Denial of Service Attacks

If anyone wants to convert from a given time zone to your local time zone, you can use: date -d '2014-03-14 14:25 PDT'

Google does this conversion automatically on their own outage pages.

You're totally right. I just adjusted the post to convert the times to UTC.

>Since every technical person should know their current UTC difference,

Awww, that's so optimistic.

I'd rather see the local time for whoever is writing the article. I'm not a machine, and hopefully neither are they.

That is when you live in the US of course. Europeans, to my knowledge, all use GMT and have nearly nothing to do with UTC.

I met some folks from GitHub last year, and this is what they postulated as well.

It just isn't even possible to say anything specific in terms of anonymous person's motivation. If they had a name and face that is the only time you can talk with some certainty.

Perhaps some developer was not going to make his deadline or wanted to take down the network to give him more time? Who knows...

Github is a valuable target if attackers are trying to get access to private repositories. A lot of organizations have their entire code base on Github.

There's a good piece of journalism (EDIT: see the reply to this comment for the link), in which someone who was being DDoSed went into the various black-market forums where such people as would DDoS hang out, to see if they could find their attacker.

What they found was that, at one forum, there was a convention where new, as-yet-untrusted sellers of DDoSing-as-a-Service are expected to take down some big, technically-respected target (e.g. GitHub) to prove their mettle, before anyone would hire them. And conveniently-enough, some new DDoSaaS seller was advertising right then, telling everyone to "look and see that _________ is down. That was me! Hire me now!"

It further turned out that the site-owner doxxed the account, found them to be a thirteen-year-old(!), and called their parents to tell them what their child was doing on the internet.

Perhaps in this case it's advertising - a proof of the power of the bot farm that a cracker somewhere is trying to sell?

As people leverage the deployment API more and more for production use-cases, an attack on github might come to represent an attack on the ability of MANY products to push changes and respond to their OWN attacks in a comfortable manner...

RIAA trying to take down popcorntime

Ha! This is good satire, but for me personally, github going down isn't a version control problem nearly as much as it is a project collaboration problem. I can't go review pull requests and discuss issues when github is down, but I can still do all the traditional version control activities. Github is so much more than distributed version control. If somebody started doing the non-version-control things that github does in a distributed fashion, I would be very interested in taking a look.

I am still laughing at this comment.

Actually there are quite a large number of researchers who have concluded that the underlying architecture of the internet itself needs to be more distributed. They call it data oriented or name-based networking, content centric etc. The hardest part about switching over to a fully distributed internet is to maintain existing business models. Either someone will figure out and successfully market a business friendly universal data/computing distribution distribution system/network, or we will see free ones pop up that start to supplant more and more centralized services that are associated with particular domain names on the traditional internet. We are also eventually likely to see very strong push back against ISPs that overcharge for business internet. Well, at least in a sane and just world all of this would come true shortly.

I was wondering the same thing? Maybe Github competitors?

-criminals demanding ransom

-"our agency has received intel that this site is a spawning ground for computer hackers" see: freenode ddos

Perhaps you have a botnet and want to test its capability on a "small scale"/unimportant target before unleashing it on a larger target?

Sort of like testing without getting massive amounts of repercussions.

Competition would be my first guess. Or an active employee somewhere that doesn't want to use github: "See, it's offline, we should roll out our own solution/keep using what we have". Or just testing out botnet on an appropriately sized target. Or anything else really. There are dozens of valid reasons.

Can you think of an easier way to negatively impact productivity at nearly every tech startup? There might not be a reason other than simple bullying. In fact, I think these attackers might be the same ones behind that 2048 game.

Others mentioned Github competitors, but I think it could be anyone's competitors. I.e. Your competitor knows you're using github to handle your continuous deployment (or whatever reasons), by bringing github down, they bring you're whole development environment down.

That's just a (dumb) hypothesis. The cost of doing so is probably not worth it.

Cred. If your botnet took down github, that's impressive.

Yea I was thinking exactly the same thing - DDOS attacking github? There are better things to do with your time.

extortion, see meetup.com recently

It is the same thing I've wondered. What has github done to anybody? Is it for the L0lZ? Is it because they happen to host somebody's gaming code, or IRC code that they feel should be taken offline?

Though when you think about it, taking out github is a very effective way to basically kill the productivity of many dev shops. At the place I'm working now, we are basically dead in the water while github is down (can't do deployments, can't merge pull requests, can't run automated testing, etc).

Github hosts a bunch of full websites too. It's not terribly uncommon for an entire hosting provider to be attacked simply because someone doesn't like what one user posted.

1) Attack and show'em who's king 2) Ask for money to not repeat the attack 3) ??? 4) PROFIT!!

Malware, DOS, DDOS, etc nowadays is driven by simple and plain crime. Spy's stories are really the exception.

Considering that so many software companies use Github for version control, and have it tied into their deployment workflow, it might make sense for Company A (not dependent on Github) to DOS in order to hurt Company B (dependent on Github).

In fact, some software companies run Github on their private servers (https://enterprise.github.com/) that prevents them being affected from a DOS to Github's servers. Granted, these companies probably made the decision to use their private servers for other performance and security reasons as well, but avoiding DOS could very well be a reason.

Why would someone want to DoS Mozilla's Bugzilla installation? People try monthly or so. Maybe even for similar reasons.

Because, although some DOS attacks follow a 'moral' code (According to whoever's morals are relevant at the time), not every DOS attack does, in the same way that some people steal from those who have less, some people vandalise state property, some launch wars based on lies. In fact, I'd go as far to say that 'bad' things that happen probably don't have a justifiable moral purpose underpinning them more often than not, and that goes for DOS attacks too.

I was going to disagree with you, but then I realized I didn't understand what you were saying: What do you suggest they should have done?

There are likely many people who have not experienced this form of attack. Many who may not have even been aware of it explicitly, and this article may have made this aware of it, and what the common strategy is for dealing with them. That's good, and so many developers user github, so the article likely reaches a larger audience than those "thinking about DDoS hardening".

What isn't useful is the narcissism of your comment, and the assumption is that everything should be targeted at you and people like you.

Isn't the whole point of git that you don't need to even have internet access to get work done?

Unfortunately there may not be a "good" reason. It's not hard for me to imagine that someone could do it for kicks, or perhaps to test some new attack vectors against a reasonably hardened target.

Usually it's some kid who wants to show off their botnet (or, more likely their $5 booting service investment) to their friends on hackforums.

I deal with this crap all the time.

Perhaps the attackers are drawn to sites they believe will later publicly document the attack, to learn whatever they can on how the operations team responded.

Just as anti-virus providers are sometimes suspected of creating viruses to help drum up business, I wonder if this could be a case of anti-DDOS service providers either doing some nasty marketing, or, looked at another way, running a protection racket.

Lots of businesses heavily relies on Github for their operations. Sure, Git is distributed, but there's more to Github than just Git; think of continuous integration/deployment tools that integrate with the service, PRs.

Attacking Github means you deny many more than only Github as a target. Which I guess, makes it more valuable than another target.

I always wonder this myself. Were I skilled enough to be able to execute such big scale attacks against someone or something, I wouldn't think of Github as a potential target. Github is just some code, it doesn't bear any political or financial weight. But then again, some people get a kick out of ruining stuff so why not.

Cloudflare is a very popular choice.

Their Pages hosting feature uses Fastly -- I would assume they use the same service across their infrastructure.

$ dig origin.github.com +short

github.map.fastly.net.

199.27.76.133

This is what we use at our company. Recently bought by Akamai.

http://www.prolexic.com/why-prolexic-best-dos-and-ddos-scrub...

Seems like it'd be pretty trivial to circumvent that. Just have your botnet do a few regular old requests to the network a few days before launching. That way the IPs of the botnet members get white listed.

For a website of GitHub's scale, I don't think it would be very effective, though maybe it could be helpful in combination with other measures.

It's not practical with the sheer number of legitimate IP addresses that access GitHub, unfortunately.

Direct peering with the eyeball networks helps a lot, as you can use smaller links (and thus, smaller scrubbing devices) on them. I do not believe that it sacrifices network neutrality, really.

Comcast is really in a class of it's own regarding one-sided peering policies, but the other providers like Cox for example are fairly easy to peer with.

If the majority of ASNs in the world followed BCP 38, these attacks would be more difficult because the origin would be easily identifiable. Today you can't tell where it's coming from because backwater networks see value in letting their customers emit forged packets however they like. So all you can do is mitigate and wait for them to move on.

BCP 38/RFC 2827 would change the DoS game, but it's been a best practice for longer than most of this audience has been alive and nobody yet gives a shit and/or they are too lazy to automate the implementation. So operators waste their lives cleaning up after bad actor ASNs that they can't even identify. I shouldn't be mitigating 65 Gbps destined for a controversial customer, the attacker should be removed from the Internet before I even notice.

You can tell from my tone that attacks are part of life for me. I'd venture that denials are the second largest problem facing the Internet today, behind the organizational structure of critical systems like DNS and ahead of spam and surveillance. However, there is now a sizable DoS prevention industry so I wouldn't be surprised if BCP 38 drifts into even more obscurity, but that's the cynic typing.

You can DOS anything that has a network interface.

Why wouldn't they do this? They presumably want someone to look at the attack before engaging the protection, and I'm sure not all of their staff is able to make network changes. If they've got it automated to the point where a single command can do it, what does it matter via what method they use?

If they're all in Campfire anyway, there's no overhead here.

It's just the most efficient and visible way for us to do it, it's not the only way. Here's a couple of reasons why we like it:

1. It's scripted so you don't have to think about it at 3am.

2. The rest of the team can see it happening in realtime so you don't have to explain what you're doing via a side channel. They can see it happening.

3. It doesn't require specialized knowledge of routing to enable it. If the on-call engineer sees an attack and calls someone for guidance, it's super easy to tell them "type /mitigation enable" for instance.

4. Of course we can run the exact same script or login to our routers and manually change our BGP announcements if we need to.

A binary order of magnitude is only doubling, which doubling traffic isn't exactly a DDoS just a busy day and likely within the spec of their current network to handle.

A decimal order of magnitude is a factor of 10. And would likely represent a problem.

Really not hard, you don't use the term 'order of magnitude' in binary. Instead opting for 'bit shift', or doubling.

Doesn't matter to me, 2^X and 10^X are close enough to each other for pretty small to large values of X. When I say it, I usually mean something between x5 and x15.

I think avoiding the temptation to false precision is more important. Inconsistent units and the retention of insignificant digits in order to make numbers look bigger (or smaller) drive me up the wall, though.

A good heuristic: if in doubt, assume the counting system we all use for everything, all the time.

For binary I would expect them to just say "double".

You're not annoyed that they don't mention octal or hexadecimal? Base 6? Base 60?

Most probably :)

I'd be surprised to hear someone using binary to talk about bandwidth... Or pretty much anything else.