Linode Manager and API are under attack
status.linode.com
status.linode.com
Part of the reason I think it's news is to shame linode. The likelihood of a DDoS attack bringing down the AWS management console is extremely low (has it ever happened?) Yet attackers have managed to do it multiple times on Linode.
Obvious scope for improvement —and I've no doubt this is a constant engineering sink— but not being able to commission new nodes through the web interface for a few hours hasn't yet ruined my day.
Can only imagine how much money and time is spent covering for malicious acts like this, malware, viruses, etc.
It will be a pity if the barriers to entry are being constantly raised by the need for more and more mitigation and this will reflect in the level of expertise needed and prices for end consumers, and even then with the constant threat of blackouts.
It also becomes easy to silence inconvenient voices.
It is difficult to run a business or website if you need to constantly fight extortionists or make payoffs to address threats of downtime. Today Linode is in the news, tomorrow it could be anyone else targetted.
There is no easy solution here, without putting constraints somewhere but there must be a way to make the web more resilient and robust and not subject to the whims of extortionists and other malicious agents.
Wonder what the root cause of all this is, they seem to be a specific target for some reason...
What is "GCP"?
Way back when, Toyota instituted a policy that required every line worker to effectively stop the factory if a defect was found. Engineers would come to the floor. They were tasked with creating a permanent solution for the problem, one that would have that never happen again.
For the first few months Toyota had a very hard time getting cars out the door. As time went by things got better. Eventually they got to the point where nearly every car coming off the line was perfect.
Around the same time companies like Mercedes Benz were devoting no less than 25% of their factory floor towards fixing manufacturing defects. During this same time period Toyota was devoting less than 5% of their factory floorplan to fixes. This, ironically, meant that the Japanese company was probably delivering a higher quality and more reliable product than the high end car manufacturer.
Source: Read a book on the subject many years ago: "The Machine that changed the world" https://goo.gl/VQw6HS
Back to Linode. The fact that they've seen so many attacks gives them the opportunity to become far better when compared to someone who never sees attacks. Whether they go there or not is entirely in their hands. If this is what's happening they need to take the time to communicate it to the world.
There are at least two possible attitudes: The first is to live in fear of attacks and hope they never happens. The second is to embrace them as an opportunity to get better.
The latter is a formula for disaster, or mediocrity at best. The latter is supported by millions of years of history on this planet showing that things get better because something or someone had to find a solution to a problem.
You can't become a good sailor without facing a few storms.
I'm sticking with Linode.
Thanks.
For reference, our third party monitoring measured approximately 23 minutes of downtime–
1m 46s @ 2016-09-08 01:37:53 EDT
1m 10s @ 2016-09-08 01:38:14 EDT
17m 4s @ 2016-09-08 01:40:28 EDT
2m 11s @ 2016-09-08 01:58:29 EDT
Likely because it's more effective, if you really want to kill the site.
Let's say that you find a "/manage/viewall" page which takes some processing to load (more so than the other pages), is never cached, and can't be protected by cloudflare/capcha/other because it must stay open for CLI tools.
First, it's easy to overload the site by throwing a couple of expensive requests to a few vulnerable services, rather than to have a botnet flooding 100 Gb/s of traffic to random customer instances. (note: the two strategies are not mutually exclusive).
Second, by attacking these services, they impact Linode itself and all customers using it. Someone is really trying to hurt Linode by doing that.
The lesson here: There seem to be some naughty attackers who are putting a lot of effort to put Linode down recently... and they seem to succeed to some extent. That really is a bad position for Linode :(
They are ancient Coldfusion implementations that have a dire security track record, so I would assume that they are the weakest link in the chain. Linode said they were rewriting them a while back, but I don't know what came of that because nothing seems to have changed in years.
Someone must have hated them or a competitor is trying to destroy them.
These frequent attack just isn't normal.
1. "We are currently experiencing a DDoS attack targeting our infrastructure." - you don't call inside attack a DDoS.
2. For internal attacks they can just firewall off / kill offending servers. It would be resolved in minutes rather than "mitigated".
On the second point, you're correct that my theories are entirely unsubstantiated. I'm just trying to guess why Linode seems to be the victim of these kinds of attacks a lot more than other providers.
A 'distraction to cover a different attack': The more obvious explanation is simply to deny control to people who wish to take down or re-image hosts that have already been hacked, that's much more direct, distraction alone of course could be a factor but is less likely if there is a more plausible explanation.
Finally, linode is on the record as not paying attackers on principle in spite of being DDOS's within an inch of their lives, so that's a pretty bad thing to say about them unless you have evidence that they did in fact pay attackers in the past.
What it could be is a high profile example to scare smaller companies into paying saying 'you don't want to happen to you what happened to Linode'.
Not DDoS but they've got a history of doing somewhat similar things re: hacks in the past.