Forum.419eater.com is currently under a small DDOS attack

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Mon Aug 11, 2008 4:32 am

Thanks, Rover, for keeping the site up and running! Thumbs up

Posted: Mon Aug 11, 2008 5:12 am

Nice job Rover,

I'm stocking the bunker bar now, and getting the pizza out of the freezer, Vodka and gin are in the chiller, beer is in Obis' fridge, pimms I have had diverted from the Mod lounge to the Bunker, although if the Mods turn up it may be messy

Posted: Mon Aug 11, 2008 6:16 am

Looks like aa419 is down Sad

Posted: Mon Aug 11, 2008 7:09 am

Thanks Rover for your hard work, now do you manage to get any sleep.

Posted: Mon Aug 11, 2008 8:16 am

Thanks for the hard work, Rover. Glad to know that you are capable of fending off some very pissed-off lads.

Posted: Mon Aug 11, 2008 8:27 am

I noticed it was sluggish last night. All seems to be running smoothly now. Seems to be a really effective little script you've got running there, Rover Thumbs up

Posted: Mon Aug 11, 2008 11:35 am

I donning my tinfoil hat and underware. your the man Rover. keep hitting them with a big pointy sticks.

Posted: Mon Aug 11, 2008 12:10 pm

The attack has slowed down as of this morning we only had four bots attacking!)

I see aa419.org is still down Sad

Let's not let our guard down just yet - the first round could simply have been the "scouting party"

Well if anything the attack gave us a chance to test out the anti-ddos measures that I put in place last year. What I can say is that the systems did extremely well at blocking the attack (actually I think it did better than expected)

I will continue to check the firewall for dropped packets and let you know once I see no more bot attacks

Posted: Mon Aug 11, 2008 12:17 pm

Thanks Rover,

We definitely appreciate the effort required to keeping this site in lad-battle readiness.

Posted: Mon Aug 11, 2008 2:32 pm

Rover deserves the highest honor we can bestow upon him in his battle with the bots:

THE CROIX DE DDOS

Thank you, Rover, for having seen to our defences. bow_down

Posted: Mon Aug 11, 2008 2:45 pm

I'm being g selfish here Laughing

I'm busy with quite an interesting bait at the moment so it is important to keep eater up in order to use the resources here !

Posted: Mon Aug 11, 2008 3:20 pm

Rover, great job. But when you say you're shutting the bots down, do you mean you just block them at the firewall, or are you actually doing something to stop them sending the attacks?
Just curious, if you don't want to give out any detail on what you do exactly, that's ok of course.

Posted: Mon Aug 11, 2008 3:37 pm

What I mean is "shutting them down from slowing down our server" So yes effectively I am just blocking them at the firewall using various automated scripts that I have written that detect bots as opposed to regular users. I wish there was a way for me to stop them sending attacks. Unfortunately not. Sorry for the misunderstanding there but no I am not stopping them from attacking us. They continue to attack us, we just drop all their packets.

Baiting Guru Joined: 07 Jan 2007 Posts: 2922

Tech question. I kinda understand that 'someone' uses (hijacks?) various unprotected pc's to send more bots. But is there anyway to figure out the originator?

Posted: Mon Aug 11, 2008 3:57 pm

Not really - remember all we see is the bots coming in. Who they belong to or who they are talking to prior to attacking us is unknown to us

Baiting Guru Joined: 07 Jan 2007 Posts: 2922

I gotta ask then what a bot looks like. I'm guessing that it's code of some type?

Oh and what firewall do you recommend? I'm running McAfee at the moment.

Posted: Mon Aug 11, 2008 4:36 pm

^^Here is a decent firewall mate. Possibly a little more hardcore then the average home user needs. If not then what the hell are you up to? Laughing

http://www.honeynet.org/ Everything you wanted to know about botnets

Posted: Mon Aug 11, 2008 5:22 pm

Ahh pissed off Ivans/Vlads. Guess I'll have to get some... "extra" kills in on my 3 days off. Twisted Evil

Posted: Mon Aug 11, 2008 6:00 pm

Thanks for all you do Rover!

I'll pick up a new tin foil hat on the way home from work. Might grab some tin foil underbritches too just to be safe. Don't want the "boys" botted!

Posted: Mon Aug 11, 2008 6:39 pm

Donato wrote:

I gotta ask then what a bot looks like. I'm guessing that it's code of some type?

Oh and what firewall do you recommend? I'm running McAfee at the moment.

As far as firewalls are concerned - there are many to choose from a hardware firewall is probably your best bet as opposed to a software firewall.

Every ddos we have had the bots have looked different. Typically you pick them up in the logs. They look just like regular users except they hit your server at a rapid rate. Far faster than any user would hit your machine.

There are many strategies to employ here (I'm not going to get into what strategies we use on eater as there are multiple) however one of the tricks is to discern what the pattern is. Once you have that figured out you look for that pattern and block it as it comes in. It works really well for us. As the scripts I have written are unique (i.e only used by us) the bots have no idea what I am checking for in order to decipher if they are a bot or not. As it is a home written script we can adapt it as need be i.e for yesterdays attack I changed it three times in order to catch all the incoming bots.

Anyway - enough on that - Eater is running smoothly at the moment so lets hope they do not come back any time soon.

I did get word that aa419.org may be down due to an isp problem and not due to a ddos attack

Posted: Mon Aug 11, 2008 6:56 pm

@Full Auto

As aa419 is down you can't get any targets to dead!!

@Rover

Castlecops is down as well which would tie-in with an ISP issue.

Baiting Guru Joined: 07 Jul 2006 Posts: 5727

Bots piss me off!

Thanks Rover. It's got to be a pain in the butt not only keeping the site up but protecting it against evil-doers. I imagine there are quite a few folks out there that would like to see this site go away. Thanks for all you do.

Posted: Mon Aug 11, 2008 7:03 pm

Jayhawk wrote:

.... I imagine there are quite a few folks out there that would like to see this site go away.....

The scary thing with your statement Jay is that some of those people that you are talking about are members of this site!

Chuck Norris Joined: 11 Jun 2007 Posts: 1369

Quote:

I did get word that aa419.org may be down due to an isp problem and not due to a ddos attack

This has happened before. The folks who run Castle Cops (and also host aa419) have been having a lot of problems with their old servers and have been trying to raise funds to get new ones.

This is just a guess on my part, as I've not been able to contact anyone at aa419 since 2 days, but as Castle Cops also is timing out at the moment (with the same timeout error message), that seems to lend further credibility to the ISP issue.

However, seeing as Castle Cops are constantly fending off DDoS themselves, I think perhaps the issues they are having with their servers + any DDoS activity may be having its effect, unfortunately.

Posted: Mon Aug 11, 2008 7:17 pm

Rover wrote:

Jayhawk wrote:

.... I imagine there are quite a few folks out there that would like to see this site go away.....

The scary thing with your statement Jay is that some of those people that you are talking about are members of this site!

If you can link them it shouldn't be too difficult to at least kick those members? Or is it member's zombie PC's you're talking about? Then they should at least be warned of malware at their PC's.

Forum.419eater.com is currently under a small DDOS attack	View next topic View previous topic