Topic: Another DDOS ? (Read 4332 times)

The downtime of the forum eerily coincided with Halloween  How spooky is this? And was it just a coincidence or something from another world messed with us we will never know.....

The truth is out there, guys, the truth is out there...

What is important is that theymos did a great job in bringing the site up after the DDOS. Unfortunately hackers hate this site and DDOS flood is been common in this year 2016 which I have been part of this forum. I remember since January, February, April , May and now we had a few of these but theymos managed to always be on top. It's a great feeling when we know we have a really great admin.

I wasn't able to login for almost 30 minutes.First connection timed out error,later SMF unable to connect to the database followed by forum's please post about it in meta message.If it was ddos,was the ransom asked ?

I have some ideas for how to mitigate the DDoS, but I might not finish it today.

As someone mentioned earlier, I don't want to use Cloudflare because Cloudflare can see/modify all encrypted traffic, they are a massive central point of failure on the Internet, IMO they probably assist and are supported by the NSA, they only protect against fairly small-scale attacks, and they really make life difficult for Tor users.

The UDP flood is causing high packet loss. What this will look like when browsing the forum is:
 - When you first connect to the forum after not browsing any pages for a while, it might be especially slow, and it might time out. After it completely fails / times out, just keep trying. It will eventually work.
 - After you first connect, browsing should be much smoother because at this point you'll already have a TCP connection open, though it might be a bit slow, and occasionally a page might time out.
 - If the page times out while posting, press the refresh button in your browser and accept any warning it gives you. Keep trying until it goes through.

The most recent 504s were due to an accidental misconfiguration I made. I'm tentatively hoping that my countermeasures were in fact successful against the DDoS.

@theymos: press the refresh button in your browser and accept any warning it gives you. Keep trying until it goes through.

The most recent 504s were due to an accidental misconfiguration I made. I'm tentatively hoping that my countermeasures were in fact successful against the DDoS.

As someone mentioned earlier, I don't want to use Cloudflare because Cloudflare can see/modify all encrypted traffic, they are a massive central point of failure on the Internet, IMO they probably assist and are supported by the NSA, they only protect against fairly small-scale attacks, and they really make life difficult for Tor users.

I don't like Cloudflare too (too expensive and they can't manage/deny those attacks.
But there are other good alternatives:   Incapsula (a good one), Keycdn, Maxcdn, etc.

For half a day, do not provide access to the Forum. 

I have some ideas for how to mitigate the DDoS, but I might not finish it today.

As someone mentioned earlier, I don't want to use Cloudflare because Cloudflare can see/modify all encrypted traffic, they are a massive central point of failure on the Internet, IMO they probably assist and are supported by the NSA, they only protect against fairly small-scale attacks, and they really make life difficult for Tor users.

The UDP flood is causing high packet loss. What this will look like when browsing the forum is:
 - When you first connect to the forum after not browsing any pages for a while, it might be especially slow, and it might time out. After it completely fails / times out, just keep trying. It will eventually work.
 - After you first connect, browsing should be much smoother because at this point you'll already have a TCP connection open, though it might be a bit slow, and occasionally a page might time out.
 - If the page times out while posting, press the refresh button in your browser and accept any warning it gives you. Keep trying until it goes through.

I changed something which may block the UDP flood. We'll see.

Email is probably broken again for most people. Note that the email is being sent, but your email provider is blocking it -- whenever I change IP addresses, I have to take a bunch of steps to make the IP look more "clean" for email purposes. I will fix this in a few days.

I have some ideas for how to mitigate the DDoS, but I might not finish it today.

As someone mentioned earlier, I don't want to use Cloudflare because Cloudflare can see/modify all encrypted traffic, they are a massive central point of failure on the Internet, IMO they probably assist and are supported by the NSA, they only protect against fairly small-scale attacks, and they really make life difficult for Tor users.

The UDP flood is causing high packet loss. What this will look like when browsing the forum is:
 - When you first connect to the forum after not browsing any pages for a while, it might be especially slow, and it might time out. After it completely fails / times out, just keep trying. It will eventually work.
 - After you first connect, browsing should be much smoother because at this point you'll already have a TCP connection open, though it might be a bit slow, and occasionally a page might time out.
 - If the page times out while posting, press the refresh button in your browser and accept any warning it gives you. Keep trying until it goes through.

As someone mentioned earlier, I don't want to use Cloudflare because Cloudflare can see/modify all encrypted traffic, they are a massive central point of failure on the Internet, IMO they probably assist and are supported by the NSA, they only protect against fairly small-scale attacks, and they really make life difficult for Tor users.

An official announcement has been made on the forum's twitter page by theymos :

it was posted 14h ago.

Theymos has never stated is was a DDoS. If you read the other pages, you would know that.
~snip~

DDoS attack

Hm, it looked to me like some sort of upstream networking failure, but now it happened again on a different IP, so maybe it is a difficult-to-detect DDoS. I'll continue to investigate.

[...]
I'm not going to use Cloudflare for bitcointalk.org. Cloudflare is a massive central point of failure to the Internet. Tons of sites (including most large Bitcoin sites) use it. Additionally, in most cases Cloudflare can undetectably read any encrypted traffic passing through their service because they have the site's HTTPS key. Even if you use their keyless HTTPS feature, they can still read your traffic (though this is detectable with something like Certificate Patrol) because they have an agreement with a CA which allows them to issue whatever certificates they want (they are essentially a CA). Also, I've heard that Cloudflare is not especially effective at stopping many types of DDoS attack.

Instead, I purchased DDoS protection that works at a lower level. After filtering, it sends user TCP traffic to the forum's server verbatim. This eliminates the need for giving up the forum's HTTPS key. It seems to be effective at stopping this attacker's traffic, but it may be introducing some periodic downtime/slowness/latency. We're still looking into it. DDoS protection services (even the most expensive ones) are notorious for often being useless, shady, or unreliable, so who knows whether this service or any future ones I may try will end up working out... Unfortunately, the Internet is just particularly weak to DDoS attacks, and there are no great solutions available.

Yes, it's very annoying but there is nothing that we can do. I only make sure that before I post something, I copy it to avoid having to type everything from scratch again as the page turns either blank, or shows an error.

In the last 2 days the forum was offline many times ...

If there is a DDOS: I don't understand: why to DDOS a forum?  What is the benefit?  There are no hideen coins in here (except those from theymos pocket)  

Apparently using a VPN can fix the connection issues. I assume some areas have Bitcointalk blocked out for some reason. Is this due to a new hosting service or on purpose?

The connection is still not perfectly reliable. The forum frequently can't be reached.
Also I have noticed that when the site is down, the favicon is also changed :



Hope it gets posted

The connection is still not perfectly reliable. The forum frequently can't be reached.
Also I have noticed that when the site is down, the favicon is also changed :



Hope it gets posted

I thought for a while that it was just some sort of upstream congestion, but I've found that it is a very large UDP flood that is causing issues despite being blocked outside of the server. I will find some way of mitigating it.

Only checked the forum now, couldn't access for the last 12+ hours, more or less.

How vpn works to you? what vpn you use.. honestly mine is not working i am using flyvpn.. and i am still halving issue even a normal browsing without proxy or vpn.. just like now i just reloading until the page load successful sometime time out or error. .

Hm, it looked to me like some sort of upstream networking failure, but now it happened again on a different IP, so maybe it is a difficult-to-detect DDoS. I'll continue to investigate.

Hm, it looked to me like some sort of upstream networking failure, but now it happened again on a different IP, so maybe it is a difficult-to-detect DDoS. I'll continue to investigate.

I can confirm right now that the forum is insanely slow. I use TOR Browser in order to browse this forum at work because they have it blocked with a firewall or something, so it makes it even slower. I tried with a VPN, it's more usable but I dont like to pay for a VPN. Tor was working just fine until today which became super slow. Please help.

Just got a message that my session token was invalid, please log out and log back in again.
Was able to sign out and sign back in but site is still lagging randomly.

I think that it was/is some sort of upstream networking failure. I'm still seeing an above-normal level of packet loss, but it seems usable now at least. I'll keep an eye on it.

I just changed something, post here if it seems to have helped or not.

I just changed something, post here if it seems to have helped or not.

It's pretty spotty for me right now.  I'm getting the "This site can't be reached, bitcointalk.org took too long to respond" or something like that.
Been happening on and off for the past hour

As far as I can tell, the connection is still spotty but relatively stable at this point - there were some short disconnects, but for the most part the connection troubles have settled down.


Probably not.

Have to be concerned about account details being leaked this time again?