Namedrive DDOS Attack Update II

[jacksonm]

DDOS Attack Update II
August 24th, 2007

Hello everyone,

I’m not going to get euphoric, but the parking is up and running fast. This was our first priority. The homepage will follow suit.

Thank you all so much for your patience and support. We will certainly reward you and make sure that you don’t lose any earnings as a result of this.
I have a funny feeling that, once your compensation has been done, the last 26 hours may be the highest earning 26 hours of the week for you, if you know what I mean .
We don’t want you to bear the brunt of this attack.

To give you an idea of what we have been up against since 15.00 GMT yesterday, in addition to the 600K domains we have parked on our system, our servers were being hit by XX,XXX false connections per second for over 24 hours. The attack is increasing as we speak and has been since it began.

We estimate that just to keep up this attack, it has cost the aggressor at least five figures and possibly six figures to initiate and sustain. This wasn’t poor defenses on our part, it was the use of overwhelming force and financial resources on theirs. The mind boggles at who has the time or funds to invest in something so unnecessary.

I apologise again for the mess. Please bear with us while we get the homepage up and running today and the revenue correction done, which will take a couple of days to get right.

Mister B
-------------------

Note: It does not cost a master of a botnet a cent to launch a distributed denial of service attack like this. These guys are just trying to save face. They received the request for protection money and they declined to pay it. Now the threat is being carried out.


.

[touchring]

I've always thought that there are ninja organizations for hire that conducts such attacks.

[jacksonm]

Originally Posted by touchring

I've always thought that there are ninja organizations for hire that conducts such attacks.

Nope. These guys are the mafia. You can't hire the mafia to shake down businesses for you - they only do it for themselves.

The large bot networks are controlled by organized crime. They mainly target online gambling sites, but they will shake down any site that visibly earns a lot of money via online operations.

.

[mulligan]

Originally Posted by jacksonm

Nope. These guys are the mafia. You can't hire the mafia to shake down businesses for you - they only do it for themselves.

The large bot networks are controlled by organized crime. They mainly target online gambling sites, but they will shake down any site that visibly earns a lot of money via online operations.

.

Eeek! Better sort your firewall out before they come across your sites ...

[jacksonm]

Originally Posted by mulligan

Eeek! Better sort your firewall out before they come across your sites ...

Firewall doesn't help. They just attack your firewall/gateway/whatever.

The only thing that helps is if you have more aggregate bandwidth than the attacker's distributed network can generate, and your server(s) are strong enough to handle the increased traffic.

.

[xxbossmanxx]

LMAO about how the attackers spent 5 or 6 figures. They talking pesos?

About the poker nets- pokerstars is now prob the strongest site in the world, they tossed tens of millions into stopping this bs.

[Asiaplay]

To be honest this is common in the commercial online world and I personally am very anti people who carry out DDOS Attacks.
I have heard of too many cases here and I was subject to the fallout of one attack due to being on the same router as the company being attacked (however I supported my server supplier and know they did their best to solve this criminal activity - therefore I never asked for a cents compensation for downtime).

There is also very little a company can do once the attack starts, if those attacking have the resources (location based where it will not be stopped quickly) - rather than spending on servers to carry it out from.

Yes - some inconvenience for their customers, but personally I hope that everyone sticks with them and supports this problem which they have (giving into guys like those attacking them, leads to a downward cost spiral which no serious business can contemplate and ultimately if given into just causes customers to suffer as well).

I back their decision not to pay and hope those carrying it out just waste their time and do not gain one cent!!!

Cheers, Asiaplay

[mdw]

Originally Posted by Asiaplay

I back their decision not to pay and hope those carrying it out just waste their time and do not gain one cent!!!

Absolutely right. If Ed & company start paying extortion money to faceless thugs on the net, then guess where that money has got to come from?

The real dilemma is a forensics challenge, and the guilty parties never seem to be held accountable. It's hard to prove the guilt of the cuprit since the requests come from victims, usually unaware that their machine is compromised and acting as a node in a botnet. The compromises surely took place at some time in the past and the actual evidence left on machines may be altered as part of the process of activating and attacking.

One thing's certain though, the attackers are scum who spend their effort like this instead of domaining and setting up networks of money-making websites. They're criminals attacking honest hard-working entrepeneurs.

[touchring]

Yes, but being a target of an attack is an achievement by itself - means your web business is worth attacking.

[jose]

I am puzzled when the say: "We estimate that just to keep up this attack, it has cost the aggressor at least five figures and possibly six figures to initiate and sustain."

How do they know the current prices of renting botnets?

I also can't believe they talking about bandwidht expenses, that would be a good laught, lol. A DOS attack can't easily be fight against due it's higly distribution nature.

[Asiaplay]

Maybe they know and maybe they don't... to be honest a lot of these come out of China (and the source is known) - it is stopping it at the source which is difficult.

Expect 3 to 4 days downtime - but once is fixed we can be assured that at least they will have as much protection built in as possible (ie, multiple servers on different IPs throughout the world - so they can switch resources to limit attacks etc. etc.).

Of interest there will be one data centre in Hong Kong signing contracts soon which state they protect against DDOS attacks (will be a first here).
So will be interesting to see if the others follow suit (up until now China and Hong Kong has been open domain to the thugs and it has resulted in servers moving offshore - which is not a solution for those targeting China parking unfortunately).

Agree - getting an attack in one way is a good sign (means their business has a profit worth people chasing).

Cheers - Asiaplay

[jacksonm]

Originally Posted by Asiaplay

Expect 3 to 4 days downtime - but once is fixed we can be assured that at least they will have as much protection built in as possible (ie, multiple servers on different IPs throughout the world - so they can switch resources to limit attacks etc. etc.).

Doesn't help one bit.

The botnet zombies are also on multiple machines throughout the world, and they all possess DNS resolvers.

The way to survive the attack is to buy more bandwidth than the attacker can saturate, high-tune your DNS servers, and put up a rack of clustered web server front-ends to your database. If they are not able to knock you out, they will eventually give up.

.

[xxbossmanxx]

I got d doss'd once and the attacker even black mailed me for cash. I laughed in his face and told him to do his worst since I could tell he was low level with his puny attack that was easily countered.

[jacksonm]

Originally Posted by xxbossmanxx

I got d doss'd once and the attacker even black mailed me for cash. I laughed in his face and told him to do his worst since I could tell he was low level with his puny attack that was easily countered.

How did you laugh in his face? You were with him? Did you tell him AIMFAI?

.

[Drewbert]

Originally Posted by jose

I also can't believe they talking about bandwidht expenses, that would be a good laught, lol. A DOS attack can't easily be fight against due it's higly distribution nature.

Exactly. That they would even say this makes you wonder about the competnece of the people running Name Drive. Hopeful y that comment was by a marketing droid who failed to listen to the tech guys explanation of what was happening.

The bandwidth consumed sending out instructions to a globally distributed bot network is tiny.

The way to fix this shit is to make Microsoft liable for the security holes.

[mdw]

Maybe the marketing guy got the story wrong?? Maybe "five or six figures" is what ND folks paid for the bandwidth necessary to keep the parked names up. That's a lot of money to spend on bandwidth, but I suppose they were desperate and paid top dollar? Just idle speculation here obviously.

[jacksonm]

Originally Posted by mdw

Maybe the marketing guy got the story wrong?? Maybe "five or six figures" is what ND folks paid for the bandwidth necessary to keep the parked names up. That's a lot of money to spend on bandwidth, but I suppose they were desperate and paid top dollar? Just idle speculation here obviously.

As far as I can tell, I can't access namedrive or any of my parked names at all.

They are off the radar, dropping connections. What else can they do?


[root@tokyo ~]# wget http://www.namedrive.com
--08:17:38-- http://www.namedrive.com/
=> `index.html'
Resolving www.namedrive.com... 216.8.177.27
Connecting to www.namedrive.com|216.8.177.27|:80... failed: Connection refused.



.

[thefabfive]

A sampling of my parked pages are resolving.

The ND home page is still down though.

[bwhhisc]

Originally Posted by jacksonm

As far as I can tell, I can't access namedrive or any of my parked names at all.

Same, i can resolve parked pages, but can't get into homepage for namedrive.

[burnsinternet]

Suggestion for everyone: Have your parked domains loaded and ready to go on Sedo or other. If this kind of thing happens again, just change your DNS until it is over. Leave a low performing site on ND to check the status.