sott site won't download again.

Re: sott.net down

Unfortunately I'm not skilled enough in this arena to be able to help much. All I would know to do is to blackhole the offending IP/Domains/Subnets until the attack abated. That would end up with a lot of address manually dropped and some would likely be legitimate yet spoofed and you would have to come back in later to open them up one at a time.

Too bad there is no known way to mirror out an attack so the flood reverses to the offending addresses. At least, none that I am aware of.
 
Re: sott.net down

ScottD said:
Unfortunately I'm not skilled enough in this arena to be able to help much. All I would know to do is to blackhole the offending IP/Domains/Subnets until the attack abated.

I doubt that would work since the IP's and subnets are most likely spoofed.
 
Re: sott.net down


Before the internet we know today... Back when computers had lots of pretty lights, I had a few gigs where I would wire up, in-line data stream analysers to watch data stream bits/bytes prior to coming into the physical box. Man-o-Man... I have never indulged into the exercises, but I imagine protection code could be written, but the cost of machine speed would probably be a show stopper. Plus I would think access to the physical server box would be required. I gotta think a machine can be built with self-defense, or even evilly retaliatorial, but again at what cost.?.?.?
:curse: :curse: :curse:

Non-Computer people: FYI
http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_10-4/104_ip-spoofing.html
Spoofing an IP Datagram
IP packets are used in applications that use the Internet as their communications medium. Usually they are generated automatically for the user, behind the scenes; the user just sees the information exchange in the application. These IP packets have the proper source and destination addresses for reliable exchange of data between two applications. The IP stack in the operating system takes care of the header for the IP datagram. However, you can override this function by inserting a custom header and informing the operating system that the packet does not need any headers. You can use raw sockets in UNIX-like systems to send spoofed IP datagrams, and you can use packet drivers such as WinPcap on Windows . Some socket programming knowledge is enough to write a program for generating crafted IP packets. You can insert any kind of header, so, for example, you can also create Transmission Control Protocol (TCP) headers. If you do not want to program or have no knowledge of programming, you can use tools such as hping, sendip, and others that are available for free on the Internet, with very detailed documentation to craft any kind of packet. Most of the time, you can send a spoofed address IP packet with just a one-line command.

Why Spoof the IP Source Address?
What is the advantage of sending a spoofed packet? It is that the sender has some kind of malicious intention and does not want to be identified. You can use the source address in the header of an IP datagram to trace the sender's location. Most systems keep logs of Internet activity, so if attackers want to hide their identity, they need to change the source address. The host receiving the spoofed packet responds to the spoofed address, so the attacker receives no reply back from the victim host. But if the spoofed address belongs to a host on the same subnet as the attacker, then the attacker can "sniff" the reply. You can use IP spoofing for several purposes; for some scenarios an attacker might want to inspect the response from the target victim (called "nonblind spoofing"), whereas in other cases the attacker might not care (blind spoofing). Following is a discussion about reasons to spoof an IP packet.
 
Re: sott.net down

Kinda makes me wonder what articles were posted to SOTT in the 24 hours before the attacks began, ya know? Something specific that upset someone perhaps?

If the attacks don't die down soon, maybe you could feed any new articles to the FB page as a temporary alternative. Also, I imagine someone (or more than one) out there friendly to the cause would be willing to host a 'basic mirror' of the site to keep the info available. I'd offer myself, but am pretty bandwidth restricted these days.
 
Re: sott.net down

Jason (ocean59) said:
Kinda makes me wonder what articles were posted to SOTT in the 24 hours before the attacks began, ya know? Something specific that upset someone perhaps?

Could be wrong, but my money is on the article below.

http://www.sott.net/articles/show/238372-The-Cs-Hit-List-History-Is-Bunk
 
Re: sott.net down

I just did a routine check to see if SotT was on yet and it is back up again, alive and kicking as ever. Yippee!! :rockon:
 
Re: sott.net down

Apparently, someone (i.e. a "bot") was banging away on es.sott.net.

We've taken some precautions, and we'll be taking some more soon!

Unfortunately, everyone and their dog has "just the solution" for this sort of thing, and everyone disagrees on what the best precautions are to take. So, a bit of trial and error is required. So far, we've had more successful trials than errors. ;)
 
Re: sott.net down

Mr. Scott said:
Unfortunately, everyone and their dog has "just the solution" for this sort of thing,

I'd try the dog's ideas first... ;)
 
Re: sott.net down

Mr. Scott said:
Unfortunately, everyone and their dog has "just the solution" for this sort of thing, and everyone disagrees on what the best precautions are to take. So, a bit of trial and error is required. So far, we've had more successful trials than errors. ;)


Well Done! :clap: :clap: :clap: :clap:
 
Re: sott.net down

Guardian said:
anart said:
I'd try the dog's ideas first... ;)

In my personal experience, they'd be just as likely to work as anyone else's... including mine. ;D

Don't sell yourself short! If we hadn't sorted it by tomorrow, we'd have called in the cavalry and that includes you.
 
Re: sott.net down

Laura said:
Don't sell yourself short! If we hadn't sorted it by tomorrow, we'd have called in the cavalry and that includes you.

I admit I already did a sorta pre-search, and Mr. Scott is SO right, everyone with a mail server has an opinion on dDOS. I really admire that he weeded all that data down to the best and brightest in such a short time. Mr. Scott Urber Geek, SOTT's all zippy again :)
 
Re: sott.net down

Mr. Scott said:
Apparently, someone (i.e. a "bot") was banging away on es.sott.net.

We've taken some precautions, and we'll be taking some more soon!

Unfortunately, everyone and their dog has "just the solution" for this sort of thing, and everyone disagrees on what the best precautions are to take. So, a bit of trial and error is required. So far, we've had more successful trials than errors. ;)

Ja, das ist sehr gut! :P

(Yes, that's very good)
 
Re: sott.net down

Das bot! :boat:

And something just flashed to me... What if this "little" disturbance is just a probation of, may I say, defenses of ours ... I am anxious if there are some major strikes following :huh:

Especially if Super-computer is to be involved :scared:

P.S.

I hope that somebody is backing up these priceless pages...
 
Back
Top Bottom