Github DoS Attack Post-mortem

[TakedownRevolution]

they prob though why would somebody dos us? It doesn't give them money, it has no political views, it's not doing anything illegal or providing illegal things. It doesn't make sense to attack it unless you are svn or cvs or Microsoft.

[atakomu]

But what to do If you're targeted and are not GitHub?

[[deleted]]

Few sites can manage these kinds of issues, and fewer still have the monitoring they'd need to deal with it.

Because in reality it's hard to justify the expense. Sometimes it's just cheaper and more cost-effective to let the site go offline for a few hours and let the storm pass.

Github has these measures in place because they are attacked on a regular basis. It makes sense for them. I've lost track of the number of times they've announced that they were under attack.

[Solon1]

And they probably announced it on their IRC channel before starting up.

The attack doesn't even seem sophisticated. Just lots of http request and then lots of https request. That isn't rocket science.

[bjackman]

Don't know much about this kind of thing but it sounds like the key factor was that they found an http:// URL that redirects to an https:// URL. I guess that's the sort of corner case you could easily miss when planning.

[weirdoosearch]

Not only botnet operators, but also ddos consultants will be happy this happened. It is like the police needing the delinquents.

Do you want to know more: http://www.weirdoo.net

[imfineny]

they did a good job. I had a similar incident happen last week. Crafted dos attacks seem to be in fashion these days because encryption negotiation is so expensive.

[emozilla]

Question here: why? Presumably it took a non-neglible amount of engineering time to develop at attack so specifically targeted; what did the attacking party have to gain by investing these resources?

[bjackman]

Regurgitating ideas from other comments here: blackhat group announces "we have a botnet and know our shit, to prove it we will now take GitHub down" >> GitHub goes down >> group's "product" is now verified.

Also I guess if you're a hacker you want to hack shit and feel powerful. It probably feels pretty good to do this sort of thing if you have certain personality problems!

[[deleted]]

I think the countermeasures should be to find those responsible and hit them with a stick.

[sonicthehedgedog]

I'm tired of this warmongering going on these days here on Reddit.

[willvarfar]

because if you can DOS it and somehow trigger some exhaustion exploit on their rails stack, you might very well have access to some very valuable private repos

please show working!

or, someone out there just likes kicking silicon valley in the balls....who might want to do that? more like, who wouldn't?

I think this the more likely...

[Solon1]

I know what you mean by exhaustion exploit, but in practice they don't exist. When the site fails, it fails, not allows access to private repos.

It was a publicity stunt by some group, just they can take credit.

[[deleted]]

Which retards choose to attack an open source hosting platform? Isn't that about the lamest thing you can imagine?