14 ms·

You ever sit there and wonder who the person is on the other end of the attack? Someone sitting there, I guess with not much on that day, decides to command the

You ever sit there and wonder who the person is on the other end of the attack? Someone sitting there, I guess with not much on that day, decides to command their army of infected bots to attack github. Why github I wonder? Perhaps it provides a challenging target. Perhaps github is used as a testing ground for a more profitable future attack. We often get technical writeups after a DDoS attack, however we very rarely get a writeup sumising the motive behind the attack. I can't believe every attack is simply driven by 'because they can'.

chrsm 13y ago
I met some folks from GitHub last year, and this is what they postulated as well.
baldfat 13y ago
It just isn't even possible to say anything specific in terms of anonymous person's motivation. If they had a name and face that is the only time you can talk with some certainty. Perhaps some developer was not going to make his deadline or wanted to take down the network to give him more time? Who knows...
erichurkman 13y ago
Github is a valuable target if attackers are trying to get access to private repositories. A lot of organizations have their entire code base on Github.
- stcredzero 13y ago
  How is a DDOS attack going to help with that?
  - doktrin 13y ago
    I'm not entirely sure why this question was downvoted. How exactly would a DDoS attack help attackers compromise the target system?
    - stcredzero 13y ago
      I'm not entirely sure why this question was downvoted Because HN is now full of people who already know the answer and who like to troll HN.
      - NAFV_P 13y ago
        > Because HN is now full of people who already know the answer and who like to troll HN. I thought submitting or referring to a good (possibly obscure or unknown) article would be more helpful in that instance, including to myself.
  - simcop2387 13y ago
    I believe if you're doing that to get at something you use the DDOS to hide your true intentions. e.g. you leave the DDOS at the level to slow the site way down so that the admins are paying attention to that while you go after what you need. It's like blowing up the building across the street during a bank robbery, you distract the people looking for you so that you can get away.
  - Morgawr 13y ago
    If you can get a crash, you can possibly find a weakness. If a system relies on Github to work properly, maybe you can find vulnerability in case Github is down. Maybe a MITM (to your target, not Github itself) is easier to perform when Github is slowed down and takes some minutes to respond to requests. There are various possibilities, nevertheless, bringing down Github is surely a juicy objective.
derefr 13y ago
There's a good piece of journalism (EDIT: see the reply to this comment for the link), in which someone who was being DDoSed went into the various black-market forums where such people as would DDoS hang out, to see if they could find their attacker. What they found was that, at one forum, there was a convention where new, as-yet-untrusted sellers of DDoSing-as-a-Service are expected to take down some big, technically-respected target (e.g. GitHub) to prove their mettle, before anyone would hire them. And conveniently-enough, some new DDoSaaS seller was advertising right then, telling everyone to "look and see that _________ is down. That was me! Hire me now!" It further turned out that the site-owner doxxed the account, found them to be a thirteen-year-old(!), and called their parents to tell them what their child was doing on the internet.
- cwb71 13y ago
  http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/ http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb...
pbhjpbhj 13y ago
Perhaps in this case it's advertising - a proof of the power of the bot farm that a cracker somewhere is trying to sell?
patcon 13y ago
As people leverage the deployment API more and more for production use-cases, an attack on github might come to represent an attack on the ability of MANY products to push changes and respond to their OWN attacks in a comfortable manner...
h1karu 13y ago
RIAA trying to take down popcorntime

chrsm 13y ago

I met some folks from GitHub last year, and this is what they postulated as well.

baldfat 13y ago

It just isn't even possible to say anything specific in terms of anonymous person's motivation. If they had a name and face that is the only time you can talk with some certainty. Perhaps some developer was not going to make his deadline or wanted to take down the network to give him more time? Who knows...

erichurkman 13y ago

Github is a valuable target if attackers are trying to get access to private repositories. A lot of organizations have their entire code base on Github.

stcredzero 13y ago
How is a DDOS attack going to help with that?
- doktrin 13y ago
  I'm not entirely sure why this question was downvoted. How exactly would a DDoS attack help attackers compromise the target system?
  - stcredzero 13y ago
    I'm not entirely sure why this question was downvoted Because HN is now full of people who already know the answer and who like to troll HN.
    - NAFV_P 13y ago
      > Because HN is now full of people who already know the answer and who like to troll HN. I thought submitting or referring to a good (possibly obscure or unknown) article would be more helpful in that instance, including to myself.
- simcop2387 13y ago
  I believe if you're doing that to get at something you use the DDOS to hide your true intentions. e.g. you leave the DDOS at the level to slow the site way down so that the admins are paying attention to that while you go after what you need. It's like blowing up the building across the street during a bank robbery, you distract the people looking for you so that you can get away.
- Morgawr 13y ago
  If you can get a crash, you can possibly find a weakness. If a system relies on Github to work properly, maybe you can find vulnerability in case Github is down. Maybe a MITM (to your target, not Github itself) is easier to perform when Github is slowed down and takes some minutes to respond to requests. There are various possibilities, nevertheless, bringing down Github is surely a juicy objective.

derefr 13y ago

There's a good piece of journalism (EDIT: see the reply to this comment for the link), in which someone who was being DDoSed went into the various black-market forums where such people as would DDoS hang out, to see if they could find their attacker. What they found was that, at one forum, there was a convention where new, as-yet-untrusted sellers of DDoSing-as-a-Service are expected to take down some big, technically-respected target (e.g. GitHub) to prove their mettle, before anyone would hire them. And conveniently-enough, some new DDoSaaS seller was advertising right then, telling everyone to "look and see that _________ is down. That was me! Hire me now!" It further turned out that the site-owner doxxed the account, found them to be a thirteen-year-old(!), and called their parents to tell them what their child was doing on the internet.

cwb71 13y ago
http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/ http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb...

pbhjpbhj 13y ago

Perhaps in this case it's advertising - a proof of the power of the bot farm that a cracker somewhere is trying to sell?

patcon 13y ago

As people leverage the deployment API more and more for production use-cases, an attack on github might come to represent an attack on the ability of MANY products to push changes and respond to their OWN attacks in a comfortable manner...

h1karu 13y ago

RIAA trying to take down popcorntime