7 ms·
This is the official response from SE: https://meta.stackexchange.com/questions/376060/update-on-the-ongoing-ddos-attacks-and-blocking-tor-exit-nodes https://m
by fabian2k 5y ago
This is the official response from SE:
https://meta.stackexchange.com/questions/376060/update-on-the-ongoing-ddos-attacks-and-blocking-tor-exit-nodes https://meta.stackexchange.com/questions/376060/update-on-th...
For the past month Stack Overflow has been hit by weekly DDoS attacks that progressively grew in size and scope. In each incident, the attacker(s) have been changing their methodology and responding to our countermeasures. Initially we were able to detect and mitigate the attacks before any performance degradation could be noticed but the latest attacks ramped up very quickly and the site was brought down before we could react.
While we cannot go into specifics on each attack in order to maintain opsec and not tip off the attackers, we can say that each individual attack has been using different IP addresses and targeted different aspects of the site. During an outage, our top priority is always getting the site back up and running. After traffic has been stabilized, we perform a post mortem for the incident where we assess and improve upon the actions we have taken.
During the outage last Sunday, we noticed that a large amount of the DDoS traffic originated from Tor exit nodes. The decision to block Tor exit nodes did not come lightly, in fact Teresa, our CTO was on the call when we discussed remediation methods. Due to the persistent nature of the attack and our desire to bring the site back up as fast as possible we made the decision to block all DDoS traffic endpoints, including these Tor exit nodes.
We did not target, nor set out to block all traffic from Tor, that’s not something Stack has ever done. However, due to the shared nature of Tor exit nodes, some of them were also routing DDoS attacks to our sites and were blocked. We have tried removing these blocks between attacks but this action has resulted in further site outages as DDoS efforts continue to originate from these exit nodes. Unfortunately blocking the Tor exit nodes also blocks legitimate users from using them. An immediate solution for users who find themselves blocked is to access our site from other IP addresses, via home internet, work internet, or other VPN services.
We are continuing to evaluate the situation and will keep our community updated. Thank you for your patience and understanding.
- rafale 5y agoI wonder what's the motive to target StackOverflow? A disgruntled ex-employee?
- colinmhayes 5y agoProbably trying to ransom if I had to guess.
- HWR_14 5y agoWell, they just got rid of their job board.
- soheil 5y agoProbably the owner of one of those stackoverflow clones would see a bump in traffic => more ad revenue if SO is experiencing slower response times/downtime.
- jandrese 5y agoShould we be investigating those Expert Sex Change people?
- Godel_unicode 5y agoPresumably advertising for the ddos service; "pay us and we'll knock your target offline! Remember, we're the ones who killed stackoverflow, we can help you"
- StevePerkins 5y agoWhat an interesting question. When I first got into computing back in the 80's and 90's, people wrote viruses just for the challenge and fun of it. Some people just want to watch the world burn. This was seen as obvious motivation, it was unquestioned. It was only after crypto mining and ransonware became big things in the 2010's, that people started assuming a financial motive behind attacks. Up through the mid-2010's, people posted amateur porn largely for personal fun and ego boost. Occasionally, regular people would try to make a buck. But it was mostly people posting selfies to /r/gonewild because they enjoyed the attention. Then OnlyFans came out, and now virtually anyone posting amateur adult material can be assumed to be driving traffic to a monetization channel. Sorry for the tangents. It just strikes me how normalized "side hustle" culture has become. It was not very long ago at all that it wouldn't even occur to most of us to question a DDOS attacker's "motive".
- arwineap 5y agoThank you for posting this, there is some tin foil hat stuff going on deeper on the thread, so I hope this stays up top.
- zozbot234 5y agoYes, it's a useful response. What happens if they use traffic shaping to limit Tor traffic to a manageable share of their resources? This might ultimately deter the attacker since the end outcome would simply be a variable amount of inconvenience for legitimate Tor users.
- AiX2ohja 5y agoFor anyone who is using Tor and needs Stack Overflow knowledge while they're doing such mitigation, Kiwix [1], best known for allowing to read wikipedia offline, also provides dumps of Stack Overflow that you can download and browse locally [2]. It's massive, though (134gb). [1] https://www.kiwix.org/en/ https://www.kiwix.org/en/ [2] https://wiki.kiwix.org/wiki/Content_in_all_languages https://wiki.kiwix.org/wiki/Content_in_all_languages
- mrobot 5y agoWhat is up with the privacy policy and data usage? The app store information says this: --- App Privacy The developer, Wikimedia CH, has not provided details about its privacy practices and handling of data to Apple. For more information, see the developer’s privacy policy. ---- ... then you click the link for "developer's privacy policy" and it goes to a 404 at http://www.kiwix.org/impressum/ http://www.kiwix.org/impressum/ ... then you go find the privacy policy on the website at https://www.kiwix.org/en/legal/privacy-policy/ https://www.kiwix.org/en/legal/privacy-policy/ and it says: "This privacy policy applies to the website www.kiwix.org only. It does not cover our subsites like wiki.kiwix.org or download.kiwix.org."
- unethical_ban 5y agoYou use Kiwix offline. You download a Kiwix database of the content you wish for. If you can get the app and the database on tor, then you're golden.
- mrobot 5y agoHm. But the privacy i was interested in was the privacy during app usage... What data is Wikimedia CH collecting about me and why won't they say?
- snthd 5y agoThey could run their own stackoverflow .onion service and advertise it in the site headers [0] (including on the block page). Then the onion traffic can be handled differently (maybe DDoSing the .onion will only affect Tor users, or the resulting .onion resource usage is throttled). Worst case a readonly version of the site would be better than nothing. Something similar could be done with the existing tor exit node blocklist, but maybe this is easier to separate from existing infrastructure. [0] https://community.torproject.org/onion-services/advanced/onion-location/ https://community.torproject.org/onion-services/advanced/oni...
- admax88qqq 5y agoYes they _could_ do a bunch of engineering and infra work to support a niche use case.
- YesThatTom2 5y ago(Your sarcasm may have been too subtle for the average reader.)
- BatteryMountain 5y agoWhat do you mean?
- z3t4 5y agoAt stack overflow scale a "niche" use case could mean more users then your average web site.
- soheil 5y agoWhatever is deciding if the traffic is tor or not can get ddos'd too.
- junon 5y agoEh? That's not how hidden services work.
- soheil 5y agoThe # of tor exit nodes relative to IP addresses available to people doing the DDoS is miniscule. I'm so tired of company blocking tor users and always claiming this as the reason. Any IOT device, routers with admin/pass as login, smart cameras, grandma's old PC and a million other types of devices are fully susceptible to being hijacked as a proxy giving the attacker an unimaginable number of IP addresses.
- kayodelycaon 5y agoYet, geo-ip and service provider (AWS) blocks are extremely effective at blocking these kinds of attacks. The issue is there is no list of IPs that can be identified and blocked with any reliability. It is impossible to separate valid connections from invalid. When the vast majority of traffic (99+%) is malicious, slamming the door is the most viable solution. If there was a good way, Cloudflare would have solved it. Cloudflare hasn’t been enough for my company. We had to add temporary Geo-IP blocks just to get the site up.
- soheil 5y agoSeems to me tor needs to implement a way to blend in better with the rest of internet traffic instead of it being detectable as an exit node so easily.
- zozbot234 5y agoTor incoming traffic is easy to detect and block on purpose. It's not trying to hide or 'blend in' via technical means, it's seeking social legitimacy for privacy-enhanced traffic.
- soheil 5y agoWhy not "social legitimacy for privacy-enhanced traffic" that is also nobody else's business to know, including the hosting providers? ie. I don't want Cloudflare CEO popping up here gloating about how they're fighting for the cause of tor users! F' that if they don't know it's there they can't take credit for it either. That's the tor I want.
- Trockiy 5y ago
- agilob 5y agoThis adds up, metrics for Tor show increased bandwidth in recent days https://metrics.torproject.org/bandwidth.html?start=2022-01-20&end=2022-02-08 https://metrics.torproject.org/bandwidth.html?start=2022-01-...
- armchairhacker 5y agoAlso SE has been down a lot yesterday.
- DoctorOW 5y ago> An immediate solution for users who find themselves blocked is to access our site from other IP addresses, via home internet, work internet, or other VPN services. Anyone for whom this is a solution has already tried it.
- tremon 5y agoThis is... interesting. Tor traffic is now high-bandwidth enough to meaningfully participate is DDoS attacks? Or is it more likely that those Tor exit nodes are on machines controlled by the attackers? A host compromise through the Tor agent? Baddies deploying additional Tor agents to better mask their activities?