13 ms·
MasterCard under DDOS, can't process SecureCode online payments
- chrisbolt 16y agoOnly SecureCode is affected (the MC equivalent of Verified by Visa), not all MasterCard online payments.
- gasull 16y agoThanks. I updated the title.
- marknutter 16y agoI think this is setting a very dangerous precedent. Yes, it was lame what Mastercard did to Wikileaks, but it wasn't technically illegal. What Anon is doing to Mastercard, however, is completely illegal and damaging, not only to MC but to its customers too (who are innocent bystanders in this case).
- carbocation 16y agoI'm going to try to articulate a position that I think that I understand but is not mine, so please bear with me. Let's put aside what is "legal" and focus on what is "socially desirable" business behavior from the perspective of Anon. MasterCard, as a private entity, has wide leeway in how it chooses to deal with other private entities such as Wikileaks. Is this socially desirable? While I have no special insight into what Anon is thinking, I would surmise that they are not pleased that private entities are restricting free-flow of information and acting as a state's agents even when not compelled to do so by the force of law. We've heard from many business (Amazon, PayPal, etc) that blocking WikiLeaks (and consequently inhibiting free distribution of classified US documents and secret corporate information) is, at its core, a profitable business decision. I would guess that Anon is trying to send a message that such an "anti-freedom" decision (scare quotes intentional) can instead become very expensive.
- marknutter 16y agoBut what is "socially desirable" is a completely subjective thing though. There could be a small group of Anons that think banning gays from entering the military is "socially desirable" and use that as a basis for taking down websites of companies who work with the military. It's Mastercard's choice whom they do business with, and by launching this attack Anon is only further solidifying the misguided popular belief that Wikileaks is akin to a terrorist organization. It may seem like a victory in the short term, but in terms of Wikileak's PR I think it's a huge setback.
- borism 16y agoIt's Mastercard's choice whom they do business with No it's not.
- jlgosse 16y agoI'm really interested in this, and I'm confused as to why people are voting you up. You provided an answer with absolutely no evidence to support what you said and people find the answer either, a) Helpful or b) Interesting. Can you explain how it isn't their choice? Mastercard, VISA and American Express turn down applicants ALL the time, so doesn't this go against what you are saying here?
- defen 16y agoI'm not sure what his point was, but technically it's true, at least in the U.S. There are a host of "protected classes", and if you refuse to do business with someone because they're in that protected class, you get in Big Trouble. This includes race, color, gender, age, etc. http://en.wikipedia.org/wiki/Protected_class http://en.wikipedia.org/wiki/Protected_class
- marknutter 16y agoIt's not true, otherwise signs that say "no shirt, no shoes, no service" would be illegal. You're referring to laws against discrimination based on race, sex, or disabilities. This says nothing about refusing service to people for other reasons, such as a rowdy bar patron or someone who violates Terms of Service.
- dagw 16y agoThe cynical part of my brain is currently quite convinced that there several members of some US security agency currently on 4chan instigating these pointless attacks in an attempt further turn public opinion against wikileaks and their supporters. People quickly switch from indifferent to hostile once they are personally affected.
- borism 16y agoRidiculous. USG agencies already have their hands full of dealing with this stuff, not adding more to it.
- khafra 16y agoThe agent provocateur is hardly an unknown or last-resort tactic for any modern government: http://www.independent.co.uk/news/world/americas/fbi-plant-banned-by-mosque-ndash-because-he-was-too-extreme-2153057.html http://www.independent.co.uk/news/world/americas/fbi-plant-b...
- borism 16y agoalright, alright, you win. 4chan is CIA's covert operation to install New World Order.
- powellc 16y agoWhile I too, am not sure that I agree with the position Anonymous is taking, I do feel like the fact that even you qualify the word "illegal" with "technically." And the first reply makes a fine case for why MC's positions and reasons not to do business stink of the heavy hand of a certain first-world nation. Excepting that, I would also argue that what has happened to WikiLeaks in the wake of the documents being release by the bureaucratic nations of the world is setting a far more dangerous precedent online. I, for one, hope ICANN is working on solutions to DNS being effectively held hostage by a few sovereign nations.
- alextgordon 16y agoIf a bunch of script kiddies (albeit in considerable number) can take down MasterCard, then it's pretty much MasterCard's fault alone. It's not like they didn't have the money or opportunity.
- eli 16y agoSeriously? Blame the victim?
- redthrowaway 16y agoWhen MasterCard does millions of dollars a day worth of online transactions, which can be halted by LOIC, then yes, blame them. LOIC is really, really basic, and anon has never really gathered any respectable amount of bandwidth. Most small botnets put them to shame. What I suspect, however, is that actual botherders are using these raids as cover. They can still DDoS the target, but 4chan takes the blame. The recent addition of "hivemind" functionality to LOIC, which slaves the user's computer to an irc feed that controls targeting and firing, seems like the perfect opportunity for a botherder to set their botnet to take orders from same.
- eli 16y agoOnline transactions weren't halted, mostly just the corporate brochure-ware sites. And attacking a website is never justified. It is wrong regardless of how much effort the owner puts into securing it. Likewise, it's exactly the same crime to steal a car that has an alarm as one that doesn't.
- redthrowaway 16y agoMeh. I'm not defending the attacks. I do think, however, that the moral landscape is significantly greyer than you depict. No nascent movement in history has been morally acceptable by the standards of the establishment. Whether this becomes the American Revolution, the Khmer Rouge, or That One No One Ever Heard Of Or Remembers remains to be seen. As to your specific point, leaving my car unlocked with the windows down overnight on a dark street in Detroit doesn't make the inevitable thieves justified, but it does make me retarded, and completely undeserving of sympathy.
- ceejayoz 16y agoMaking Rosa Parks get out of her seat was lame but not technically illegal. Her refusal was completely illegal and plenty of folks argued it was damaging. I don't see why civil disobedience should cease to be civil disobedience just because it's on a computer.
- eli 16y agoYes, and it kicked off the Montgomery Bus Boycott. Not slashing tires or road blockades.
- bradleyland 16y agoAn incredibly critical point. A boycott is only effective if the disgruntled group has enough population to affect the business of the target. There in lies the problem with a DDoS attack. It is not a symmetrical response. A small group of people could execute such an attack, while the majority of actual customers may not have an issue with their actions.
- jacquesm 16y agoJudging by the difficulty that MC has in dealing with this one I wonder how big that 'small group' really is.
- eli 16y agoAs compared to total MC customers and daily transactions, I'm sure it's infinitesimal
- danohuiginn 16y agoaccording to netcraft, it only took 400 machines. http://news.netcraft.com/archives/2010/12/08/visa-com-taken-down-by-botnet-volunteers.html http://news.netcraft.com/archives/2010/12/08/visa-com-taken-...
- Daishiman 16y agoA small group of MC lawyers and executives also has say on whether you can use of the three largest payment methods on the planet to fund a group you sympathise with. When it comes to oligopolies, the usual rule of corporations as private, independent entities that can do whatever they please, goes out the window.
- lhnz 16y agoI guess it goes to show that Mastercard should think about what is best for their customers as opposed to what is best for the government. The reality is that, nowadays, if you make an unpopular decision with a large part of internet users you may get DDOS'ed.
- rorrr 16y agoVisa + Mastercard is a duopoly. They have been abusing their domination for years. I don't feel sorry for MC.
- marknutter 16y agoYou do realize that there are actual human beings working for Mastercard who are just like you and I who are getting hurt by this, right? There are real people behind these websites.
- steveklabnik 16y agoFollowing orders is not a valid defense for wrongdoing. If you work for a company, you're complicit in their wrongdoings.
- nkassis 16y agoThat's not true at all. A secretary filling documents should not be held responsible for the way the corporation is run. That's just plain idiocy to claim that employees of a company are to be held responsible for corporate policy. Now if they did something illegal while working, that' another story but I don't think that's what you meant here.
- steveklabnik 16y agoNope, that's exactly what I mean here. Now, we're talking about my own personal set of ethics here, but it's pretty straightforward: * Your role is an employee is to help accomplish a corporation's objectives. * (In this case) the corporation's objectives are unethical. * You're contributing to something unethical. That being said, nobody is perfectly ethical. But if I worked for Amazon or PayPal, I'd have quit by now, and I'd never have taken a job with MasterCard in the first place. I also don't mean "held responsible" in a legal sense, either. They've done nothing wrong legally. Legality != morality, though.
- 16y ago
- roel_v 16y agoMeh. In a few years when we all depend on the internet even more, the law will catch up with this sort of internet petty vandalism. A couple of people will get sued and thrown into jail, joe schmoe user will be cut off from the internet the moment a ddos is detected from his ip, and people coordinating 4chan ddos'es will be tracked and arrested. The only reason these things work today is because of a lack of urgency. I mean, when this starts happening every week, people will call for regulation, it may take a few years to get it sorted out politically, then another few before the policy catches up, and things like this won't be possible any more. In the mean time, the damage done is relatively small. Yes it sucks for some online merchants, but let's not blow this out of proportion. I remember 10 years ago there was a 'digital sit in' (the term 'ddos' didn't exist yet) on my at that time employer's website. There were camera crews coming in, interviewing our CEO's, it was big news. In reality, the effect was minor; averaged over the few days around it, the loss of sales was not even statistically significant.
- ZoFreX 16y agoI for one can't wait for the day when a government agency can detect that I'm initiating a DDOS from my home connection the second I start and immediately disconnect me, without a warrant, court order or trial.
- SageRaven 16y agoThen you initiate it from the McDonald's parking lot, silly! Isn't free wireless grand?
- roel_v 16y agoWhen you drive too fast with your car, the policy will stop you and give you a fine, or take away your car on the spot. All within the bounds of the law, court-supervised. I'm not seeing the difference. Imagine 100 years ago, when building and driving cars was practiced by enthusiasts only, how they must have lamented the prospect of not being able to drive as fast as they would like to on all roads! I'm not saying I'm looking forward to more control over the internet, but the Wild West days are over, and as the internet and computers become more fundamental in societal functioning, some form of oversight to safeguard a good functioning are inevitable.
- tshtf 16y agoI wonder if the perpetrators of this attack realize an attack against e-commerce may attract the attention of federal authorities more than one against a quasi-religious group.
- fluidcruft 16y agoYeah, it's almost as if the government and large businesses only care about each other.
- tobtoh 16y agoCyber warfare has always been a staple of sci-fi fiction, but generally between nation states. I can't help but wonder if the reality is that this 'warfare' won't be so much between nation states, but between governments and the public and we're witnessing the start of this with a secretive and paranoid government(s) on one side and a distrusting and increasingly activist 'public' on the other. Corporations are stuck in the middle looking at their bottom line, but pressured from both sides.
- DanielBMarkham 16y agoI read an interesting editorial a few months back -- can't remember where -- that basically made the counter-intuitive point that we are not headed towards totalitarianism. Far from it. We are headed towards mob rule. The writer used the various strikes and protests in Europe as an example. His point was that as the nation-states became less relevant, people would begin to more closely associate in virtual groups than geographic ones. I _also_ read the recent leaks about China, which leads me to believe that the Chinese think they can keep a lid on the internet. This could be the beginning of a long, drawn-out period of chaos and overreaction by all sides. Sure would suck to have to choose between that and totalitarianism (even if, in the end, totalitarianism wouldn't work) Perhaps this is some author's overactive imagination though. I sure hope so.
- smackay 16y agoPublic demonstrations in Europe these days are generally well-behaved. Probably the main motivation for taking to the streets is to ensure that the government at least acknowledges an issue rather than simply ignoring as was case in the past. The anarchist groups active today are a little less troubling than groups like the Red Army Faction, Red Brigades and the Irish Republican Army that were a feature of the 1970's and 1980's. The real danger of mob rule might come from unscrupulous politicians making capital from social tensions. The recent series of expulsions of Romany from France and Italy were certainly a very troubling reminder of Europe's recent history.
- jacquesm 16y ago
- eli 16y agoI'm really not a fan of Internet mob justice. I don't see how this attack helps Wikileaks in any way. It's only going to make it harder to find anyone willing to do business with them.
- nano81 16y agoExactly. Not only that, but it will make them seem even less sympathetic in the eyes of the general public.
- cryptoz 16y agoIt doesn't help WikiLeaks and it's not supposed to. What you're seeing is a group of people who looked at MasterCard's decisions, and reacted to prove them wrong. MC thought that preventing money from going to some people who move information around was a smart business decision. Anonymous replied with, <<No, trying to prevent the free flow of information is a bad business decision.>> They do this, presumably, with the idea that next time MC will think twice before doing their part in silencing the flow of information. This is all irrelevant to WikiLeaks. They have nothing to do with this at all, except that their particular case provides Anon with a clear example to set for MC.
- eli 16y agoYou really think cyber terrorism is going to make Mastercard more likely to want to work with similar groups in the future?
- cryptoz 16y agoWoah, don't put words in my mouth like that! I never said I thought that. That said, I'm not sure I understand your question. Wikileaks and Anon aren't related. MC can't choose to deal or not deal with Anon. Their choice is about Wikileaks, who have nothing to do with any of this. If they continue to choose to ban payments through their system to Wikileaks, I assume they'll continue losing money from DDoSs. shrug I don't have any idea what'll happen, but I think you have to accept that Anon has a point, even if you don't agree with them. MC slows the flow of information. Anon slows the flow of cash to MC. If MC doesn't respond, it seems like they'll keep losing money.
- andrewingram 16y agoI'm fairly naive about the specifics of a DDOS, but it's such an obvious vector of attack that I'm surprised it's a major vulnerability. Could anyone explain what it would take to minimise vulnerability to such attacks? I would have expected the standard load on SecureCode to be pretty high anyway, so I'm surprised that an attack brought it down. I welcome anyone to fix my reasoning :)
- cryptoz 16y agoThere's really no way around a DDOS, except to pay for enough servers to swallow all the fake requests and real requests. That's probably far too expensive to do - at least for now. Maybe the cloud can bring a solution to this, with the idea of spinning up new VMs as needed. Basically, if your site is open to the public then it's open to bots. And there are far more bots than people. So if someone directs their bots to your site, you'll go down. End of story.
- jacquesm 16y agoThere are plenty of ways to defend against this kind of attack, with varying degrees of efficiency and automation.
- cryptoz 16y agoYeah, it looks like I'm wrong about that. But then, I'd have to raise the question why MC hasn't done anything (successfully) yet to defend against this? They must be losing hundreds of thousands of dollars (per hour? not sure of volume here) because of the SecureCode payments failing all over the place. Also, a falling trust from consumers and vendors. It seems mission-critical to get their site back up, but they haven't. I assumed that was because they couldn't. But if you say they can....why haven't they?
- jacquesm 16y agoMy guess would be that they incorrectly estimated the magnitude of any attack that they would have to deal with and are now scrambling to get a procedure in place that allows them to forward lists of 'known bad' ip addresses to their upstream providers to be placed in ACLs. Everything is hard the first time.
- m_eiman 16y agoA better way to show Mastercard that you don't like what they're doing would be to cancel your Mastercard and/or stop accepting MC payments.
- MikeCapone 16y agoThis only works if enough people do it AND tell MC (and possibly the media) why they're doing it, though.
- protomyth 16y agoYes, and that is how it is supposed to work. Boycotts and demonstrations not working, does not justify attacks.
- jasonlotito 16y agoThe problem is this isn't how it happens. First, consider that no attack is really happening. It's merely digital, it harms no one physically. So this is merely economic harm (indeed, calling it an attack only elicits sympathy for the victim). Gandhi used an attack on the economy with his salt march. He broke laws. Boycotts and demonstration raise awareness, but unless it reaches a critical mass, they don't work. Boycotts and demonstrations that disrupt (like marches through the street or strikes) are other forms of economic attacks that cause real monetary loss. Voting with your wallet only works so far. Usually you're in the minority. Not because you're wrong. Even elections understand this: the results are based on those who voted, not those who could vote. Review history, and time and time again you'll see economic attacks as parts of non-violent means.
- xenophanes 16y agoIt does harm people physically when, say, their sandwich purchase doesn't work and they become overly hungry -- physical stomach pains. And maybe a diabetic somewhere will end up in the hospital. And what about the guy who was buying safety equipment and now he has to do the first day without it?
- user24 16y agoI'll be interested to see if Mastercard's stock takes a dive as a result of this. Not that I don't expect it to recover quickly of course. But it does make me wonder who first suggested 'operation payback', and what exactly their motives were...
- user24 16y agothere's been no impact on their price that I can see so far.
- adriand 16y agoIt's sort of interesting - maybe even ironic, although I don't know if that adjective is quite applicable - that when a news story comes out that says that a major website is down due to DDOS, the first thing I do - and probably what many others do - is try to go to that website to see if it's still down. That, of course, must make the situation so much worse.
- jmg 16y agocompared to the traffic the servers are seeing from the bots, the single requests of curious people is pretty negligible.
- marknutter 16y agoThe really sad part about this is the people who are probably getting most hurt by this are the web developers who maintain mastercard.com; probably a few fellow HNers. I'd hate to be in their shoes right now.
- deleted 16y ago[deleted]
- faragon 16y agoBetter attack: reduce the credit card usage, and try to pay more with cash. As both MasterCard and Visa (the ones against Wikileaks) take the gross of its revenue from retail and pay by credit, that could really hurt them... but without doing anything illegal. It's just business: you fuck Wikileaks, I reduce your profit, dear [put your favourite megacorp name here]. Boycott list: * Amazon (Amazon stops hosting WikiLeaks website [Reuters, 20101202]) * Tableau Software (Another Falls: Tableau Software Drops Wikileaks Data Visualizations [20101202]) * Everydns.net (WikiLeaks fights to stay online after US company withdraws domain name [guardian.co.uk, 20101203]) * Paypal (WikiLeaks loses PayPal revenue service [cnn.com, 20101205]) * PostFinance (Swiss bank freezes WikiLeaks founder's legal defense fund [rawstory.com, 20101206]) * MasterCard (MasterCard pulls plug on WikiLeaks payments [cnet.com, 20101206] * Visa (WikiLeaks loses PayPal revenue service [ibnlive.in.com, 20101207]) * Twitter??? (it was or it wasn't censorship?)
- jorgem 16y agoBoycotts are good way to go. But for giant companies like Amazon and Paypal, it is unclear that they would be able to correlate determine why their sales are going down. Unless the Boycott is huge.
- euccastro 16y agoBoth Amazon and Paypal ask you why you closed your account with them. Now, if you just reduce your usage of their services, then you're right, it'll be hard to attribute.
- Andrew_Quentin 16y agoIf Private companies, all in concert, deny a party the ability to publish for whatever reason, is that different from government censorship? I think not. It is of course if it is only one private company, because the individual has a choice, but if all private companies deny it, then the individual has no choice, thus it is no different than the government itself having denied it. This that we are seeing, I believe, is the connection between corporations and government in action, the business-government complex if you like. Private companies should not have the right to discriminate based on other's beliefs or opinions.
- ars 16y agoSo basically if you help wikileaks you'll be DDOSd by the (presumably) government. If you cut them off you'll be DDOSd by other parties. The only solution is to have nothing to do with them. Not exactly an optimum solution - I'd much rather be cut off and constantly find new hosts than have people afraid to have anything at all to do with me. These attacks are not helping wikileaks.
- danilocampos 16y agoDisclaimer: I just finished Accelerando a few days ago (late to the party). I'm hopped up on futurist vision. First, let's stipulate that 4chan's Anonymous raids are mostly juvenile and often ineffective at doing anything meaningful to their targets. At the same time: The ability of a community to completely self-organize, without central direction, and instantly execute a publicly-visible plan like this is without precedent in human history. It stands to reason that as time goes on, larger groups of people will become involved in communities that exhibit 4chan-like cohesion. A larger pool means a higher likelihood of these groups including people with the knowledge and ability to do ever-increasing damage. The long-term implications are interesting. Into the future, are we talking about the instant formation and dissolution of "terrorist" or "dissident" groups, bound together by transient common interest and gone again within days or hours? If you're a government or corporation, this is terrifying. You can keep tabs on other governments, and even traditional terrorist cells, which each move at the speed of the usual group dynamics, proportional to their size. But what the hell do you do about groups you can't predict that are gone before you even figure out what's wrong? Groups that aren't bound together by national identity or other easily quantified affiliations – just ideas, ideals and transient events? There's something meaningful here that points to how we all get along in the future, in the same vein as the "post-secrecy world" presaged by Wikileaks-style activism enabled by network technologies. Or maybe I just need a nap.
- tvon 16y ago> The ability of a community to completely self-organize, without central direction, and instantly execute a publicly-visible plan like this (...) I don't see any reason to believe it went down that way. It's probable it was a group who already had much of the ability in-place to execute an attack like this, and who decided to target mastercard.com because it was found to be vulnerable, or because paypal and amazon were out of thier reach.
- danilocampos 16y agoThat group would be Anonymous, in all of its gossamer affiliation. The idea of another group using 4chan/Anonymous as a front for its own goals seems needlessly complicated. "Anonymous" does all of this for Scientologists and cat abusers, why not Mastercard?
- motters 16y agoAs an organisation Wikileaks should distance themselves as far from this sort of activity as possible. If they condone it, or even merely appear to condone it, then their fate is most certainly sealed.