3 ms·

I find it somewhat chilling how their original colo left them to hang and dry. Maybe I'm weird, but I'd consider colo to be a closer cooperation than just rent

by tetha 3y ago

I find it somewhat chilling how their original colo left them to hang and dry. Maybe I'm weird, but I'd consider colo to be a closer cooperation than just renting some virtual servers from wherever. And just getting told "Yupp, your null-routed. No, we can't give you access for specific sources over a different path. Get fucked" - or, in fact, not getting told that - is ... one of our ex-hosters was like that. And as a service provider, I have strong feelings about the customer service there. Maybe I don't know big infrastructures, but this just leaves me with a weird feeling in my guts. But hell. Make sure to give your engineers - and their family - something. After some hell-weeks, we've given people some budget to do something fun with their family, because the company had to take so much private time during those weeks.

downrightmike 3y ago
being null routed is really the only thing they can do. Then then undid it and they had to do it again. This wasn't a standard DDOS attack, which they normally handle just fine. Good coverage of the event: Security Now! Podcast https://www.youtube.com/watch?v=ehfV7cRLkFE https://www.youtube.com/watch?v=ehfV7cRLkFE
- aidenn0 3y ago
  About 29minutes in is where it picks up after reading verbatim the status report from Drew.
- MaxBarraclough 3y ago
  Drew's second mention on Security Now, for what it's worth. Gibson quoted one of his blog posts back in September. https://www.grc.com/sn/sn-941.htm https://www.grc.com/sn/sn-941.htm
- iso8859-1 3y ago
  Subscribed and the unsubscribed shortly after when they mistook Greenland for Iceland (42m55s), Italy for ??? (43m42s) and then Equatorial Guinea for Chad (44m55s).
- AlexeyBelov 3y ago
  Why do you think this DDoS attack is non-standard? What makes it stand out?
- tetha 3y ago
  I'll give the podcast a listen tomorrow :) But, even if you only have a single action available, isn't communication with the customer key? We've pulled customer systems offline, and parts of the customer were glad because we could provide information and help with handling harsh situations they had. And even if this isn't a 1% revenue customer, if they are receiving a DDOS-whopper you cannot happen, that would probably be a customer you want communication with. Even if the goal was just to figure out if there was glory in hosting them or to just fire them. Just null-routing and being unavailable seems unprofessional, though I know quite well how .. well-structured these acquire-everything hosting providers are internally. Doesn't change that this is bad customer service.
jabart 3y ago
Depends on the contract and the attack size. Sometimes the DC has to pick all it's other customers over trying to handle a DDoS for one. Our DC had an issue where packets over 1492bytes were being dropped in Chicago by one transit provider and that took 3 hours to make the call to drop them.
dsr_ 3y ago
Corporations gonna corporate. And when they merge and buy each other, information disappears. People get fired or leave, dropping relationships. I had a ten year colo relationship with AT&T, mostly but not entirely datacenters, where the salescritter would be changed every single time I tried to talk to them. 3-4x a year, they either left or were re-org'd elsewhere or our account was moved to a different group. (Datacenter techs: competent. Datacenter manager: competent. Sales staff: chaotic.) Eventually I learned to open a ticket to find out who the salescritter would be. On the other hand, there was a competent server salesperson at company X who I used to buy lots of stuff from; company X started raising prices and flubbing tech support returns, so on my next order I tried company Y. I was rather surprised to get the same server salesperson -- who had just taken a job at Y.

by tetha 3y ago

downrightmike 3y ago

being null routed is really the only thing they can do. Then then undid it and they had to do it again. This wasn't a standard DDOS attack, which they normally handle just fine. Good coverage of the event: Security Now! Podcast https://www.youtube.com/watch?v=ehfV7cRLkFE https://www.youtube.com/watch?v=ehfV7cRLkFE

aidenn0 3y ago
About 29minutes in is where it picks up after reading verbatim the status report from Drew.
MaxBarraclough 3y ago
Drew's second mention on Security Now, for what it's worth. Gibson quoted one of his blog posts back in September. https://www.grc.com/sn/sn-941.htm https://www.grc.com/sn/sn-941.htm
iso8859-1 3y ago
Subscribed and the unsubscribed shortly after when they mistook Greenland for Iceland (42m55s), Italy for ??? (43m42s) and then Equatorial Guinea for Chad (44m55s).
AlexeyBelov 3y ago
Why do you think this DDoS attack is non-standard? What makes it stand out?
tetha 3y ago
I'll give the podcast a listen tomorrow :) But, even if you only have a single action available, isn't communication with the customer key? We've pulled customer systems offline, and parts of the customer were glad because we could provide information and help with handling harsh situations they had. And even if this isn't a 1% revenue customer, if they are receiving a DDOS-whopper you cannot happen, that would probably be a customer you want communication with. Even if the goal was just to figure out if there was glory in hosting them or to just fire them. Just null-routing and being unavailable seems unprofessional, though I know quite well how .. well-structured these acquire-everything hosting providers are internally. Doesn't change that this is bad customer service.

jabart 3y ago

Depends on the contract and the attack size. Sometimes the DC has to pick all it's other customers over trying to handle a DDoS for one. Our DC had an issue where packets over 1492bytes were being dropped in Chicago by one transit provider and that took 3 hours to make the call to drop them.

dsr_ 3y ago

Corporations gonna corporate. And when they merge and buy each other, information disappears. People get fired or leave, dropping relationships. I had a ten year colo relationship with AT&T, mostly but not entirely datacenters, where the salescritter would be changed every single time I tried to talk to them. 3-4x a year, they either left or were re-org'd elsewhere or our account was moved to a different group. (Datacenter techs: competent. Datacenter manager: competent. Sales staff: chaotic.) Eventually I learned to open a ticket to find out who the salescritter would be. On the other hand, there was a competent server salesperson at company X who I used to buy lots of stuff from; company X started raising prices and flubbing tech support returns, so on my next order I tried company Y. I was rather surprised to get the same server salesperson -- who had just taken a job at Y.