" as such its more of a VPN (tunnel) to underground PC's/Servers...

Still get goosebumps tho when I think about it

Oh please, stop acting like the Deep web is some secret club nobody knows about.

Step 1: Download TOR.
Step 2: Look through the hidden wiki and go exploring.

Whoop di do was that so hard?

 

[Keegan]

Oh please, stop acting like the Deep web is some secret club nobody knows about.

Step 1: Download TOR.
Step 2: Look through the hidden wiki and go exploring.

Whoop di do was that so hard?

LMAO, I know that, but there's more...

 

[Maverick Jester]

I would have placed a DDoS appliance at the edge of the network to cover all aspects of security. The firewalls are really not built for that purpose.

Agreed, but different security patterns dictate how you deploy your infrastructure, and whether as you mentioned earlier, the LTM module does really well at things like compression, load balancing and offloading. Given that we do not have AFM, it made more sense to those in charge.

BTW: In my opinion it should have been the hosting provider's fault (IS) to protect customers like IOL - it is amazing that IS lets DDoS traverse across it's core network and knock customers off the grid.

Then you may as well host your entire datacentre at IS...

 

[Maverick Jester]

My sentiments exactly - IS shared FW is really a piece of junk - incident was reported at 11:07 and I would think the DoS attack knocked off part of the firewall. Surprising that it had not taken out more customers during the 1 hour. AFAIK the shared FW in Rosebank was knocked off, but I understand that IOL is hosting in Bryanston so it could be unrelated or a knock-on from the attack when IS tried to switch firewalls (but I might be wrong on this)

From what I remember, Bryanston is their failover site.

Not surprising that it only affected IOL- the attack targeted them. I really don't think that core infrastructure at IS will be shared with other companies, but at the end of the day, IOL did not have the relevant protection measures in place on their own site anyway. Them being the only party impacted by this is a testament to that.

 

[Keegan]

From what I remember, Bryanston is their failover site.

Not surprising that it only affected IOL- the attack targeted them. I really don't think that core infrastructure at IS will be shared with other companies, but at the end of the day, IOL did not have the relevant protection measures in place on their own site anyway. Them being the only party impacted by this is a testament to that.

Its not known if there were any other server/websites that was behind that firewall, the way I see it, is that the firewall went into "safe mode" and stopped traffic passing through it, (normal behavior)
The only other way that could've decreased downtime was that if IOL had a replicated site at another location and switch traffic to that destination when the firewall went down...

Just my thought/assumption...

 

[Sinbad]

From what I remember, Bryanston is their failover site.

Not surprising that it only affected IOL- the attack targeted them. I really don't think that core infrastructure at IS will be shared with other companies, but at the end of the day, IOL did not have the relevant protection measures in place on their own site anyway. Them being the only party impacted by this is a testament to that.

According to the news, 50 sites were affected.

http://www.bdlive.co.za/national/media/2013/06/13/hacktivists-hit-iol-over-praise-of-mugabe

ANONYMOUS Africa, a so-called hacktivist group, briefly shut down about 50 websites on Wednesday, including Independent Newspapers’ Independent Online (IOL).

The attack was justified on the grounds that the website was "ignoring the genocide against the Ndebele people and for ‘supporting’ a dictator". The group was protesting against an opinion piece on the Sunday Independent website claiming that Zimbabwean President Robert Mugabe was a heroic African leader.

Anton Harber, Caxton professor of journalism at Wits University, said this was "an attack on the rights to free expression" of those who support Mr Mugabe.

"Freedom of speech means tolerating even — or especially — opinions one dislikes. They can disagree, even protest, but vandalising a newspaper site and preventing the expression of different opinions is a thuggish attack on freedom of expression."

The article was part of a debate series run on the site, said IOL editor Alastair Otter. It suffered a denial of service (DOS) attack, meaning that its server was flooded with so much traffic that it was overwhelmed and readers were prevented from gaining access to the website.

The group, which uses the twitter handle @zim4thewin, warned in one of its tweets that it would "go after more fun targets". The group on Wednesday attacked the websites of Zimbabwean political party Zanu (PF) and the state-owned Herald newspaper.

Costa Koutakis, chief client officer at Internet Solutions, which hosts the IOL server, said the attack was "well orchestrated" and came from multiple sources. The fact that the traffic emanated from different places made it look legitimate and so it did not trigger monitoring systems, he said.

Mr Otter said such attacks are particularly hard to prevent as they do not rely on breaking into servers. Mr Koutakis said Internet Solutions is seeking a way to prevent such attacks.

 

[CharlieBravo]

Pretty much no firewall will stop a Layer7 Denial-of-Service attack. You also cannot mitigate it by pointing the domain name to a different server as it uses http requests and not the IP.

IOL and the likes would need to seek the services of someone liek Prolexic, cloudflare or black lotus to mitigate these types of attacks. The traffic just looks to normal. If the traffic is spoofed then it will look like the attack is coming from many machines when in reality it is probably just using some sort of Proxy list. If a botnet is being used then this would likely be 200+ infected machines attacking. Hard to block thousands of IP's when it looks like normal Http requests

I can not see how this group is in anyway affiliated to Anonymous the collective. None of their followers are main characters from the collective.

The most likely thing that is happening is 1 person maybe 2 has discovered something called a booter or a stresser. These are services that can be purchased from websites to use their attack servers to launch a Denial-of-Service attack for x amount of seconds. Why do I believe they are using a booters/stressers because the attacks appear to be very limitied in time duration.

Generally when Anonymous attack a website it goes down for at least a day, if not the attack is most likely being mitigated by Cloudflare and the likes.

Anonymous also state as a rule that NO media outlets are to be attacked. The idea is that information on the internet is free and shared. IOL have never been seen as party leaning towards an political party and therefore the attack is completely unwarranted.

Booters and Stressers:
These can push out up to 30Gbp/s when attacking and can charge as little as $18pm with 1 hour slots. Anyone with paypal, bitcoin etc can sign up to these. They are by no means reserved for the underground hacker groups.

 

[MagicDude4Eva]

Pretty much no firewall will stop a Layer7 Denial-of-Service attack. You also cannot mitigate it by pointing the domain name to a different server as it uses http requests and not the IP.

I do think that a Radware DefensePro might protect from such attack behaviour - at least that's what they advertise. We tried the device and it failed (mostly due to poor local support and inexperience of the local reseller)

 

[b@nD]

MSM Whores !

Anton Harber, Caxton professor of journalism at Wits University, said this was "an attack on the rights to free expression" of those who support Mr Mugabe.

"Freedom of speech means tolerating even — or especially — opinions one dislikes. They can disagree, even protest, but vandalising a newspaper site and preventing the expression of different opinions is a thuggish attack on freedom of expression."

The article was part of a debate series run on the site, said IOL editor Alastair Otter. It suffered a denial of service (DOS) attack, meaning that its server was flooded with so much traffic that it was overwhelmed and readers were prevented from gaining access to the website.

VERY very stupid people these ( so called academics and intellectuals )

They should go to ZIM
Join the MDC
Make donations to the MDC
then
Print articles that are scathing of Mugabe --
and
then see what happens to their "rights to free expression" of those who [DO NOT] support Mr Mugabe.

Perhaps they should read about --> die Weiße Rose

 

[CharlieBravo]

Nope - these products will claim to stop DDoS attacks but only if they are Layer4 attacks and some Layer7 attacks that match their signatures. These devices generally look for UDP or Syn packets to block. Layer7 is a totally different kettle of fish. They use POST/GET/HEAD requests so the firewall thinks its legit. The packet hits the server and send back the acknowledgement but the attack server/botnet never completes the request and this leaves the slot open if you like. Eventually the server accumulates all these requests that arent completing, totally overwhelming it before it falls over.

Having said that how many devices can stop a 30gbps attack in SA? Our pipes just wont handle it and the attack will most likely bottleneck the network before bringing the actual site down.

 

[b@nD]

?

Having said that how many devices can stop a 30gbps attack in SA?
Our pipes just wont handle it and the attack will most likely bottleneck the network before bringing the actual site down.

Block @ source
What do the Ingress keepers do ? ( the landing stations for the fibre International links )
What would a couple of hundred million p/m "legit" -- "trigger" comms do to the NSA ?

 

[Bar0n]

Having said that how many devices can stop a 30gbps attack in SA? Our pipes just wont handle it and the attack will most likely bottleneck the network before bringing the actual site down.

In the case of IOL: Block international traffic for a bit if you know the majority of your traffic is national.

 

[Maverick Jester]

According to the news, 50 sites were affected.

Ouch... a bit concerning for me. Will need to give IS a ring then...

 

[BTTB]

VERY very stupid people these ( so called academics and intellectuals )

They should go to ZIM
Join the MDC
Make donations to the MDC
then
Print articles that are scathing of Mugabe --
and
then see what happens to their "rights to free expression" of those who [DO NOT] support Mr Mugabe.

Perhaps they should read about --> die Weiße Rose

Thanks for that piece of history, never knew about the White Rose Movement.
Beheaded, I thought that went out with the French Revolution.

.why do you allow these men who are in power to rob you step by step, openly and in secret, of one domain of your rights after another, until one day nothing, nothing at all will be left but a mechanised state system presided over by criminals and drunks? Is your spirit already so crushed by abuse that you forget it is your right - or rather, your moral duty - to eliminate this system?