5 ms·

This happened back in October a couple of days in a row. Who the heck is targeting Github and why? I wonder if these attacks are related to the Chinese hacking

This happened back in October a couple of days in a row. Who the heck is targeting Github and why? I wonder if these attacks are related to the Chinese hacking attacks that have been publicised lately?

netrus 14y ago
Hm, I don't think it fits the pattern. The most reported Chinese hacking was about espionage, not bringing down websites. Most of the time, DDOS is either related to politics (newspapers, federal agencies etc.) or related to blackmailing (most likely in the case of GitHub. This of course, does not mean that the hacker is NOT sitting in China. But she could be placed everywhere else just as likely.
- crag 14y ago
  A lot of Chinese (and everyone else) hacking has been for good old fashion profit. But I do agree, I doubt the Chinese or any other "criminal" element is behind this attack. Github either pissed someone off, or it's about "street cred". I was interviewing a candidate about a year ago. Who bragged to me that he hacked the North Broward Hospital District. And I was like, "why would you hack a hospital?" His answer, "It was there." I was dumb-founded. I mean I hired him, but still. :)
  - minopret 14y ago
    It's a Monty Python sort of joke? Interviewer: (sings) Good night, ring-ding-dingy. (shouts) Five, four, three, two, one! Candidate: (cackles like a chicken) Interviewer: (writing) Good! Very good, indeed!
citricsquid 14y ago
Nowadays it's so easy to execute a large scale ddos that it's just as likely to be an attention starved teenager as it is a group with an agenda. Github is big enough that it's on peoples radars as "that popular website lots of people rely on", the company I work for has websites smaller than Github and we're indiscriminately ddosed every couple of days.
- mratzloff 14y ago
  DDoS attempts are just as often business related as not. Maybe not in this case, but it's "surprising" how often these coincide with a business deal in the works. Also, potential partners (usually international) sometimes run DDoS tests against a network to see how resilient it is to attack.
- codexon 14y ago
  I wish hosts would stop blaming their customers for these attacks. Every time someone gets ddosed and complains on hosting forums, the #1 reaction is "who did you piss off?".
Negitivefrags 14y ago
I often have to wonder if the DDoS gods roll a dice and pick someone to screw each day. We have had many DDoS attacks and never once had any indication as to why. A few days ago we had a 30 Gbit DDoS. Our server host just blackholed any IP that was touched by it. They kept moving it around to target different bits of our infrastructure (unlike previous attacks that just targeted our website). We lost 6 servers, but thankfully not enough to take us fully offline though some customers would have experienced problems during that time. If they had just been a bit more persistent we might have been in serious trouble. At that level of DDoS your server host doesn't care about keeping you online. They want the traffic off their network.
- martinced 14y ago
  If your nickname here can somehow be linked to the company you're working for (e.g. by checking previous messages you posted to HN or on another board) I think it's not very smart to write what you just wrote. Now the bad guys knows that they should just have tried a bit longer. Now maybe that because you were DROP'ing / blacklisting IPs maybe they just ran out of zombies but still... If I was the attacker and read your message and wanted to be bad, I'd just hammer you a bit more to put you in trouble. Besides that there are some ISPs who do care about both keeping you online and fighting the low-life scums: the ISP XS4ALL from the Netherlands is (was at least) notoriously famous for that.
  - switch007 14y ago
    They know that anyway. The longer and more severe an attack is, the more damage it's likely to do. A host may be able to sustain 30Gbps for a minute or two, but not for 5 minutes. If 5 out of 10 servers are being attacked, you can probably handle traffic at 50% capacity for a while, but not forever.
- tomjen3 14y ago
  Get a smaller host, that way they can't afford to cut you of.
  - 14y ago
onemorepassword 14y ago
Any service hosting 3rd party content on even a moderate scale (say a few hundred various users) is likely to get DDoS-ed and never find out exactly why.
- pixl97 14y ago
  I had a single IP on a customers 10M-bit fiber line get DDoSed for what seemed like no apparent reason. We had the ISP blackhole just that IP and the issue went away, but it was a real WTF on why it happened, and no it wasn't some ones accidental DNS mistake.
smtddr 14y ago
> wonder if these attacks are related to the Chinese hacking attacks that have been publicised lately? Might be just me, but I don't like this trend. I'm seeing "the chinese" & "hacking" used too much together without proof more often than not. Almost as if they are being made into the next boogeyman to be afraid of.
- tatsuke95 14y ago
  >"I'm seeing "the chinese" & "hacking" used too much together without proof more often than not." Get used to it, you're going to be seeing it for what is likely a few decades at least. We need an enemy. The Chinese are the new Red Army; something to blame Western problems on.
  - philwelch 14y ago
    It's a remix of anti-Communism and the type of anxiety we used to feel about Japan's economic power.
  - nwzpaperman 14y ago
    Sovereign nations do employ significant signal intelligence resources to defend their government. The Chinese are heavily invested and have been responsible for the majority of attacks on US IT infrastructure for years. It wasn't discussed openly before because the trade relations weren't degraded/ing like they are today. In case you've missed the memo, they're threatening all of their neighbors outright with kinetic military force. Japan is no trivial country to threaten force against, so the diplomatic climate has changed and more information is being shared publicly in anticipation of an outright military conflict. There are conflicting interests between individuals that lead to physical fights and the same applies to sovereign nations whose interests run contrary.
    - blablabla123 14y ago
      >It wasn't discussed openly before It was, at least in some political magazines. http://www.heise.de/tp/artikel/7/7551/1.html http://www.heise.de/tp/artikel/7/7551/1.html (German article from 2001) References: http://www.wired.com/politics/law/news/2001/05/43443 http://www.wired.com/politics/law/news/2001/05/43443 And besides Internet, just for the record https://www.fas.org/irp/news/1999/06/990602-275397.htm https://www.fas.org/irp/news/1999/06/990602-275397.htm
bdg 14y ago
> Who the heck is targeting Github and why? Typically large services are targeted by some some form of cyber-criminal. As an example only, if the Russian Business Network[1]* were attempting to extort money from github they could use a DDOS and go away when paid (for a while). This happens to some larger media sites during large events such as the Olympics[2]. [1] http://en.wikipedia.org/wiki/Russian_Business_Network [2] http://news.techworld.com/security/3309917/london-olympics-cio-claims-immunity-from-ddos-attacks/ *Their MO is more towards identity theft
plaguuuuuu 14y ago
One possible motivation might be to knock github offline following a 0day on some software such that the patch/latest version can't be downloaded.

netrus 14y ago

Hm, I don't think it fits the pattern. The most reported Chinese hacking was about espionage, not bringing down websites. Most of the time, DDOS is either related to politics (newspapers, federal agencies etc.) or related to blackmailing (most likely in the case of GitHub. This of course, does not mean that the hacker is NOT sitting in China. But she could be placed everywhere else just as likely.

crag 14y ago
A lot of Chinese (and everyone else) hacking has been for good old fashion profit. But I do agree, I doubt the Chinese or any other "criminal" element is behind this attack. Github either pissed someone off, or it's about "street cred". I was interviewing a candidate about a year ago. Who bragged to me that he hacked the North Broward Hospital District. And I was like, "why would you hack a hospital?" His answer, "It was there." I was dumb-founded. I mean I hired him, but still. :)
- minopret 14y ago
  It's a Monty Python sort of joke? Interviewer: (sings) Good night, ring-ding-dingy. (shouts) Five, four, three, two, one! Candidate: (cackles like a chicken) Interviewer: (writing) Good! Very good, indeed!

citricsquid 14y ago

Nowadays it's so easy to execute a large scale ddos that it's just as likely to be an attention starved teenager as it is a group with an agenda. Github is big enough that it's on peoples radars as "that popular website lots of people rely on", the company I work for has websites smaller than Github and we're indiscriminately ddosed every couple of days.

mratzloff 14y ago
DDoS attempts are just as often business related as not. Maybe not in this case, but it's "surprising" how often these coincide with a business deal in the works. Also, potential partners (usually international) sometimes run DDoS tests against a network to see how resilient it is to attack.
codexon 14y ago
I wish hosts would stop blaming their customers for these attacks. Every time someone gets ddosed and complains on hosting forums, the #1 reaction is "who did you piss off?".

Negitivefrags 14y ago

I often have to wonder if the DDoS gods roll a dice and pick someone to screw each day. We have had many DDoS attacks and never once had any indication as to why. A few days ago we had a 30 Gbit DDoS. Our server host just blackholed any IP that was touched by it. They kept moving it around to target different bits of our infrastructure (unlike previous attacks that just targeted our website). We lost 6 servers, but thankfully not enough to take us fully offline though some customers would have experienced problems during that time. If they had just been a bit more persistent we might have been in serious trouble. At that level of DDoS your server host doesn't care about keeping you online. They want the traffic off their network.

martinced 14y ago
If your nickname here can somehow be linked to the company you're working for (e.g. by checking previous messages you posted to HN or on another board) I think it's not very smart to write what you just wrote. Now the bad guys knows that they should just have tried a bit longer. Now maybe that because you were DROP'ing / blacklisting IPs maybe they just ran out of zombies but still... If I was the attacker and read your message and wanted to be bad, I'd just hammer you a bit more to put you in trouble. Besides that there are some ISPs who do care about both keeping you online and fighting the low-life scums: the ISP XS4ALL from the Netherlands is (was at least) notoriously famous for that.
- switch007 14y ago
  They know that anyway. The longer and more severe an attack is, the more damage it's likely to do. A host may be able to sustain 30Gbps for a minute or two, but not for 5 minutes. If 5 out of 10 servers are being attacked, you can probably handle traffic at 50% capacity for a while, but not forever.
tomjen3 14y ago
Get a smaller host, that way they can't afford to cut you of.
- 14y ago

onemorepassword 14y ago

Any service hosting 3rd party content on even a moderate scale (say a few hundred various users) is likely to get DDoS-ed and never find out exactly why.

pixl97 14y ago
I had a single IP on a customers 10M-bit fiber line get DDoSed for what seemed like no apparent reason. We had the ISP blackhole just that IP and the issue went away, but it was a real WTF on why it happened, and no it wasn't some ones accidental DNS mistake.

smtddr 14y ago

> wonder if these attacks are related to the Chinese hacking attacks that have been publicised lately? Might be just me, but I don't like this trend. I'm seeing "the chinese" & "hacking" used too much together without proof more often than not. Almost as if they are being made into the next boogeyman to be afraid of.

tatsuke95 14y ago
>"I'm seeing "the chinese" & "hacking" used too much together without proof more often than not." Get used to it, you're going to be seeing it for what is likely a few decades at least. We need an enemy. The Chinese are the new Red Army; something to blame Western problems on.
- philwelch 14y ago
  It's a remix of anti-Communism and the type of anxiety we used to feel about Japan's economic power.
- nwzpaperman 14y ago
  Sovereign nations do employ significant signal intelligence resources to defend their government. The Chinese are heavily invested and have been responsible for the majority of attacks on US IT infrastructure for years. It wasn't discussed openly before because the trade relations weren't degraded/ing like they are today. In case you've missed the memo, they're threatening all of their neighbors outright with kinetic military force. Japan is no trivial country to threaten force against, so the diplomatic climate has changed and more information is being shared publicly in anticipation of an outright military conflict. There are conflicting interests between individuals that lead to physical fights and the same applies to sovereign nations whose interests run contrary.
  - blablabla123 14y ago
    >It wasn't discussed openly before It was, at least in some political magazines. http://www.heise.de/tp/artikel/7/7551/1.html http://www.heise.de/tp/artikel/7/7551/1.html (German article from 2001) References: http://www.wired.com/politics/law/news/2001/05/43443 http://www.wired.com/politics/law/news/2001/05/43443 And besides Internet, just for the record https://www.fas.org/irp/news/1999/06/990602-275397.htm https://www.fas.org/irp/news/1999/06/990602-275397.htm

bdg 14y ago

> Who the heck is targeting Github and why? Typically large services are targeted by some some form of cyber-criminal. As an example only, if the Russian Business Network[1]* were attempting to extort money from github they could use a DDOS and go away when paid (for a while). This happens to some larger media sites during large events such as the Olympics[2]. [1] http://en.wikipedia.org/wiki/Russian_Business_Network [2] http://news.techworld.com/security/3309917/london-olympics-cio-claims-immunity-from-ddos-attacks/ *Their MO is more towards identity theft

plaguuuuuu 14y ago

One possible motivation might be to knock github offline following a 0day on some software such that the patch/latest version can't be downloaded.