MyBroadband forum problems

[rpm]

MyBB is currently experiencing issues. I am 100% sure that rpm and the crew are running around frantically trying to resolve the problem.

That is an understatement. We are really doing our best to address the problems.

 

[Zarkon]

Yip been a nightmare to get onto mybb since monday,tapatalk wont log in.When i eventually get in to the website from my pc,i try and post and boom msg gone because error.

 

[Zarkon]

That is an understatement. We are really doing our best to address the problems.

Was it an attack on mybb? i keep seeing checking for ddos or something when it loads? All the best that side

 

[Necropolis]

MyBB is currently experiencing issues...

I am 100% sure that rpm and the crew are running around frantically trying to resolve the problem.

Or they are running some sick social experiment to see what the effects of MyBB withdrawal are on the most addicted members

 

[MagicDude4Eva]

The k@k comes in when people think Cloudflare is a DDoS solution.

They are not. They simply remove the proxy and direct it to your server as they do not position themselves as a DDoS solution.

Mybb should fork out some money and get proper protection contact Incapsula and get them to do what they do best.

Not the case. You can get a very sophisticated Cloudflare solution. The errors point at a MyBB issue and I do not believe it is related at all to Cloudflare itself. Everyone says it is DDoS, but all errors point at an actual outage on the MyBB server(s).

 

[DanDango]

MyBB is currently experiencing issues...

I am 100% sure that rpm and the crew are running around frantically trying to resolve the problem.

 

[Sinbad]

Not the case. You can get a very sophisticated Cloudflare solution. The errors point at a MyBB issue and I do not believe it is related at all to Cloudflare itself. Everyone says it is DDoS, but all errors point at an actual outage on the MyBB server(s).

Why are the Cloudflare error pages containing very weird "Your IP address" values though?
Apparently this big four bank operates either off a cable modem on the Virgin Media network, or some jtglobal.com DSL modem...

 

[Thor]

Of course they do position themselves as a DDoS solution. Maybe in Mauritius they don't, but everywhere else based in reality they do.


Incidentally, there's something wrong with CloudFlare. It's reporting my client IP address very randomly...

http://www.webhostingtalk.com/showthread.php?t=1065748

http://www.webhostingtalk.com/showthread.php?t=1065748&p=7571098#post7571098

I see cloudflare later entered this market, but offer limit caps

http://www.webhostingtalk.com/showthread.php?t=1358852&p=9052563#post9052563

 

[cobusv]

MyBroadband Website

Hi MyBroadband,

what is up with your website of late, it's slow and as of late, it keeps being down.



keep getting the above, cloudflare error, and also noticed that traffic to the website started to route internationally

Cobuss-MacBook-Pro-2:~ cobusviljoen$ traceroute www.mybroadband.co.za    
traceroute: Warning: www.mybroadband.co.za has multiple addresses; using 104.20.71.110
traceroute to www.mybroadband.co.za (104.20.71.110), 64 hops max, 52 byte packets
 1  172.16.9.254 (172.16.9.254)  2.367 ms  2.255 ms  2.194 ms
 2  41.193.119.193 (41.193.119.193)  4.451 ms  5.129 ms  4.859 ms
 3  41.193.119.192 (41.193.119.192)  6.361 ms  6.046 ms  6.005 ms
 4  41.193.119.190 (41.193.119.190)  5.732 ms  5.409 ms  5.939 ms
 5  196.41.27.70 (196.41.27.70)  192.879 ms  193.885 ms  192.613 ms
 6  ldn-b5-link.telia.net (213.248.86.21)  194.007 ms  193.258 ms  193.059 ms
 7  ldn-bb2-link.telia.net (80.91.248.94)  192.917 ms
    ldn-bb3-link.telia.net (62.115.114.186)  194.011 ms
    ldn-bb2-link.telia.net (62.115.138.154)  193.008 ms
 8  ldn-b5-link.telia.net (213.155.132.195)  232.541 ms
    ldn-b5-link.telia.net (80.91.248.216)  193.355 ms
    ldn-b5-link.telia.net (213.155.132.197)  193.345 ms
 9  cloudflare-ic-306325-ldn-b3.c.telia.net (62.115.42.242)  194.299 ms  213.825 ms  203.020 ms
10  104.20.71.110 (104.20.71.110)  193.886 ms  192.869 ms  241.043 ms

 

[koeksGHT]

is kill

 

[spiff]

Or they are running some sick social experiment to see what the effects of MyBB withdrawal are on the most addicted members

that's not funny!!!

 

[Sinbad]

http://www.webhostingtalk.com/showthread.php?t=1065748

http://www.webhostingtalk.com/showthread.php?t=1065748&p=7571098#post7571098

I see cloudflare later entered this market, but offer limit caps

http://www.webhostingtalk.com/showthread.php?t=1358852&p=9052563#post9052563

https://www.cloudflare.com/ddos/

DNS amplification attacks, one form of DRDoS, are on the rise and have become the largest source of Layer 3/4 DDoS attacks. CloudFlare routinely mitigates attacks that exceed 100Gpbs, and recently protected a customer from an attack that exceeded 300Gbps—an attack the New York Times deemed the “largest publicly announced DDoS attack in the history of the Internet.”

You're posting 5 year old forum threads. In terms of the internet, those are doddering around in a retirement home.
Maybe your traffic going via mauritius is being delayed by a few years???

 

[MickZA]

It's all due to this damn three day week I tell you.

... we all thought we could slack off and Bam - the poo hits the fan.

 

[MagicDude4Eva]

Why are the Cloudflare error pages containing very weird "Your IP address" values though?
Apparently this big four bank operates either off a cable modem on the Virgin Media network, or some jtglobal.com DSL modem...

I think it is a DNS/Cloudflare/Hetzner config issue caused by probably changes in configuration to mitigate small scale attacks (i.e. direct SQL injection attack against Wordpress/vBulletin). You will probably find that both their nginx/http are bleeding connections and CPU churns out - hence those Cloudflare errors that the host (= the servers where MyBB runs on) are not accessible.

The reason why they can not fix it, is because those attack vectors are against port 80 and are probably "just" a slow HTTP connection attack. In simplest terms, think of a few hundred browser sessions keeping the HTTP connection open and trickle-feeding their HTTP servers. The server will never terminate the connection "as it is still busy", and this then creates a "slow DDoS" - i.e. no other user can access the server. The HTTP/nginx will probably queue up pending requests until the load-average of the server goes into double/triple digits and then the only option is to drop the HTTP connections/restart the server.

If it is a slow HTTP DDoS, then it is easy to fix via Apache modules -

- mod_reqtimeout (built in) - https://httpd.apache.org/docs/2.4/mod/mod_reqtimeout.html
- mod_qos (never tried it, but you can control keep-alives, connections etc) - http://opensource.adnovum.ch/mod_qos/
- mod_evasive - works quite well, especially when paired with firewalld to drop connections
- mod_security - is super complex and tough to configure - especially in the MyBB case as they use so many 3rd party services (white-listing will be a PITA).

If the MyBB outages were related to a "simple" DDoS/attack, this would have been mitigated via Cloudflare. It is not a volumetric attack, as it would otherwise be mitigated at Hetzner's edge-network. Even an IDS would not be able to pick up a slow HTTP DDoS, as the attack pattern has no real signature (other than long/slow HTTP requests).

The above is a trivial thing to resolve provided that the technology choice where MyBB is hosted is vanilla and not outdated - i.e. if they are running an older HTTP/nginx which does not support rate-limiting/QoS they sit with the issue of having to upgrade the base OS first, which introduces all sorts of other dependencies. Easiest would be DNS their site to Hetzner load-balancer, pull up a new web-node which includes the correct web-node stack and configs and then gradually shift load to that server. This obviously implies that their sites do not require sticky-sessions or session-replication and that their issues are not caused by the backend database.

FWIW - Slowloris / R-U-D-Y (R u dead yet) attacks are very easy to mitigate via simple HTTP configurations by not using HTTP server defaults. Even a trimmed down mod_security installation will cut off those requests (Slowloris is already a SecRule)

Another approach to stop Slowloris is a simple iptables BTW:

iptables -A INPUT -p tcp –syn –dport 80 -m connlimit –connlimit-above 100 -j DROP

 

[FiestaST]

She (Tapatalk) is working

 

[AirWolf]

Issues still ongoing.

 

[Mars]

I hate cloudflare. Every time I see that stupid "Checking your browser page" I know I'm not going to be connected.

 

[Sinbad]

I think it is a DNS/Cloudflare/Hetzner config issue

/snip


I dunno.
I mean, it's reporting MY IP address as what look to be botnet client IPs...
Something's borked

 

[saor]

Thor187 could fix this //

 

[Sinbad]

Thor187 could fix this //

he's stuck in mauritius though