MtGox - too many connections - page 4.

MagicalTux

vip

Activity: 608

Merit: 501

-

Quote from: cypherdoc on April 30, 2011, 10:01:48 PM

Quote from: MagicalTux on April 30, 2011, 09:44:04 PM

Quote from: sammoocow on April 30, 2011, 09:21:29 PM

I just transferred 5 BTC over to MtGox earlier today, then less than an hour later it started becoming impossible to go on. And they never showed up in my balance.

Am I going to lose those bitcoins?

No, don't worry, this is fine. Your balance will show up correctly once things are back to normal.

MagTux, r u ever going to reply to my email requests?

Email requests about?

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: MagicalTux on April 30, 2011, 09:44:04 PM

Quote from: sammoocow on April 30, 2011, 09:21:29 PM

I just transferred 5 BTC over to MtGox earlier today, then less than an hour later it started becoming impossible to go on. And they never showed up in my balance.

Am I going to lose those bitcoins?

No, don't worry, this is fine. Your balance will show up correctly once things are back to normal.

MagTux, r u ever going to reply to my email requests?

Ian Maxwell

full member

Activity: 140

Merit: 101

@Sammoocow: unlikely unless there's a tremendous data breach and wallets are stolen. Bitcoins aren't really sent "to" Mt Gox in the sense that their server has to remain up; it's more like a deed transfer, in that there is a public record that ownership of the coins has been transferred.

sammoocow

newbie

Activity: 36

Merit: 0

OK, thanks a lot for the reply.

MagicalTux

vip

Activity: 608

Merit: 501

-

Quote from: sammoocow on April 30, 2011, 09:21:29 PM

I just transferred 5 BTC over to MtGox earlier today, then less than an hour later it started becoming impossible to go on. And they never showed up in my balance.

Am I going to lose those bitcoins?

No, don't worry, this is fine. Your balance will show up correctly once things are back to normal.

sammoocow

newbie

Activity: 36

Merit: 0

I just transferred 5 BTC over to MtGox earlier today, then less than an hour later it started becoming impossible to go on. And they never showed up in my balance.

Am I going to lose those bitcoins?

qed

full member

Activity: 196

Merit: 100

A DDoS can't last forever and performing it means giving away a large compromised network. This operation has an huge cost for the hacker and usually it's something desperate.

Yes, a DDoS can be used as an excuse for covering a succesfull attempt of violation, but usually the server will be immediatelly shut down and a backup placed insted of it.

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: qed on April 30, 2011, 09:04:41 PM

Quote from: cypherdoc on April 30, 2011, 08:42:59 PM

for us non hackers, is it possible to sustain a DDoS attack indefinitely and if so can mtgox restore functionality?

Nope.

nope to which part of the question?

bitcoinex

sr. member

Activity: 350

Merit: 252

probiwon.com

Quote from: qed on April 30, 2011, 09:04:41 PM

Quote from: cypherdoc on April 30, 2011, 08:42:59 PM

for us non hackers, is it possible to sustain a DDoS attack indefinitely and if so can mtgox restore functionality?

Nope.

An ddos could be a cover for a hack.

qed

full member

Activity: 196

Merit: 100

Quote from: cypherdoc on April 30, 2011, 08:42:59 PM

for us non hackers, is it possible to sustain a DDoS attack indefinitely and if so can mtgox restore functionality?

Nope.

bitcoinex

sr. member

Activity: 350

Merit: 252

probiwon.com

Quote from: MagicalTux on April 30, 2011, 08:19:06 PM

The attacks seems specifically targetted at mtgox (use of the login url, for example), and contain a vast majority of russian bits (use of random russian referers, use of russian user agents, etc).

And now I understand you

mewantsbitcoins

full member

Activity: 126

Merit: 101

MagicalTux, if we mirrored your site, maybe you could do some load balancing?

cypherdoc

legendary

Activity: 1764

Merit: 1002

Quote from: eof on April 30, 2011, 08:47:50 PM

Quote from: cypherdoc on April 30, 2011, 08:42:59 PM

for us non hackers, is it possible to sustain a DDoS attack indefinitely and if so can mtgox restore functionality?

in theory; but he will likely be able to find patterns in the traffic and/or block the right IPs to restore functionality. depends on how smart a ddos and how much resources they have

has a gov't ever launched a DDoS?

eof

full member

Activity: 156

Merit: 100

Quote from: cypherdoc on April 30, 2011, 08:42:59 PM

for us non hackers, is it possible to sustain a DDoS attack indefinitely and if so can mtgox restore functionality?

in theory; but he will likely be able to find patterns in the traffic and/or block the right IPs to restore functionality. depends on how smart a ddos and how much resources they have

cypherdoc

legendary

Activity: 1764

Merit: 1002

for us non hackers, is it possible to sustain a DDoS attack indefinitely and if so can mtgox restore functionality?

bitcoinBull

legendary

Activity: 826

Merit: 1001

rippleFanatic

Quote from: qed on April 30, 2011, 08:33:24 PM

Quote from: bitcoinBull on April 30, 2011, 08:22:40 PM

Quote from: qed on April 30, 2011, 08:12:42 PM

Quote from: Ulysses on April 30, 2011, 07:53:19 PM

Most likely it's not a dos, mtgox was featured on hacker news frontpage.

Source?

Bitcoin hits US$ 4, after being mentioned on CNN yesterday (mtgox.com)
http://news.ycombinator.com/item?id=2501006

Bitcoin exchange account of Coinpal shut down by Paypal (bitcoin.org)
http://news.ycombinator.com/item?id=2501793

I miss the connection, how is hacker news related with any hackers crew?

Its not. But HN is a high-profile site which can drive large traffic. However, the HN traffic still would not be enough to cause the MtGox outage. As MagicalTux explained above, apart from legitimate traffic, they are under a DDoS attack.

qed

full member

Activity: 196

Merit: 100

Quote from: bitcoinBull on April 30, 2011, 08:22:40 PM

Quote from: qed on April 30, 2011, 08:12:42 PM

Quote from: Ulysses on April 30, 2011, 07:53:19 PM

Most likely it's not a dos, mtgox was featured on hacker news frontpage.

Source?

Bitcoin hits US$ 4, after being mentioned on CNN yesterday (mtgox.com)
http://news.ycombinator.com/item?id=2501006

Bitcoin exchange account of Coinpal shut down by Paypal (bitcoin.org)
http://news.ycombinator.com/item?id=2501793

I miss the connection, how is hacker news related with any hackers crew?

bitcoinBull

legendary

Activity: 826

Merit: 1001

rippleFanatic

Quote from: qed on April 30, 2011, 08:12:42 PM

Quote from: Ulysses on April 30, 2011, 07:53:19 PM

Most likely it's not a dos, mtgox was featured on hacker news frontpage.

Source?

Bitcoin hits US$ 4, after being mentioned on CNN yesterday (mtgox.com)
http://news.ycombinator.com/item?id=2501006

Bitcoin exchange account of Coinpal shut down by Paypal (bitcoin.org)
http://news.ycombinator.com/item?id=2501793

MagicalTux

vip

Activity: 608

Merit: 501

-

Reporting here! What I got so far:

Getting ~6000 SYN/sec (standing at ~1.7MB/s) from various sources, mainly vietnam. Those are attempts to connect on port 443 to "poke" various urls, including / and /users/login.

There are different patterns, suggesting either there are various version of the "drones" out there trying to attack mtgox, or that different people are attacking.

The attacks seems specifically targetted at mtgox (use of the login url, for example), and contain a vast majority of russian bits (use of random russian referers, use of russian user agents, etc).

The strategy:

I'm trying to get some patterns out there I can block out from the server. Traffic load is still lower than server uplink, which should allow to block that without too much troubles. The first thing I'll be doing is to block the ips I've recorded so far, and write a little C program with libpcap to analyze the network traffic and block ips that seem obviously doing something bad. I'll also reduce the max open tcp connections per ip to limit the load caused by a single IP.

bitcoinBull

legendary

Activity: 826

Merit: 1001

rippleFanatic

MagicalTux is on #bitcoin-otc discussing the DDoS right now:

[21:08] <+MagicalTux> in 0.05 seconds, I'm getting 313 connection attempts
[21:09] <+MagicalTux> that's ~6200 connections/second
[21:10] <+MagicalTux> I'll be storing bits of flood from tcpdump, and blocking those

http://webchat.freenode.net/?channels=#bitcoin-otc

Topic: MtGox - too many connections - page 4. (Read 14171 times)