MasterCard under DDOS, can't process SecureCode online payments | Hacker News Reader

MasterCard under DDOS, can't process SecureCode online payments

blog.securetrading.com

204 pointsgasull188 comments

Disclaimer: I just finished Accelerando a few days ago (late to the party). I'm hopped up on futurist vision.

First, let's stipulate that 4chan's Anonymous raids are mostly juvenile and often ineffective at doing anything meaningful to their targets.

At the same time: The ability of a community to completely self-organize, without central direction, and instantly execute a publicly-visible plan like this is without precedent in human history.

It stands to reason that as time goes on, larger groups of people will become involved in communities that exhibit 4chan-like cohesion. A larger pool means a higher likelihood of these groups including people with the knowledge and ability to do ever-increasing damage.

The long-term implications are interesting. Into the future, are we talking about the instant formation and dissolution of "terrorist" or "dissident" groups, bound together by transient common interest and gone again within days or hours? If you're a government or corporation, this is terrifying. You can keep tabs on other governments, and even traditional terrorist cells, which each move at the speed of the usual group dynamics, proportional to their size.

But what the hell do you do about groups you can't predict that are gone before you even figure out what's wrong? Groups that aren't bound together by national identity or other easily quantified affiliations – just ideas, ideals and transient events?

There's something meaningful here that points to how we all get along in the future, in the same vein as the "post-secrecy world" presaged by Wikileaks-style activism enabled by network technologies.

Or maybe I just need a nap.

> The ability of a community to completely self-organize, without central direction, and instantly execute a publicly-visible plan like this (...)

I don't see any reason to believe it went down that way.

It's probable it was a group who already had much of the ability in-place to execute an attack like this, and who decided to target mastercard.com because it was found to be vulnerable, or because paypal and amazon were out of thier reach.

That group would be Anonymous, in all of its gossamer affiliation. The idea of another group using 4chan/Anonymous as a front for its own goals seems needlessly complicated. "Anonymous" does all of this for Scientologists and cat abusers, why not Mastercard?

Not a real group so much as whoever wants in, is in, on a per-effort basis; a movement is spearheaded by an individual or two and each so-called member spontaneously decides whether to participate or not. “Anonymous” is hardly a group or organization, any more than the IRC channel for your favorite framework. A weak analogy is whenever Redditors decide to contribute to a certain cause or user. No one decided for the group, and there was no real vote, but nevertheless without the community most individuals would not have contributed.

Economist / Babbage: http://www.economist.com/blogs/babbage/2010/12/more_wikileak... (I think he gets the definition of OP wrong, but everything else seems to jive with my non-firsthand understanding.)

It's relatively accurate.

Reminds me of a Frank Herbert story called "Committee of the Whole". It concerns an engineer who makes public the plans and method to build a super-weapon from everyday household materials - and this makes government oppression a thing of the past and forces human beings to get along.

The idea of a giant hivemind conducting business as it sees fit frightens me. There are countless stories of 4chan, Reddit, et al. raiding the wrong individuals and causing great harm. Of course there are other times where everything goes better than expected, however, as Voltaire once said, 'It is better to risk sparing a guilty person than to condemn an innocent one.'

The internet has no filter. Information flows at a steady constant pace; in fact most communication now a days can take place immediately. This has its pros and cons. Pros, well its awesome. Cons, without a filter many people will jump on a bandwagon without knowing the full details of a situation.

Sometimes people do not think as logically as they think they are. Acting on hearsay and emotions alone will lead people to act reckless, and once that stone starts rolling it's hard to stop; zerg.

This should not be taken as a generalization of online networks as there are outliers in most situations. This is just a reminder that not everyone on the internet has other people best interest in mind. Some people are just mean.

The best relationships are somewhere in the middle.

>The idea of a giant hivemind conducting business as it sees fit frightens me.

What about a government doing as it sees fit? That should be more frightening to you because it's existing for a long time and it's cost countless lives. And it's still doing so.

I would choose order over anarchy any day. At least the government has a system of checks and balances; could be better but I'll take what I get. A utopia is built over time, instant is too soon.

Of course, a government has the ability to influence a situation more than the Internet; they can pretty much do what ever they want. I don't see them throwing that weight around to much though. In fact, if the Wikileaks documents has taught anyone anything, it is that the government is on its grind 24-7 365.

Dont get me wrong. DDoSing Paypal, Master Card, et al is pretty entertaining, but I wonder what that cost other people? They screwed with an individual organization, well they have millions of clients. Instead of giving the situation time to develop, the Internet took the easy path to instant gratification, destruction.

If you mess with ourIdol(X) we(Y) will not hesitate to take you(Z) down, and not care about them(ABCDEFGHIJKLMNOPQRSTUVW)

A better solution would have been: Get the news. Allow the news to sink in. What is the gravity of the situation? Are there any opposing arguments? Let those arguments sink in. Rationally, which view is better? Has the news changed yet? Form opinion. Talk to opposition. Plan. Attack.

All of that should take at least a 1 or 2 days. Internet, their on it in like 5 minutes.

>I would choose order over anarchy any day.

I suspect you don't know much about anarchy if you think it's without order. It's just (according to the literature) without inequality.

>but I wonder what that cost other people?

At this point, there is pretty much no action you could take that would have any effect on the people you wish to motivate without affecting innocent people as well. Deciding to not use a monopoly business only has negative affect on you, not the monopoly. They wont even notice.

Cyber warfare has always been a staple of sci-fi fiction, but generally between nation states. I can't help but wonder if the reality is that this 'warfare' won't be so much between nation states, but between governments and the public and we're witnessing the start of this with a secretive and paranoid government(s) on one side and a distrusting and increasingly activist 'public' on the other. Corporations are stuck in the middle looking at their bottom line, but pressured from both sides.

I read an interesting editorial a few months back -- can't remember where -- that basically made the counter-intuitive point that we are not headed towards totalitarianism. Far from it. We are headed towards mob rule.

The writer used the various strikes and protests in Europe as an example. His point was that as the nation-states became less relevant, people would begin to more closely associate in virtual groups than geographic ones.

I _also_ read the recent leaks about China, which leads me to believe that the Chinese think they can keep a lid on the internet.

This could be the beginning of a long, drawn-out period of chaos and overreaction by all sides. Sure would suck to have to choose between that and totalitarianism (even if, in the end, totalitarianism wouldn't work) Perhaps this is some author's overactive imagination though. I sure hope so.

Public demonstrations in Europe these days are generally well-behaved. Probably the main motivation for taking to the streets is to ensure that the government at least acknowledges an issue rather than simply ignoring as was case in the past.

The anarchist groups active today are a little less troubling than groups like the Red Army Faction, Red Brigades and the Irish Republican Army that were a feature of the 1970's and 1980's.

The real danger of mob rule might come from unscrupulous politicians making capital from social tensions. The recent series of expulsions of Romany from France and Italy were certainly a very troubling reminder of Europe's recent history.

1989 is only a bit over 20 years ago:

http://en.wikipedia.org/wiki/Nicolae_Ceau%C5%9Fescu

And I do not doubt that if some European politician got it in to their heads to try something really stupid that such 'reminder' demonstrations would turn violent pretty quickly.

In France it wasn't 5 years ago that 100's of cars were burned every night and in the Netherlands squatters do battle with the riot police with some regularity.

Mob violence is never far away.

I think that the events in France don't belong to this list. France is dealing with a lot of youth criminality from ghettoized communities. The burning of cars was not backed up with any political claims. It only reflects how authorities are losing control over certain neighborhoods.

The burning of cars was - as far as I understand it - a direct consequence of multiple decades of festering trouble that was not adequately recognized or responded to by politicians. The shortest complete description of the background on this was something like 'these youths are protesting not against any specific policy but against being born in to a situation that they find it almost impossible to escape from in the country that they are nominally a citizen of'.

If you can do better than that be my guest, but I definitely see them as motivated by politics, even if not directly attacking a specific policy or having a concrete goal. It's more an act of frustration with life set off by the friction between police and these youths, specifically one incidence was the spark that set off the powder.

Not that I disagree with your point, but 1989, while only 20 years ago was a different era. Especially regarding Romania or anywhere east of Berlin. It's closer to 1979 than it was to 1991 in a lot of regards.

I'd argue that on the surface everything seems different but that underneath that surface more of it remains than you might think.

I've lived 'east' of Berlin for a while and still spend quite a bit of time there and in Romania and this particular sentiment strikes me every time I'm there. In the big cities the differences are large but outside not nearly as much if at all. Poverty is still quite present and the fat cats have found ways of getting fatter.

At least it's gotten easier for people to get around, provided they have the means of doing so.

Ah yes, but I think all other dictators be it China, Singapore, Iran or North Korea have learned from the Romanian/Yougoslavian/East German, etc. experience.

A successful mob revolution requires a huge mob that can spill over government opposition. Such a huge mob can be prevented in 2 main ways - $ and Fear:

1. The Chinese and Singaporean approach: The fascist state with a booming economy. Fear of punishment and desire to make money keeps the mob small.

2. The North Korean approach: Have such a huge military that the rest of the country can not overrun it ever. The downside is no state can support that kind of military and you get starvation.

Iran etc. are a mix of 1 & 2 with less prosperity then Singapore but more sate violence and spying then China.

I have absolutely no faith that a violent revolution can happen anywhere in today's Europe. We're too old and too rich.

I live in Romania, and although I was only 8 years old in '89, I remember pretty vividly what happened.

      Such a huge mob can be prevented in 2 main ways - $ and Fear

Fear, Doubt and Censorship is what defined the Stalinist regime before Dec '89 in Romania.

     The North Korean approach: Have such a huge military that
     the rest of the country can not overrun it ever.

The military is formed out of ordinary people that can switch sides at any time. Also wars are won in the hearts first: you can make the military switch sides if you give the impression that this isn't a war they can win.

In Romania I still think it was a coup d'état, as the army switched sides quite early; but the mob was there, it was furious ... and it emerged out of nowhere. And it was interesting because romanians really aren't violent people.

Governments should learn to not piss off citizens: people can take a lot of pain before acting, but there's always a tipping point and from there onward it turns into a civil war between millions of people and a couple of thousand with guns (but that's a short-lived tactical advantage).

>we are not headed towards totalitarianism. Far from it. We are headed towards mob rule.

In Plato's Republic, he set up a cyclical theory of the progression from one form of government to the next. From aristocracy to timocracy to oligarchy to democracy to tyranny and back again to aristocracy.

The transition between democracy and tyranny was ochlocracy, a.k.a. mob rule, out of which emerges a demagogue.

Plato might have underestimated the power of the internet.

> Corporations are stuck in the middle looking at their bottom line, but pressured from both sides.

Maybe some of them fall into this category, but many of the others are the ones pulling most of the strings.

They are responsible for millions of dollars in campaign contributions, whereby they essentially buy seats in the House and Senate and dictate much of the legislation. They influence voters through mass advertising and propaganda, they influence the representatives through lobbyists and the threat of withdrawing their financial support.

The "government" then becomes a battlefield between the ignorant, the manipulated, the enlightened, and the powerful manipulators sitting at the top.

many of the others are the ones pulling most of the strings

This seems to be a chicken-and-egg question to me. I'm not sure how you can determine whose strings are being pulled, and who are the pullers.

Is it really the corps that are coercing the politicians into misbehavior? Or is it the politicians that create an environment in which corporations can gain an advantage by doing so?

Who has more money and power in your opinion? The answer of course differs by country - it's one extreme in the US and another extreme in Russia or China.

Perhaps I don't understand the question, because I can't see that the answer is variable.

In all countries today, the power of the government, or an individual politician, exceeds that of a corporation. That's obviously true, or why else would the corporations be contributing to political election campaigns? Corporations are (despite popular complaints) at the mercy of their customers; look at the OP for an example of how corporations are held instantly responsible for any perceived action, contrasted to politicians who "launch an investigation" and then the problem is forgotten long before the next election, or who use demagoguery to convince voters that they are the lesser evil; if the opponent wins the country will fall apart.

Similarly, in all cases the government controls far more money than any corporation. What portion of the GDP does the government's budget make up? Compare that to the revenue of any corporation.

EDIT: OK, guys. I'll take a down-vote, but please give me the courtesy of an explanation as to why I'm wrong.

Yes, theoretically national power supersedes power of any single corporation in that country. That doesn't mean that corporations as a whole don't influence governments or vice versa. It all comes down to who needs whom the most.

US multinationals do depend on security provided by US Government, but they can exist without it too. The US Government on the other hand is absolutely and wholly dependent on large multinationals, at least in it's current form.

In China or Russia it's the other way around. Government does work with both domestic and multinational big co's, but shall the need arise they will be reduced to Nil in no time as has been demonstrated time and time again.

P.S. power of any individual politician exceeds that of largest corporations? Seriously?

US multinationals ... can exist without [the US government] too.

Yes, in the sense that they don't need to rely on the government. On the other hand, they are at the mercy of the government. One quick flourish of the pen, and a company can be destroyed. Obviously this is true at the startup scale, where a niche can simply be erased. But even at the larger scale, a national decision to back one approach can be devastating (as in FCC decisions). Or antitrust actions can decimate a company (ATT, IBM, narrowly avoided by Microsoft). The bottom line is that the government has the guns, literally.

The US Government on the other hand is absolutely and wholly dependent on large multinationals

I simply can't see how this is the case. Can you explain further? I mean, I don't see how the government needs Google or GM in any way.

power of any individual politician exceeds that of largest corporations?

I probably made that sound grander than I should have. In once sense, if every other politician is against you, then in general, winning one to your side won't help. However, in more realistic circumstances, winning a single person to your side (especially with America's committee system) can make all the difference. A single congressman influencing the language of a bill can mean hundreds of $millions in income, or the complete obsolescence of your business plan.

One quick flourish of the pen, and a company can be destroyed. Obviously this is true at the startup scale, where a niche can simply be erased. But even at the larger scale, a national decision to back one approach can be devastating (as in FCC decisions). Or antitrust actions can decimate a company (ATT, IBM, narrowly avoided by Microsoft).

This is just absolutely not true. When US president has the guts to suggest that company(ies) responsible for largest ecological disaster in US history should pay for it, it equalled to "shake-down" to people currently running US legislative branch, then what are we even arguing about? ATT, IBM and MSFT were decimated? Seriously? They were broken-up, as they were approaching monopoly (that's a good thing you know), but all three examples and their spin-offs are thriving since then.

One thing you got right though - start-up world is risky.

Your response seems to assume that if the government is "right" in its action (apparently as determined by your criteria alone), then the action of force somehow doesn't count. That is, because BP did evil, or because consumers might be protected, government action somehow doesn't count as force that asserts power of corporations.

Even if you're right, it's beside the point. My argument was that government holds ultimate power even against the biggest corporations.

It is true that they're not always able to wield their power, as in your BP example. That's a good thing, because it demonstrates that the government is at least constrained to operate predictable (i.e., the rule of law). If the government were able to spin anything as a righteous stand, and do whatever they thought they could get away with, then business (and indeed any freedom) would be stymied, because people could not be certain that they'd be able to go about their business -- the fear from uncertainty would inhibit all sorts of activities.

And the fact that ATT and IBM are doing well now really doesn't enter into it. The simple fact is that these were giant, powerful corporations. Yet the government still had the power to tear them apart. That simple fact demonstrates my argument; the "goodness" of the action is besides the point.

I can accept the vague assertion that "the government" is more powerful than a given corporation. However, the government does not ever (not even in the aftermath of 9-11) act as a single unit. Looked at in this way, it's easy to see that there are many corporations that are more powerful than individual politicians. Money and corporate connections are force multipliers with politics, and concerted corporate strategies can effect many changes that affect the public at large, as well as tax revenue deficiencies and other free-rider problems.

>In all countries today, the power of the government, or an individual politician, exceeds that of a corporation.

Nonsense and demonstrably false. If Al Gore had won his election that would have been the first time in 20 years that a candidate who didn't spend the most money won a presidential election. In Michigan the only Senator to vote against the Patriot act got ousted by a clueless hack who, once again, happened to spend a lot more money.

Spending more money doesn't always win, but it has enough effect that politicians live or die based on campaign contributions. Snap their fingers and wipe away a corporation? Yea right, so no other corp would ever give them money again?

I'm afraid you're living in a dream world. The US government is completely owned by big business. The only difference between republican and democrat is which companies they are owned by.

Correlation != Causation

It's true that if the person who becomes president is always the one who spent the most money that the money might not have had any effect, but that's extraordinarily unlikely. It's hopefully not the only cause but it's virtually guaranteed that it's related and very likely that it's a major cause.

It's sort of interesting - maybe even ironic, although I don't know if that adjective is quite applicable - that when a news story comes out that says that a major website is down due to DDOS, the first thing I do - and probably what many others do - is try to go to that website to see if it's still down. That, of course, must make the situation so much worse.

compared to the traffic the servers are seeing from the bots, the single requests of curious people is pretty negligible.

I think this is setting a very dangerous precedent. Yes, it was lame what Mastercard did to Wikileaks, but it wasn't technically illegal. What Anon is doing to Mastercard, however, is completely illegal and damaging, not only to MC but to its customers too (who are innocent bystanders in this case).

I'm going to try to articulate a position that I think that I understand but is not mine, so please bear with me.

Let's put aside what is "legal" and focus on what is "socially desirable" business behavior from the perspective of Anon. MasterCard, as a private entity, has wide leeway in how it chooses to deal with other private entities such as Wikileaks. Is this socially desirable? While I have no special insight into what Anon is thinking, I would surmise that they are not pleased that private entities are restricting free-flow of information and acting as a state's agents even when not compelled to do so by the force of law.

We've heard from many business (Amazon, PayPal, etc) that blocking WikiLeaks (and consequently inhibiting free distribution of classified US documents and secret corporate information) is, at its core, a profitable business decision. I would guess that Anon is trying to send a message that such an "anti-freedom" decision (scare quotes intentional) can instead become very expensive.

But what is "socially desirable" is a completely subjective thing though. There could be a small group of Anons that think banning gays from entering the military is "socially desirable" and use that as a basis for taking down websites of companies who work with the military.

It's Mastercard's choice whom they do business with, and by launching this attack Anon is only further solidifying the misguided popular belief that Wikileaks is akin to a terrorist organization. It may seem like a victory in the short term, but in terms of Wikileak's PR I think it's a huge setback.

It's Mastercard's choice whom they do business with

No it's not.

I'm really interested in this, and I'm confused as to why people are voting you up. You provided an answer with absolutely no evidence to support what you said and people find the answer either, a) Helpful or b) Interesting.

Can you explain how it isn't their choice? Mastercard, VISA and American Express turn down applicants ALL the time, so doesn't this go against what you are saying here?

I'm not sure what his point was, but technically it's true, at least in the U.S. There are a host of "protected classes", and if you refuse to do business with someone because they're in that protected class, you get in Big Trouble. This includes race, color, gender, age, etc.

http://en.wikipedia.org/wiki/Protected_class

It's not true, otherwise signs that say "no shirt, no shoes, no service" would be illegal. You're referring to laws against discrimination based on race, sex, or disabilities. This says nothing about refusing service to people for other reasons, such as a rowdy bar patron or someone who violates Terms of Service.

It's generally understood that refusing to do business with someone for political reasons, unless the person's politics involve genocide or something, is against the social contract. Not illegal, but generally not approved of by anyone (unless you have the whole US media playing the mccarthy card against the person, apparently).

I think there are many people who, given the chance, would not do business with WikiLeaks (on the grounds that their actions are perceived to be against the US national interest and potentially putting lives in danger). So I'm not sure where you're getting the idea that this would be "generally understood ... to be against the social contract."

If you're a small business and people can take their money elsewhere, that's one thing, if you're one of two giant corporations providing a vital service, that's another.

There is a difference between turning down an individual for financial reasons and turning down an organization due to political pressure (whose money they were completely okay with taking before the hammer fell down).

I'm not saying it isn't their choice, but there is no real advantage to them angering politicians who could screw them on votes or funding at some point in the future.

I vote him up because I don't vote based on agreement. Invisible text simply makes the discussion difficult to read.

They're now collectively turning down something. That's not something they should be allowed to do, given that they control a lot when it comes to moving money. It puts a consumer in a position where he has no choice.

Another thing, the people who think that bringing down Mastercard is going to help Wikileaks in any way need a serious reality check.

Why would anyone do business with someone if there was even a tiny chance that they would get screwed over the next day to the tune of MILLIONS and MILLIONS of dollars. The fact that mastercard.com is down and their SecureCode service is offline has already cost thousands of small businesses millions of dollars. Do you think these companies are going to support something like Wikileaks after this event?

I know I mean thats like thinking 12 guys back in 1776 could really stop the British Empire with their silly little tea parties.

Except your assertion requires that the availability of imported tea was an essential component to the American Revolution's success. The founders didn't reduce their available resources by making people less likely to import tea.

Anon has reduced Wikileaks' available resources by making people less likely to facilitate donations to them.

http://thenextweb.com/media/2010/12/09/caving-to-pressure-fr... 'nuff said.

http://www.zdnet.co.uk/blogs/security-bullet-in-10000166/leg...

Visa and MasterCard can block payment providers if they believe those generate a lot of fraudulent activity, not because they disagree with those organisations activities.

The only people who are going to blame this on Wikileaks are the people who are uninformed enough to already think they're a terrorist organization anyway. I wouldn't spend too much time worrying about what such people think because unless you can get a spokesmen on Fox News you can't change their mind anyway.

It's not a dissimilar concept to strike action, in that it may well have a negative effect on customers, but is believed to be neccesary none-the-less.

I fully support unions and strikers, however I'm not sure how I feel about this kind of action. The similarity ends with differences such as strikers have names, faces, spokespeople, they decide together if they are for or against striking, it isn't one or more people with nothing to do with the company who makes the decision.

The difference might not be as huge, Round Robin was not invented for nothing. Just that the online world has more opportunity for anonymous sabotage.

Strike actions have symmetry and boundedness. Withholding labor obviously affects both the company and the workers and the action can only go so far since both sides need each other to survive.

This kind of action is asymmetric and unbounded: Anon can hurt MasterCard without cost to himself (presumably) and he can theoretically carry it out for as long as he wants. This can only lead to some kind of escalation if MasterCard (and similar entities) want to survive.

Agreed. My comparison was purely in reply to the concept of "you shouldn't hurt a company to improve things, because it hurts their customers too."

Well the you can compare it with commercial sanctions to Cuba, Irak or North Korea that the international community don't suffer too much (they're not big players) but the people of those countries do, not only their governments.

OTOH, you can't let dictators use their own population as hostages, when they buy weapons instead of feeding the populations (Saddam, which you mentioned, had lots of money from smuggling).

Also, is it better to let those populations suffer in "jail" for generations? (If I was Eastern European, I'd be pretty pissed to have been left to rot until 1989.)

If nothing else, the dictators spread their problems (support of terrorists, atom weapon programs etc).

Look at WW II for what will happen when democracies are pressed. At the start of the war, British military argued against bombing private property (German factories). Compare that to a few years later.

(I guess the place where this is closest to happen next, is Israel and the humongous Hezbollah (/Hamas?) arsenals of rockets optimized for attacks against civilians.)

Point is, those juntas are arguably a blight on humanity that needs to be solved, the longer it takes the worse it might be.

Ah well, this is both after the discussion and irrelevant to Wikileaks.

Edit: Made a bit clearer.

Oh, there wasn't much of a disagreement on my part; I was just pointing out the essential differences more explicitly.

> Anon can hurt MasterCard without cost to himself (presumably)

Presumably getting caught and jailed/fined is a potential cost? So it's not an action without risk/cost.

As one of their propaganda posters says, "Just say you've gotten a virus." The chances of anyone getting nailed for this are pretty low.

I wouldn't be so sure. This was organized somewhere and I doubt every one of the people involved was technically good enough to completely hide their IP address. Don't be shocked if someone gets jail time and a fine of millions of dollars over this.

"Socially desirable" is the right way to think about it. Law has always been "mob rule", with competitive courts competing to define what this entails.

"Legal" just means the government agrees with it. The state claimed a monopoly on "law" along the way.

The tension we see today is that the "legal" does not represent the "socially desirable" / "law" anymore.

Granted, a binary offline/online result using DDOS attacks is a very rude reputation system, but the reputation feedback processes can be improved upon by competition (semantic web startups anyone?).

Law has always been "mob rule", with competitive courts competing to define what this entails.

Exactly. In the US we have a system of checks in balances to pit competing mobs against each other in a way such that it is sufficiently difficult for a mob to rule over a large population. But if the mob gets sufficiently large, they can rule. And likewise, for small geographic regions we often do have mob rule.

The cynical part of my brain is currently quite convinced that there several members of some US security agency currently on 4chan instigating these pointless attacks in an attempt further turn public opinion against wikileaks and their supporters. People quickly switch from indifferent to hostile once they are personally affected.

Ridiculous. USG agencies already have their hands full of dealing with this stuff, not adding more to it.

The agent provocateur is hardly an unknown or last-resort tactic for any modern government: http://www.independent.co.uk/news/world/americas/fbi-plant-b...

alright, alright, you win. 4chan is CIA's covert operation to install New World Order.

If a bunch of script kiddies (albeit in considerable number) can take down MasterCard, then it's pretty much MasterCard's fault alone. It's not like they didn't have the money or opportunity.

Seriously? Blame the victim?

When MasterCard does millions of dollars a day worth of online transactions, which can be halted by LOIC, then yes, blame them.

LOIC is really, really basic, and anon has never really gathered any respectable amount of bandwidth. Most small botnets put them to shame.

What I suspect, however, is that actual botherders are using these raids as cover. They can still DDoS the target, but 4chan takes the blame. The recent addition of "hivemind" functionality to LOIC, which slaves the user's computer to an irc feed that controls targeting and firing, seems like the perfect opportunity for a botherder to set their botnet to take orders from same.

Online transactions weren't halted, mostly just the corporate brochure-ware sites.

And attacking a website is never justified. It is wrong regardless of how much effort the owner puts into securing it. Likewise, it's exactly the same crime to steal a car that has an alarm as one that doesn't.

Meh. I'm not defending the attacks. I do think, however, that the moral landscape is significantly greyer than you depict. No nascent movement in history has been morally acceptable by the standards of the establishment. Whether this becomes the American Revolution, the Khmer Rouge, or That One No One Ever Heard Of Or Remembers remains to be seen.

As to your specific point, leaving my car unlocked with the windows down overnight on a dark street in Detroit doesn't make the inevitable thieves justified, but it does make me retarded, and completely undeserving of sympathy.

A bunch of "script kiddies" can make any website unavailable for some period of time.

edit: The only difference is in how fast you manage to recover.

"Any website" is quite a claim. Google or Microsoft frontpages won't go down that easily.

Making Rosa Parks get out of her seat was lame but not technically illegal. Her refusal was completely illegal and plenty of folks argued it was damaging.

I don't see why civil disobedience should cease to be civil disobedience just because it's on a computer.

Yes, and it kicked off the Montgomery Bus Boycott. Not slashing tires or road blockades.

An incredibly critical point.

A boycott is only effective if the disgruntled group has enough population to affect the business of the target. There in lies the problem with a DDoS attack. It is not a symmetrical response. A small group of people could execute such an attack, while the majority of actual customers may not have an issue with their actions.

Judging by the difficulty that MC has in dealing with this one I wonder how big that 'small group' really is.

As compared to total MC customers and daily transactions, I'm sure it's infinitesimal

according to netcraft, it only took 400 machines. http://news.netcraft.com/archives/2010/12/08/visa-com-taken-...

A small group of MC lawyers and executives also has say on whether you can use of the three largest payment methods on the planet to fund a group you sympathise with.

When it comes to oligopolies, the usual rule of corporations as private, independent entities that can do whatever they please, goes out the window.

"Life, liberty, and a credit card merchant account" doesn't quite have the same ring to it.

Must they also offer service to companies with bad credit or a history of fraud?

Bad credit and fraud are actually good reasons to deny a service, and fraud is, you know, an actual criminal offence that is easily demonstrable, unlike the arbitrary decision of the Department of State to not like an organization and whine about it to their corporate friends.

Actually if you read the updated story, the State Department didn't say anything to Paypal. It was Paypal's decision.

That said, Paypal is not making nearly enough on transaction fees to cover wasting a single minute of a lawyer's time. If there's even a chance of there being legal issues with an account holder, it's almost certainly in their business interest to end that account.

Don't be naive. Credit card companies have lobbies which operate in their interests and help pass legislation which favors their industry, much like other financial interests.

There doesn't even need to be explicit conversation between government officials and Visa/MasterCard for there to be a conspiracy; it's more of a matter of a gentleman's agreement to cover each other's backs.

Not that I approve of MC's actions, but I think they're perfectly in their right to deny service to WL. I don't think their excuse of "illegal actions" cuts it, because as it's been pointed out, the illegality of their actions is still in a very gray area. However, I think they should be able to sever ties with a customer and I cannot see what law would prevent them from doing so in this case. WL is not in any protected class (http://en.wikipedia.org/wiki/Protected_class).

I don't like that they've denied them service, but I believe it is and should be perfectly legal for them to do so. Can you explain why you think it should be illegal?

By arbitrarily accepting or rejecting clients, they essentially determine the existence or lack thereof of these organizations. In the same way that Google has suffered legal action for alleged manipulation of search results (though I must credit them for being very consistent in that regard), MasterCard should also be accountable as not just an actor in a market, but a gatekeeper.

A market that's guarded by a couple of monolithic entities with similar interests is not open, and without credit card transactions a lot of international business is essentially impossible. I believe that's too critical an issue to be left to the whims of corporations.

The situation would be very different if we had dozens of easily available credit card providers who would take our money with no hassles. Whether you consider that a failure of the states or the corporations is no the issue at hand. The problem is one of assigning too much power to aisngle entity.

Seeing as "Political Affiliation" isn't in that list of protected classes, does that mean that a private (i.e. non-government) corporation can legally say "I won't sell to you because you're a {Republican,Democrat,insert-your-party-here}"?

They boycott itself was deemed illegal, too.

http://en.wikipedia.org/wiki/Montgomery_Bus_Boycott

> Under a 1921 ordinance, 156 protesters were arrested for "hindering" a bus, including King. He was ordered to pay a $500 fine or serve 386 days in jail.

I think you missed my point.

Perhaps he did, but to be fair a DDOS is more like a sit in than tyre slashing. Inconvenience and delay, but no lasting damage.

And in fact it has been contextualized as such in the past: http://en.wikipedia.org/wiki/Electronic_Disturbance_Theater#...

And here's the HN comment comparing an anonymous DDoS attack to Rosa Parks physically and nonviolently resisting an unjust law. The reverse-Godwin, right on schedule.

They are alike in the aspects being discussed. Comparisons need not entail that two things are completely identical in all respects.

Rosa Parks wasn't really harming anyone in her actions. Anon is most certainly harming people with theirs. I don't see how a parallel can be drawn.

How is DDoSing MC physically harming someone? I say physically, because Rosa Parks was, at the very least, caused economic harm.

And here's the HN comment comparing a non-violent DDoS attack as penalty for unjust operations to the violent LA riots.

It's all in how you spin it.

Just because the issue of race is still emotionally charged doesn't mean there isn't an equivalence to freedom of information and protection of whistleblowers.

And let me add: if I'm going to get downvoted into the light greys, I'm proud that it's for mocking people who compare anonymous DDoS attackers to Rosa Parks.

You're not getting very downvoted. And you seem to be missing the point. It's not to compare the value of what's being done; this is clearly nowhere near fighting for rights. It's to compare the damage done to the company.

I think its a good problem solving tactic to try to look for analogous situations and gain insight into our current dilemma in doing so.

I think a better analogy might be a sit in. If you occupy all the seats in a restaurant, I think it kind of qualifies as a meatspace DOS. I guess the difference is that in civil rights sit ins of the 60s, the people sitting in actually wanted service.

I guess the digital analogue would be a bunch of people requesting permission to donate to Wikileaks, rather than permission to load the page. It seems the subtle difference is that civil rights groups actually wanted the service that they deny to others, while anon wants a service different from the one they are denying to others.

I guess its up to individuals whether they think the difference is significant.

I guess it goes to show that Mastercard should think about what is best for their customers as opposed to what is best for the government. The reality is that, nowadays, if you make an unpopular decision with a large part of internet users you may get DDOS'ed.

Visa + Mastercard is a duopoly. They have been abusing their domination for years. I don't feel sorry for MC.

You do realize that there are actual human beings working for Mastercard who are just like you and I who are getting hurt by this, right? There are real people behind these websites.

Following orders is not a valid defense for wrongdoing. If you work for a company, you're complicit in their wrongdoings.

That's not true at all. A secretary filling documents should not be held responsible for the way the corporation is run. That's just plain idiocy to claim that employees of a company are to be held responsible for corporate policy. Now if they did something illegal while working, that' another story but I don't think that's what you meant here.

Nope, that's exactly what I mean here. Now, we're talking about my own personal set of ethics here, but it's pretty straightforward:

* Your role is an employee is to help accomplish a corporation's objectives.

* (In this case) the corporation's objectives are unethical.

* You're contributing to something unethical.

That being said, nobody is perfectly ethical. But if I worked for Amazon or PayPal, I'd have quit by now, and I'd never have taken a job with MasterCard in the first place.

I also don't mean "held responsible" in a legal sense, either. They've done nothing wrong legally. Legality != morality, though.

While I understand your premises, I question the idea that an employee is ethically responsible for all of the actions/objectives of there employer.

"responsible" is a bit strong, but that doesn't mean contribution on some level hasn't occurred.

All of them? Of course not.

But they are responsible for those they know about.

On what grounds?

my guess is that you a) don't have a mortgage b) are exceptionally skilled that finding another job is not difficult for you

Most people don't have the option of just up and quitting their jobs.

I don't have a mortgage, but I also never will.

Even if finding a new job is easy, it's still difficult. I just went through this process, it's still rough...

As I said, everyone makes choices. Everyone commits minor works of evil. If doing wrong is worth your mortgage... it's your life.

Just because other people don't "have the choice" doesn't mean that those of us who do shouldn't take the opportunity to do what's right.

Meh. In a few years when we all depend on the internet even more, the law will catch up with this sort of internet petty vandalism. A couple of people will get sued and thrown into jail, joe schmoe user will be cut off from the internet the moment a ddos is detected from his ip, and people coordinating 4chan ddos'es will be tracked and arrested.

The only reason these things work today is because of a lack of urgency. I mean, when this starts happening every week, people will call for regulation, it may take a few years to get it sorted out politically, then another few before the policy catches up, and things like this won't be possible any more.

In the mean time, the damage done is relatively small. Yes it sucks for some online merchants, but let's not blow this out of proportion.

I remember 10 years ago there was a 'digital sit in' (the term 'ddos' didn't exist yet) on my at that time employer's website. There were camera crews coming in, interviewing our CEO's, it was big news. In reality, the effect was minor; averaged over the few days around it, the loss of sales was not even statistically significant.

I for one can't wait for the day when a government agency can detect that I'm initiating a DDOS from my home connection the second I start and immediately disconnect me, without a warrant, court order or trial.

Then you initiate it from the McDonald's parking lot, silly! Isn't free wireless grand?

When you drive too fast with your car, the policy will stop you and give you a fine, or take away your car on the spot. All within the bounds of the law, court-supervised. I'm not seeing the difference.

Imagine 100 years ago, when building and driving cars was practiced by enthusiasts only, how they must have lamented the prospect of not being able to drive as fast as they would like to on all roads! I'm not saying I'm looking forward to more control over the internet, but the Wild West days are over, and as the internet and computers become more fundamental in societal functioning, some form of oversight to safeguard a good functioning are inevitable.

And thank goodness nobody speeds anymore.

Seriously, if you thought enforcing traffic laws was a futile affair, just wait until the other 4 billion people on this planet get online, and the Internet becomes the medium of transmission for literally every bit of shared information on the planet. Think about it: every TV show, every film shown in theaters, every phone call, every book, magazine, and newspaper; things I'm not even thinking of because they haven't been invented yet. (While we're on the subject, every speeding ticket too.)

That day will come, sooner than you think. You seriously believe we will have the capacity to police that? I am dubious.

The point of imposing speed limits is not to 100% root out risky road behavior, it's to set a framework within which a 'generally safe enough' situation is created. Enforcing traffic laws is not a 'futile affair', I have no idea where you get that idea. Are you saying that people's behavior is not influenced by traffic laws? Are you saying that these norms do not transgress from the administrative to a collective social norm, where respect for general road safety becomes ingrained in all well-adjusted participants to that society? If so you have not reflected much on changes in social mores over the last 50 years.

You can hardly expect these things to arise overnight. I'm not sure what your point is on all the data that will be generated, transmitted and consumed. There is (in the context of this discussion) no need to track all of that, only to find out what the source is of traffic deliberately causing problems. Of course we will be able to pinpoint the origin of disturbances; when we can't any more, we'll be in Singularity territory, and then all of this is moot anyway.

This 'this is the Internet, your norms don't apply to us' nonsense needs to die already. With the internet becoming institutionalized, the same order that has arisen in meatspace will arise online. Of course there will always be the fringes where subgroups hang out in to a greater or lesser degree separate order (like the downtown biker bar in meatspace), but that doesn't prevent order from existing elsewhere.

My point is that the quantity of activity I am talking about will far exceed our ability to analyse and/or control it. Hell, that's already happened; if you don't believe me, I've got a record industry I'd like to sell you.

Take your own phase, "pinpoint the origin of disturbances." What exactly is meant by that? There are literally thousands of people all over the world who loaded up LOIC and are participating in this attack. I myself contributed simply by surfing to Mastercard.com to see what all the fuss was about, as I'm sure millions of others did as well. Who is culpable? Assuming it were technically possible, how would you go about solving this problem? I hope you'll agree that the word "pinpoint" is hopelessly inadequate here.

Anyways, the entire analogy is flawed. Policing that internet is absolutely nothing like patrolling the highways. How do you account for encryption? The fact that physical presence has no bearing on your online activities? This is unlike anything we've experienced before, and I have a hard time seeing free and democratic societies putting the genie back in the bottle. China is another story.

LOL, I'm reading this while watching the news here in the Netherlands with a clip on searches by the police at a Dutch hosting company that was hosting a website that called for the DDoS on MasterCard. The legal system is already catching up.

The question is not how to control, within hours, an attack like the one that happened on MasterCard. The matter is that when it happens again, and there is enough momentum for it, everybody participating will be logged (I mean it's generally not that hard to distinguish between a regular visitor and someone running LOIC) and prosecuted. After a while it will become known that doing things like this has consequences, and the amount of people willing to participate will fall rapidly, until there is only a core left (this core is usually hard to control, but small enough to not matter much).

Take another analogy: rioters. What is the strategy when you have a group of rioting protesters? You contains the damage (police squads to keep the mob from strategic points) and you arrest a few of the core people and prosecute them. That doesn't stop rioters, but it does impose a barrier on participation; so the size of the group of people willing to riot is small enough to be restricted to some extremists (which, despite popular opinion, is quite small).

I'm really not a fan of Internet mob justice. I don't see how this attack helps Wikileaks in any way. It's only going to make it harder to find anyone willing to do business with them.

Exactly. Not only that, but it will make them seem even less sympathetic in the eyes of the general public.

It doesn't help WikiLeaks and it's not supposed to. What you're seeing is a group of people who looked at MasterCard's decisions, and reacted to prove them wrong.

MC thought that preventing money from going to some people who move information around was a smart business decision. Anonymous replied with, <<No, trying to prevent the free flow of information is a bad business decision.>>

They do this, presumably, with the idea that next time MC will think twice before doing their part in silencing the flow of information.

This is all irrelevant to WikiLeaks. They have nothing to do with this at all, except that their particular case provides Anon with a clear example to set for MC.

You really think cyber terrorism is going to make Mastercard more likely to want to work with similar groups in the future?

Woah, don't put words in my mouth like that! I never said I thought that. That said, I'm not sure I understand your question. Wikileaks and Anon aren't related. MC can't choose to deal or not deal with Anon. Their choice is about Wikileaks, who have nothing to do with any of this.

If they continue to choose to ban payments through their system to Wikileaks, I assume they'll continue losing money from DDoSs. shrug I don't have any idea what'll happen, but I think you have to accept that Anon has a point, even if you don't agree with them.

MC slows the flow of information. Anon slows the flow of cash to MC. If MC doesn't respond, it seems like they'll keep losing money.

While I understand the logic of your point, I think the assumption you make is that MasterCard will add in the costs of a possible DDos attack when considering whether they made the right business decision.

And I think the answer is no, although it's arguable. There is surely a point at which MC will try to do the "right" thing instead of the profitable thing, and it's easy to see how that point is between cutting off Wikileaks (which arguably is harming US national interests) and changing business strategy to appease hackers.

I think you missed his point again. He's not speculating as to what MC will optimize. He's just stating point of fact, as we understand it today. If you do A then B will happen.

Given that its unclear to me that what Wikileaks even did is illegal (http://www.nytimes.com/2010/12/02/world/02legal.html?_r=1) I have little sympathy for MC. It just feels like they're a bully in this situation. It does suck for their customers though. Maybe more customers will drop MC due to their inefficiency? Who knows.

How is it being a bully to deny service to a customer who may or may not be committing a crime? There is no inalienable right to have a credit card merchant account.

That's why we call it 'being a bully' and not 'committing a crime.'

Seems like the lesson to me would be, never offer service to any controversial organizations in the first place lest the Internet mob punish you for withdrawing that service later.

If I worked for any sort of internet payment gateway, I'd certainly make sure to never take on Wikileaks as a client.

I am not a fan of mob justice either — but neither am I a fan of "tour de force" justice as practiced by Amazon, Mastercard and Paypal, under pressure from US Government. I think this is a relatively good way for everyone involved to learn that every action has consequences.

Notice that if there is no response at all from, let's call it "the internet crowd", then there will be no free speech on the internet. Any attempt to say anything which corporations aren't comfortable with (this includes anything that the governments aren't comfortable with) will be quickly silenced.

So, while I am not a fan of 4chan's DDOS attacks, I see them as a reaction — similar to crowds in the streets.

If Private companies, all in concert, deny a party the ability to publish for whatever reason, is that different from government censorship?

I think not. It is of course if it is only one private company, because the individual has a choice, but if all private companies deny it, then the individual has no choice, thus it is no different than the government itself having denied it.

This that we are seeing, I believe, is the connection between corporations and government in action, the business-government complex if you like. Private companies should not have the right to discriminate based on other's beliefs or opinions.

Only SecureCode is affected (the MC equivalent of Verified by Visa), not all MasterCard online payments.

Thanks. I updated the title.

Better attack: reduce the credit card usage, and try to pay more with cash. As both MasterCard and Visa (the ones against Wikileaks) take the gross of its revenue from retail and pay by credit, that could really hurt them... but without doing anything illegal. It's just business: you fuck Wikileaks, I reduce your profit, dear [put your favourite megacorp name here].

Boycott list:

    * Amazon (Amazon stops hosting WikiLeaks website [Reuters, 20101202])
    * Tableau Software (Another Falls: Tableau Software Drops Wikileaks Data Visualizations [20101202])
    * Everydns.net (WikiLeaks fights to stay online after US company withdraws domain name [guardian.co.uk, 20101203])
    * Paypal (WikiLeaks loses PayPal revenue service [cnn.com, 20101205])
    * PostFinance (Swiss bank freezes WikiLeaks founder's legal defense fund [rawstory.com, 20101206])
    * MasterCard (MasterCard pulls plug on WikiLeaks payments [cnet.com, 20101206]
    * Visa (WikiLeaks loses PayPal revenue service [ibnlive.in.com, 20101207])
    * Twitter??? (it was or it wasn't censorship?)

Boycotts are good way to go. But for giant companies like Amazon and Paypal, it is unclear that they would be able to correlate determine why their sales are going down.

Unless the Boycott is huge.

Both Amazon and Paypal ask you why you closed your account with them.

Now, if you just reduce your usage of their services, then you're right, it'll be hard to attribute.

Is it a checkbox, or do I write in: WikiLeaks?

No Wikileaks checkbox, you have to write it.

Regarding Everydns.net, the impression I got was they withdrew their service not because of any specific disagreement with Wikileaks, but because it was negatively impacting their other customers (if 10,000 people kept requesting Wikileaks, the 20-30 other people trying to request other sites had to wait a lot longer). I'd agree with them on this one.

A better way to show Mastercard that you don't like what they're doing would be to cancel your Mastercard and/or stop accepting MC payments.

This only works if enough people do it AND tell MC (and possibly the media) why they're doing it, though.

Yes, and that is how it is supposed to work. Boycotts and demonstrations not working, does not justify attacks.

The problem is this isn't how it happens. First, consider that no attack is really happening. It's merely digital, it harms no one physically. So this is merely economic harm (indeed, calling it an attack only elicits sympathy for the victim). Gandhi used an attack on the economy with his salt march. He broke laws.

Boycotts and demonstration raise awareness, but unless it reaches a critical mass, they don't work. Boycotts and demonstrations that disrupt (like marches through the street or strikes) are other forms of economic attacks that cause real monetary loss.

Voting with your wallet only works so far. Usually you're in the minority. Not because you're wrong. Even elections understand this: the results are based on those who voted, not those who could vote.

Review history, and time and time again you'll see economic attacks as parts of non-violent means.

It does harm people physically when, say, their sandwich purchase doesn't work and they become overly hungry -- physical stomach pains. And maybe a diabetic somewhere will end up in the hospital.

And what about the guy who was buying safety equipment and now he has to do the first day without it?

I can apply the same "what if" logic to Rosa Parks, who caused police to be sent to arrest her rather than patrolling their location and stopping a murder. Or someone on the bus that got delayed being late for a job interview, not getting it. Or that same diabetic not being able to get to his medicine he left at home.

Edit: I should also remind you that even if you want to accept your arguments, they aren't impacting actual transactions. Merely SecureCode transactions done online. So I highly doubt a diabetic in need of medicine now is going to order online.

Edit 2: And seriously, a guy get's a bit more hungry because he has to wait a tad longer because he can't order Fat Man's Pizza online because SC is down, and that's violent? Heck, then I guess Gandhi wasn't so peaceful after all, what with his salt march causing less money for people, and therefore, less money to buy food with, and therefore, less food to eat.

It's hard to think of a plausible way that Rosa Parks hurt anyone but it's very easy to think of plausible ways that having your credit card denied could hurt you.

But I didn't know it was online only. In that case it's hard to think of plausible ways it would do physical harm.

I didn't say "violent" so don't complain about me calling stuff "violent". All I said is that economic harm can cause physical harm, it's not harmless (contrary to the person who said it is harmless. not low on harm but literally harmless).

You should not be upset with people who make corrections without expressing any opinion. Factual, literal-minded minor corrections are no threat to your side unless your side is mistaken.

> It's hard to think of a plausible way that Rosa Parks hurt anyone but it's very easy to think of plausible ways that having your credit card denied could hurt you.

No. I can't think of a way having my CC being denied online is going to physically hurt me. Maybe you can give an example.

Seriously though, your logic is flawed.

> I didn't say "violent" so don't complain about me calling stuff "violent".

Sorry, but what would you call an attack that causes physical harm? Peaceful?

You don't have to say the word violent, but you can still describe it.

> All I said is that economic harm can cause physical harm

And a butterflies wing could flap because of it can cause a hurricane causing the deaths of millions. Yes, everything is connected. I can create all sorts of crazy scenarios. Let's stick to reality.

Anon is doing a DDoS. Twisting that round and saying "Anon is attacking people causing physical harm" is dumb.

> Factual, literal-minded minor corrections are no threat to your side unless your side is mistaken.

I'm fine with factual, logical minded corrections. Your comment was void of that. You should remember context.

Until you can show anon attacking people causing physical harm, your actually not saying anything.

Why so hateful?

That's an intellectually dishonest argument. In my opinion the restriction of funding to Wikileaks is far more damaging.

i'm pretty sure it's the other way around: overlooking or complaining about the fact i pointed out, b/c one cares for a global conclusion, is intellectually dishonest. I didn't say a word about wiki leaks, I simply corrected the person who said that economic harm doesn't have any real life harmful consequences, which is false. I did not even try to say what that means; I just think we should use true premises whatever judgment we end up making.

Your probably is your being thickheaded. On purpose, or because that's who you are.

Yes, economic harm has real life consequences. Everything relates. Heck, you could make arguments that NOT DDoS could save someones life because someone couldn't pay for a gun they were going to use to kill someone with. You can go crazy with all sorts of stupid thought experiments. I mean, hell, let's go all out. Your posting of comments is killing living things, what with all the electricity needed to power the servers that connect your computer to this server. Your purchase of your computer keeps low-wage works in low-conditions.

But all that is stupid.

And that's not what I meant. And you know it. That's what makes you dishonest.

Why so hateful again? Why go to a different part of the thread, where I'm talking to someone else, to call me stupid, dishonest, thickheaded, and intentionally immoral?

Is it because you think I posted something wrong on the internet?

I would beg to differ on the "no attack" part. Digital has real world implications and if someone is not able to buy a product because of this then it is an attack. It is like arguing that a protest on the sidewalk is equivalent to nailing the businesses front door shut. If you've ever had your credit card denied when trying to buy gas or food, you probably would understand what happens when someone does things like this in the modern world.

If boycotts and demonstrations don't reach critical mass, then they were not accepted by your peers. Be glad for this, many groups that are not generally accepted do marches that don't generate popular support.

> I would beg to differ on the "no attack" part. etc.

Same logic can be applied to Rosa Parks, who held up a bus full of people and delayed them from getting to wherever they were going, and also forced a police officer to deal with her rather than stay on patrol watching for real crime.

Of course, even in this case, it's dealing with the MC servers, which affects SecureCode. People aren't buying gas or food out and about with SecureCoded MCs.

I might be getting my history wrong, but Rosa Parks did not attack anyone. Once again, this is the difference between a demonstration on the sidewalk and boarding up someone's store.

Short memory span? You argued that Anon was attacking people causing physical harm (of which I was arguing against).

So, either you agree with me... or you disagree with me. Which is it? Are you suggesting Parks attacked people, or do you agree with me?

I at no point said it was "physical" , but I said it had real world implications. Rosa Parks was peaceful and in no way can be compared to these people doing the DDOS. I am rather offended by the comparison. I believe that a DDOS is an attack. I also believe your last post twists and does not address what I actually said, and I am disinclined from answering further. People can protest, boycott, and educate others, but the crossing of the line to attacks is mob madness and not to be celebrated.

The problem with this line of reasoning is that it is not a democratic response. The size of your wallet determines the size of your vote, which gives the millionaires and the multinationals all the votes.

I'm fairly naive about the specifics of a DDOS, but it's such an obvious vector of attack that I'm surprised it's a major vulnerability.

Could anyone explain what it would take to minimise vulnerability to such attacks? I would have expected the standard load on SecureCode to be pretty high anyway, so I'm surprised that an attack brought it down. I welcome anyone to fix my reasoning :)

There's really no way around a DDOS, except to pay for enough servers to swallow all the fake requests and real requests. That's probably far too expensive to do - at least for now. Maybe the cloud can bring a solution to this, with the idea of spinning up new VMs as needed.

Basically, if your site is open to the public then it's open to bots. And there are far more bots than people. So if someone directs their bots to your site, you'll go down.

End of story.

There are plenty of ways to defend against this kind of attack, with varying degrees of efficiency and automation.

Yeah, it looks like I'm wrong about that. But then, I'd have to raise the question why MC hasn't done anything (successfully) yet to defend against this? They must be losing hundreds of thousands of dollars (per hour? not sure of volume here) because of the SecureCode payments failing all over the place. Also, a falling trust from consumers and vendors.

It seems mission-critical to get their site back up, but they haven't. I assumed that was because they couldn't. But if you say they can....why haven't they?

My guess would be that they incorrectly estimated the magnitude of any attack that they would have to deal with and are now scrambling to get a procedure in place that allows them to forward lists of 'known bad' ip addresses to their upstream providers to be placed in ACLs.

Everything is hard the first time.

I wonder if it would be viable to offer DDOS protection in the form of a huge bank of servers that the victim could rent for a specific period of time to help alleviate the affects. Companies could pay for it like it's insurance.

There are companies that do this. There was an article a long time ago on Wired (IIRC) that described how this was built for an online gambling company when they were being extorted.

Something like www.blacklotus.com

The program that is being used is a multi-threaded .NET app that opens a lot of connections and then allows them to timeout.

Easiest form of DoS to carry out and easiest to defend.

Prevention:

a) Upstream forwarding proxy that will block all requests from an IP that hammers the server

b) Low timeouts (5-10 seconds)

c) Intelligent upstream router than can drop the routes

d) They are hitting mastercard.com, which should be distributed on a CDN

e) Separate the public website from the application, don't even but them in the same IP address block

At Techcrunch we survived a 4chan DoS attempt. Surprised Mastercard didn't (I think the scale of this attack is larger, but still)

>At Techcrunch we survived a 4chan DoS attempt

I wouldn't mention it; just my friendly advice. Anon is a fickle beast.

> I think the scale of this attack is larger, but still

That's a pretty large but, when a DoS is, by nature, all about scale.

In fact, pretty sure it's this program:

http://en.wikipedia.org/wiki/LOIC

They even gave it a cute name.

I find the 'relinquish control' part really interesting. Someone could totally f anon over if a hivemind version with access to the OS was released. Yeah, you could only ever use it once, but once is enough. 4chan would reverb about it for months.

Also because I just kept imagining the program playing a clip of the Harbinger going "assuming direct control" whenever you relinquish.

The issue at hand, and what you have to minimize depending on what attack is being used, is malicious packets reaching your servers. Now, it is a fairly difficult task to figure out what packets are malicious and which packets are real as they definitely look alike.

Going with the latest web server attack (the long open connections with POST) there is not a whole lot of protection that could be afforded other than throwing more resources and more servers at the mix such that each of them can handle the open connections that are SLOWLY sending data to them. There could be time-outs, but those are easy to figure out with some experimentation and it doesn't require much to keep endless connections going forever and sending the bare minimum required to keep the connection alive.

Other attacks like ICMP ping floods just flood the network to the point that the routers are unable to physically carry the traffic from point A to point B. They start dropping packets. If at this point you attempt a TCP/IP connection it most likely will not get through in the large flood. ICMP traffic can be dropped at the door, letting legitimate traffic through again, and generally can easily be taken care of at the edge routers.

Then there are the various TCP/IP flood attacks which are mostly designed so that on the target a connection stays in an open queue whereby the host runs out of backlog so that it can't accept new connections, also known as half-open connections. SYN cookies help with this.

Or still the best method is to have a VERY large botnet of computers that attack the target so that the amount of traffic is simply overwhelming no matter the method used. If your server is on a 100 Mbit connection, you can NEVER accept 1 Gbit worth of data. Now multiply that and start looking at where in the infrastructure there is a bottleneck. If inside your network you can accept 10 Gb's a second, but your gateway router is only rated at 1 Gb's a second you can just choke the router and it doesn't matter what is behind it.

With massive DDoS attacks it becomes very costly, as you have to divert the traffic elsewhere first where it can efficiently be filtered for legitimate and non-legitimate and then have it be sent on to the actual backend servers that then respond.

You don't need to scale up to solve a problem of slow active connections. You just need to use a frontend web server that doesn't allocate a thread/process per connection.

Each connection has a state attached to it - be it a TCP socket state in the kernel or an application-level state like that maintained by a web server. Create sufficient amount of connections and you will exhaust server's memory. A thread per connection is merely a way to trigger the very same problem faster.

Sure, a bit of state, but if you have a server designed to maximize connections you can handle orders of magnitude more than something like apache. Then you reach a point where being able to handle traffic below the absolute network-crushing level isn't very hard to do.

I'll be interested to see if Mastercard's stock takes a dive as a result of this. Not that I don't expect it to recover quickly of course. But it does make me wonder who first suggested 'operation payback', and what exactly their motives were...

there's been no impact on their price that I can see so far.

So basically if you help wikileaks you'll be DDOSd by the (presumably) government. If you cut them off you'll be DDOSd by other parties.

The only solution is to have nothing to do with them. Not exactly an optimum solution - I'd much rather be cut off and constantly find new hosts than have people afraid to have anything at all to do with me.

These attacks are not helping wikileaks.

As an organisation Wikileaks should distance themselves as far from this sort of activity as possible. If they condone it, or even merely appear to condone it, then their fate is most certainly sealed.

I wonder if the perpetrators of this attack realize an attack against e-commerce may attract the attention of federal authorities more than one against a quasi-religious group.

Yeah, it's almost as if the government and large businesses only care about each other.

The really sad part about this is the people who are probably getting most hurt by this are the web developers who maintain mastercard.com; probably a few fellow HNers. I'd hate to be in their shoes right now.

Reply on news.ycombinator.com