3 ms·

> We had the famous census night access issues due to a DDoS and I am just waiting for that data to leak That wasn't a DDoS, that was a few million Australians

by L_226 9y ago

> We had the famous census night access issues due to a DDoS and I am just waiting for that data to leak That wasn't a DDoS, that was a few million Australians trying to use a poorly implemented system.

NamTaf 9y ago
I thought they blamed a DDoS by unknown parties in addition to the unexpectedly high load of us all trying to access it?
- SyneRyder 9y ago
  They tried blaming it on that, but it was just incompetence. They didn't even buy DDoS protection services. There's more details on the inside story of the Census here: https://risky.biz/censusfailupdate/ https://risky.biz/censusfailupdate/
  - lmm 9y ago
    "DDoS protection services" are a racket. Build the thing right and you don't want or need them.
    - ironic_ali 9y ago
      You haven't worked in a govt department have you. In one meeting the BA Ministry lead fell asleep and actually started snoring. In another, the ministry infrastructure architect said, "oh, that thing, I've lost the word, what is it?" - "a server?". As an ex antipodean govt contractor, I'm not even kidding. Many other stories of complete fuckwits who had no right to touch a keyboard, never mind run things. My conclusion was anyone with any smarts was completely bamboozled by the abject incompetence and left to the private sector, leaving behind the above characters. Unbelievable, but true. Saying that, don't believe me, get a job there and I see for yourself :)
      - lmm 9y ago
        Requiring them to buy DDoS protection would be part of the problem, not the solution.
sasas 9y ago
Risk Biz has more details [1].. Recommend the podcast! * IBM and the ABS were offered DDoS prevention services from their upstream provider, NextGen Networks, and said they didn't need it. * This plan was activated when there was a small-scale attack against the census website. * Unfortunately another attack hit them from inside Australia. This was a straight up DNS reflection attack with a bit of ICMP thrown in for good measure. It filled up their firewall's state tables. Their solution was to reboot their firewall, which was operating in a pair. * They hadn't synced the ruleset when they rebooted the firewall so the secondary was essentially operating as a very expensive paperweight. This resulted in a short outage. [1] https://risky.biz/censusfailupdate/ https://risky.biz/censusfailupdate/

by L_226 9y ago

NamTaf 9y ago

I thought they blamed a DDoS by unknown parties in addition to the unexpectedly high load of us all trying to access it?

SyneRyder 9y ago
They tried blaming it on that, but it was just incompetence. They didn't even buy DDoS protection services. There's more details on the inside story of the Census here: https://risky.biz/censusfailupdate/ https://risky.biz/censusfailupdate/
- lmm 9y ago
  "DDoS protection services" are a racket. Build the thing right and you don't want or need them.
  - ironic_ali 9y ago
    You haven't worked in a govt department have you. In one meeting the BA Ministry lead fell asleep and actually started snoring. In another, the ministry infrastructure architect said, "oh, that thing, I've lost the word, what is it?" - "a server?". As an ex antipodean govt contractor, I'm not even kidding. Many other stories of complete fuckwits who had no right to touch a keyboard, never mind run things. My conclusion was anyone with any smarts was completely bamboozled by the abject incompetence and left to the private sector, leaving behind the above characters. Unbelievable, but true. Saying that, don't believe me, get a job there and I see for yourself :)
    - lmm 9y ago
      Requiring them to buy DDoS protection would be part of the problem, not the solution.

sasas 9y ago

Risk Biz has more details [1].. Recommend the podcast! * IBM and the ABS were offered DDoS prevention services from their upstream provider, NextGen Networks, and said they didn't need it. * This plan was activated when there was a small-scale attack against the census website. * Unfortunately another attack hit them from inside Australia. This was a straight up DNS reflection attack with a bit of ICMP thrown in for good measure. It filled up their firewall's state tables. Their solution was to reboot their firewall, which was operating in a pair. * They hadn't synced the ruleset when they rebooted the firewall so the secondary was essentially operating as a very expensive paperweight. This resulted in a short outage. [1] https://risky.biz/censusfailupdate/ https://risky.biz/censusfailupdate/