OcUK DDoS attack - £10,000 reward

Status
Not open for further replies.
shauncr91 said:
You know what's worse? Because I couldn't get on the forums today I actually had to do something productive :mad:
Click to expand...

Indeed I've been very bored without them! I have no where online to hang out on!

This might not be much help, but Isohunt thought it was being DDoS'd the other day but it turned out to be dodgy IE plugin to do with reading rss feeds :)
Its was assumed it was a DDoS because of where the ips were coming from, below is from their news:

"Starting a couple hours before midnight GMT on 10-Jan-2009 we started receiving a lot more requests and traffic than we would normally have at that time of day, which topped out at 8500 CPS (connections per second) before we could get in, figure out what was happening and act to mitigate it. Thankfully, the folks that attacked us the first time made it fairly easy for us to locate and filter their traffic, since I don't think there are many people living in South America or Asia who legitimately run their browsers in Russian Smile

Update: it turns out that the /js/rss hits aren't actually a DDoS like I originally thought, and is instead the fault of one of those silly IE "toolbars" that refused to respect the TTL we set in our RSS feed. Currently testing a fix, and if the fix works, I'll be sure to turn RSS back on again.

SecretSquirrel wrote:
Rounds 2 and 3 weren't so generous. Round 2 had 171,892 unique ips all hitting /js/rss.php. Round 3 is ongoing and we're still struggling to find a way to mitigate the attack beyond completely turning off our rss (which is where things stand now). So, if you've used our RSS in the past, or are attempting to use it now, and are legitimate, I would suggest that you stop using our feed until we get this figured out (which will be accompanied by a post to the front page stating that rss feeds are back on).

If you're reading this, and you're responsible for any of these attacks, I would like to give you the opportunity to be heard. You may either PM me on the forums or send us an email at admin@this site's domain."
 
skippi90 said:
If I read up on this right, does it infect other PC's?

If so, would there be symptoms?

Maybe could find it that way.
Click to expand...

Well it's normally in the form of a virus, if you have a good av and have no popups then you're likely fine, do a netstat to check outgoing connections and check your process list.
 
Napaim said:
Well it's normally in the form of a virus, if you have a good av and have no popups then you're likely fine, do a netstat to check outgoing connections and check your process list.
Click to expand...

How does someone distrubute a virus to thousands of computers?

Chimerical said:
If thats the case try suspending Tefal.
Click to expand...

According to Azza's thread, Tefal has just "taken off" and just got up and left. The thread only lasted like 3 minutes, but it seems like Tefal is no more! :eek:
 
netstat may be rooted tho... you need a router with the ability to list connections or a *nix shell that can list network stuff.
 
Chimerical said:
If thats the case try suspending Tefal, Pilky01 and Yantorsen all at the same time for a week. This will fix the problem.
Click to expand...
Fixed ;)

I read earlier up about some of the attacks being from overseas, I'd imagine that not being a huge problem, if you have a decent host you should be able to "stop" these packets upstream (and without much economic costs as OCUK are going to have like 95% UK based customers). You have to filter in tiers. What is concerning is that I think OcUK had / have blocked certain Ip *ranges* that are UK based, which anyway you look at it are going to be an absolute pain in the back side for Spie et al. Once gain all the best o luck lads.
 
I hope they arrest those responsible and show them that this kind of thing is breaching the law.

Lets see how l33t they are when they are getting an ass raping for being a noob in prison.
 
I'm also part of the 1/10 peeps, who don' have an inkiling of who is suspect:(

Reading someones post Above RE: constant pressing of refresh button was disregarded by Spie. However, there can be "Unintentional" attacks.


---------------------------------------------
WIKIPEDIA

""UNINTENTIONAL ATTACK""

"This describes a situation where a website ends up denied, not due to a deliberate attack by a single individual or group of individuals, but simply due to a sudden enormous spike in popularity. This can happen when an extremely popular website posts a prominent link to a second, less well-prepared site, for example, as part of a news story. The result is that a significant proportion of the primary site's regular users — potentially hundreds of thousands of people — click that link in the space of a few hours, having the same effect on the target website as a DDoS attack"""""""


It is Wednesday, "This-week-only" (offers) Just a thought thats all!

~Ant
 
Its removed :eek:

Stone him. :D

joking

On a lighter note:

ta3fxy.jpg
 
Status
Not open for further replies.
Back
Top Bottom