4 ms·

I run a service which was recently DDOS'd. It came immediately after a request from the police services in India to give them data on a specific user. They clai

I run a service which was recently DDOS'd. It came immediately after a request from the police services in India to give them data on a specific user. They claimed it was terrorism related. We explained our policy on that (there is a procedure but it requires lengthy legal formalities in our jurisdiction). Within hours our service was taken down. It lasted about 12 hours. We never received any ransom request. We were left with 3 possibilities: 1. Indian police/government 2. Original user 3. Total coincidence When it happens you just realize: this should not be possible. This is a game that hugely benefits the most powerful players whether they just don't bother solving the problem or actively play in it.

teddyh 3y ago
How sure are you that the request came from the actual police in India, and not somebody else? I.e. someone who might get irrationally upset when you did not give them what you wanted?
- mattw2121 3y ago
  "someone who might get irrationally upset when you did not give them what you wanted" Like the police in India?
  - teddyh 3y ago
    I would assume that the actual police have their own traditional methods of being irrationally vindictive, and would not normally restort to DDoS.
    - alright2565 3y ago
      Indian police will have a lot of trouble beating you if you live in another country.
      - m-p-3 3y ago
        Their government might though..
      - not2b 3y ago
        Google Hardeep Singh Nijjar.
        computerfriend 3y ago
        Still a lot of trouble.
    - dspillett 3y ago
      Those traditional methods don't often work very well across borders like a DDoS does. The post at the top of the thread didn't state whether or not they were based in India too.
- throw9999away 3y ago
  Yes we went through a bit of procedure to establish that. They have also been in touch with the authorities in our jurisdiction since. In fact we were contacted by multiple police authorities from different regions.
- deleted 3y ago
  [deleted]
- Polycryptus 3y ago
  Agreed, I've been through something like this before and it was not legit. They'd compromised a Bangladeshi police email account and used it to try to get data out of us.
leosanchez 3y ago
IMO. There is no way Indian Police is competent enough to DDOS your service.
- soraminazuki 3y ago
  Government authorities purchasing shady cyberweapons is a well documented issue. It would a pleasant surprise if there was any government on Earth that didn't do such things out of respect for basic human rights. https://hn.algolia.com/?q=nso https://hn.algolia.com/?q=nso
- Thorrez 3y ago
  It's not too hard to DDOS a website. Here's the 9th google result for booter service: https://nightmarestresser.net/ https://nightmarestresser.net/
- rst 3y ago
  DDoS-for-hire services exist. They don't have to build their own.
- alephnerd 3y ago
  They definitely are. Beat cops definitely aren't, but most police forces in India are state level and a couple are federal, and will usually have a Task Force devoted to offensive and defensive security, and if not, will contract out to companies like Appin Security Group (who were able to force Reuters and SentinelOne to remove their report into how the private-public cyber model in India operated [0]) Also, after the 2008 Mumbai Attacks, the Indian Ministry of Home Affairs began working on coordinating and centralizing Metadata Analysis and Monitoring [1][2][3], because they unable to trace the VoIP calls used by LeT [4]. If it was actually National Security related, it would have went through a couple fusion centers that the Indian government formed [5][6]. If it was some local PD asking the platform, they probably wouldn't have the capabilities to DDOS [0] - https://www.reuters.com/investigates/special-report/usa-hackers-appin/ https://www.reuters.com/investigates/special-report/usa-hack... [1] - https://en.m.wikipedia.org/wiki/Central_Monitoring_System https://en.m.wikipedia.org/wiki/Central_Monitoring_System [2] - https://en.m.wikipedia.org/wiki/NATGRID https://en.m.wikipedia.org/wiki/NATGRID [3] - https://en.m.wikipedia.org/wiki/DRDO_NETRA https://en.m.wikipedia.org/wiki/DRDO_NETRA [4] - https://www.wired.com/2008/12/mumbai-and-voip/ https://www.wired.com/2008/12/mumbai-and-voip/ [5] - https://en.m.wikipedia.org/wiki/National_Cyber_Coordination_Centre https://en.m.wikipedia.org/wiki/National_Cyber_Coordination_... [6] - https://en.m.wikipedia.org/wiki/Indian_Cyber_Crime_Coordination_Centre https://en.m.wikipedia.org/wiki/Indian_Cyber_Crime_Coordinat...
alephnerd 3y ago
Which police service? Some Military and Internal Security forces have the name "Police", eg. CRPF, ITBP. If it was one of these forces within the MHA, I wouldn't be surprised, because it falls under "National Security"
kgeist 3y ago
We were recently DDOS'd, too. Every time it happens, I wonder, who benefits from it (or even cares about us)? Competitors? Someone's bored? A disgruntled customer? And we'll probably never know.
- rrdharan 3y ago
  > Every time it happens, I wonder, who benefits from it Cloudflare. And any other DDoS protection vendors. Not saying they caused it but obviously they benefit the same way roof tile manufacturers benefit from hurricanes.
  - bluGill 3y ago
    Cloudflare benefits so long you buy protection from them. It doesn't need to be you. So long as you think you need their services it doesn't matter if you actually do. They also have the ability to keep you running if your project explodes in popularity.
- emmp 3y ago
  Yes my org was recent DDoSed too repeatedly. It was honestly inexplicable. We're still not sure why.
solardev 3y ago
IMO what is surprising about this is that the service didn't already have DDOS protection of some sort (or did it?) It's been a pretty standard practice to add that to any public-facing service for a decade or two now, hasn't it? Cloudflare is free/cheap for smaller services and there are many other options too. I'd just assume that any service is going to get randomly DDOSed soon after launch, even without any sort of blackmail/targeted attack. Even if you can figure out who did it, there's pretty much no chance of chasing them down. My takeaway from this wouldn't be "this shouldn't be possible" but "this has been commonplace for decades, and will keep happening, and we should prepare for the next one". It doesn't really matter whether it's some corrupt local agency or some script kiddie... half the world's connected, on various shitty devices, and DDOSes are gonna keep happening.
- whatevaa 3y ago
  Sourcehut is big enough that Cloudfare is neither cheap nor free, I think there was a discussion about this in another post. Nor is it a good thing that Cloudfare has keys to half of the internet.
  - solardev 3y ago
    Wasn't talking about Sourcehut, but this comment's parent. And there are alternatives to Cloudflare. The point is just that DDOSes have been common for decades and they shouldn't be a surprise for anyone. They're an inherent part of the internet protocols we have and the freedom of routing. Saying "they shouldn't exist" is like saying bad actors shouldn't exist. Sure, that's a nice thought, but they do exist (and have existed long before Cloudflare) and we can't just pretend otherwise and believe that our service won't be affected. It's just a matter of time/luck.
  - AzuraIsCool 3y ago
    Is sr.ht free?
- BeFlatXIII 3y ago
  > I'd just assume that any service is going to get randomly DDOSed soon after launch, even without any sort of blackmail/targeted attack. Even if you can figure out who did it, there's pretty much no chance of chasing them down. My takeaway from this wouldn't be "this shouldn't be possible" but "this has been commonplace for decades, and will keep happening, and we should prepare for the next one". I treat this as a foundational flaw in the protocols powering the internet. People shouldn't need to pay off DDoS protection companies as a standard line of business.

teddyh 3y ago

How sure are you that the request came from the actual police in India, and not somebody else? I.e. someone who might get irrationally upset when you did not give them what you wanted?

mattw2121 3y ago
"someone who might get irrationally upset when you did not give them what you wanted" Like the police in India?
- teddyh 3y ago
  I would assume that the actual police have their own traditional methods of being irrationally vindictive, and would not normally restort to DDoS.
  - alright2565 3y ago
    Indian police will have a lot of trouble beating you if you live in another country.
    - m-p-3 3y ago
      Their government might though..
    - not2b 3y ago
      Google Hardeep Singh Nijjar.
      - computerfriend 3y ago
        Still a lot of trouble.
  - dspillett 3y ago
    Those traditional methods don't often work very well across borders like a DDoS does. The post at the top of the thread didn't state whether or not they were based in India too.
throw9999away 3y ago
Yes we went through a bit of procedure to establish that. They have also been in touch with the authorities in our jurisdiction since. In fact we were contacted by multiple police authorities from different regions.
deleted 3y ago
[deleted]
Polycryptus 3y ago
Agreed, I've been through something like this before and it was not legit. They'd compromised a Bangladeshi police email account and used it to try to get data out of us.

leosanchez 3y ago

IMO. There is no way Indian Police is competent enough to DDOS your service.

soraminazuki 3y ago
Government authorities purchasing shady cyberweapons is a well documented issue. It would a pleasant surprise if there was any government on Earth that didn't do such things out of respect for basic human rights. https://hn.algolia.com/?q=nso https://hn.algolia.com/?q=nso
Thorrez 3y ago
It's not too hard to DDOS a website. Here's the 9th google result for booter service: https://nightmarestresser.net/ https://nightmarestresser.net/
rst 3y ago
DDoS-for-hire services exist. They don't have to build their own.
alephnerd 3y ago
They definitely are. Beat cops definitely aren't, but most police forces in India are state level and a couple are federal, and will usually have a Task Force devoted to offensive and defensive security, and if not, will contract out to companies like Appin Security Group (who were able to force Reuters and SentinelOne to remove their report into how the private-public cyber model in India operated [0]) Also, after the 2008 Mumbai Attacks, the Indian Ministry of Home Affairs began working on coordinating and centralizing Metadata Analysis and Monitoring [1][2][3], because they unable to trace the VoIP calls used by LeT [4]. If it was actually National Security related, it would have went through a couple fusion centers that the Indian government formed [5][6]. If it was some local PD asking the platform, they probably wouldn't have the capabilities to DDOS [0] - https://www.reuters.com/investigates/special-report/usa-hackers-appin/ https://www.reuters.com/investigates/special-report/usa-hack... [1] - https://en.m.wikipedia.org/wiki/Central_Monitoring_System https://en.m.wikipedia.org/wiki/Central_Monitoring_System [2] - https://en.m.wikipedia.org/wiki/NATGRID https://en.m.wikipedia.org/wiki/NATGRID [3] - https://en.m.wikipedia.org/wiki/DRDO_NETRA https://en.m.wikipedia.org/wiki/DRDO_NETRA [4] - https://www.wired.com/2008/12/mumbai-and-voip/ https://www.wired.com/2008/12/mumbai-and-voip/ [5] - https://en.m.wikipedia.org/wiki/National_Cyber_Coordination_Centre https://en.m.wikipedia.org/wiki/National_Cyber_Coordination_... [6] - https://en.m.wikipedia.org/wiki/Indian_Cyber_Crime_Coordination_Centre https://en.m.wikipedia.org/wiki/Indian_Cyber_Crime_Coordinat...

alephnerd 3y ago

Which police service? Some Military and Internal Security forces have the name "Police", eg. CRPF, ITBP. If it was one of these forces within the MHA, I wouldn't be surprised, because it falls under "National Security"

kgeist 3y ago

We were recently DDOS'd, too. Every time it happens, I wonder, who benefits from it (or even cares about us)? Competitors? Someone's bored? A disgruntled customer? And we'll probably never know.

rrdharan 3y ago
> Every time it happens, I wonder, who benefits from it Cloudflare. And any other DDoS protection vendors. Not saying they caused it but obviously they benefit the same way roof tile manufacturers benefit from hurricanes.
- bluGill 3y ago
  Cloudflare benefits so long you buy protection from them. It doesn't need to be you. So long as you think you need their services it doesn't matter if you actually do. They also have the ability to keep you running if your project explodes in popularity.
emmp 3y ago
Yes my org was recent DDoSed too repeatedly. It was honestly inexplicable. We're still not sure why.

solardev 3y ago

IMO what is surprising about this is that the service didn't already have DDOS protection of some sort (or did it?) It's been a pretty standard practice to add that to any public-facing service for a decade or two now, hasn't it? Cloudflare is free/cheap for smaller services and there are many other options too. I'd just assume that any service is going to get randomly DDOSed soon after launch, even without any sort of blackmail/targeted attack. Even if you can figure out who did it, there's pretty much no chance of chasing them down. My takeaway from this wouldn't be "this shouldn't be possible" but "this has been commonplace for decades, and will keep happening, and we should prepare for the next one". It doesn't really matter whether it's some corrupt local agency or some script kiddie... half the world's connected, on various shitty devices, and DDOSes are gonna keep happening.

whatevaa 3y ago
Sourcehut is big enough that Cloudfare is neither cheap nor free, I think there was a discussion about this in another post. Nor is it a good thing that Cloudfare has keys to half of the internet.
- solardev 3y ago
  Wasn't talking about Sourcehut, but this comment's parent. And there are alternatives to Cloudflare. The point is just that DDOSes have been common for decades and they shouldn't be a surprise for anyone. They're an inherent part of the internet protocols we have and the freedom of routing. Saying "they shouldn't exist" is like saying bad actors shouldn't exist. Sure, that's a nice thought, but they do exist (and have existed long before Cloudflare) and we can't just pretend otherwise and believe that our service won't be affected. It's just a matter of time/luck.
- AzuraIsCool 3y ago
  Is sr.ht free?
BeFlatXIII 3y ago
> I'd just assume that any service is going to get randomly DDOSed soon after launch, even without any sort of blackmail/targeted attack. Even if you can figure out who did it, there's pretty much no chance of chasing them down. My takeaway from this wouldn't be "this shouldn't be possible" but "this has been commonplace for decades, and will keep happening, and we should prepare for the next one". I treat this as a foundational flaw in the protocols powering the internet. People shouldn't need to pay off DDoS protection companies as a standard line of business.