Interesting afternoon…

[inxilpro (Chris Morrell)]

Hey all,

We’ve had an interesting afternoon at InterNACHI. Our server got hit with a denial of service, or DDoS, attack, and we were dealing with 50x traffic for several hours. This is what it looked like:

We’ve contained the problem and blocked the offending IPs, and have been monitoring the situation. Sorry if anyone was affected by slowness or downtime!

If you’re in Ukraine and just accidentally tried to download all of NACHI.ORG every second for several hours, sorry we had to block you!

Chris

[belliott (Bob Elliott, 450.0002662)]

Wondered what happened.
What is the purpose of this type attack ?

[mcyr (Marcel Cyr, CMI)]

Well, that explains the Server is too busy for a few minutes.

[dhays (David Hays, CMI)]

@belliott

Wondered what happened.
What is the purpose of this type attack ?

They were just trying to slow Frank Rotte down a little. He was burning up the NACHI server. :mrgreen:

[frotte (Frank Rotte)]

@dhays

They were just trying to slow Frank Rotte down a little. He was burning up the NACHI server. :mrgreen:

Hardly fazed me.

[inxilpro (Chris Morrell)]

@belliott

What is the purpose of this type attack?

Hard to say, and probably no way we’ll ever know. When you get as big as we are, you become a target for stuff like this. We deal with a handful of attacks like this every month. Usually they’re not as big as this, or don’t cause as many problems. This one just was particularly effective.

Just for fun, I logged out of one of our servers and then logged back in immediately. When I logged back in, I was greeted with this:

There were 17 failed login attempts since the last successful login.

So, in less than 3 seconds our server saw 17 attempts to break into it. It’s just the reality that we have to deal with nowadays. Luckily, 90% of the time our automated systems catch it, and 90% of the time that they don’t, our IT team steps in before we get into any trouble.

Also, we use really freaking strong passwords

Chris

[sfetty (Dave Fetty, CMI)]

I noticed about an hour or two of the “the server being too busy”. Thanks for the update as to what happened. My Google Adwords info tells me I’m flooded with traffic from Russia, is there a way to stop or guard from the attacks?

[rernst1 (Robert Ernst)]

Good job stopping that DOS. It shows a good IT team. Back in the day I worked for a company that was attached allot and it can eat up allot of resources.

[lkage (Larry Kage, CMI)]

@inxil

Hard to say, and probably no way we’ll ever know. When you get as big as we are, you become a target for stuff like this. We deal with a handful of attacks like this every month. Usually they’re not as big as this, or don’t cause as many problems. This one just was particularly effective.

Just for fun, I logged out of one of our servers and then logged back in immediately. When I logged back in, I was greeted with this:

So, in less than 3 seconds our server saw 17 attempts to break into it. It’s just the reality that we have to deal with nowadays. Luckily, 90% of the time our automated systems catch it, and 90% of the time that they don’t, our IT team steps in before we get into any trouble.

Also, we use really freaking strong passwords

Chris

Thanks for the update and your teams’ expertise.

[belliott (Bob Elliott, 450.0002662)]

@inxil

Hard to say, and probably no way we’ll ever know. When you get as big as we are, you become a target for stuff like this. We deal with a handful of attacks like this every month. Usually they’re not as big as this, or don’t cause as many problems. This one just was particularly effective.

Just for fun, I logged out of one of our servers and then logged back in immediately. When I logged back in, I was greeted with this:

So, in less than 3 seconds our server saw 17 attempts to break into it. It’s just the reality that we have to deal with nowadays. Luckily, 90% of the time our automated systems catch it, and 90% of the time that they don’t, our IT team steps in before we get into any trouble.

Also, we use really freaking strong passwords

Chris

Seems all the attacks come from Russia most of the time.
I know Dom deals with them for years from there.
Whats the deal with Russia and Hackers ?..LOL

I suppose they are doing us all a favor in the long run by teaching us to learn security.

[cwallace1 (Charles Wallace, OK License # 70001308)]

They are usually attempting to break in to obtain / steal personal information: user names, passwords, credit card info, DOB, SSN, etc…

Thanks for the update Chris.

[jjonas (Jeffrey Jonas)]

It’s Nick’s fault.

[dmorris5 (Dan Morris)]

People need to get a life and quit doing “Mindless” junk like this. It just shows they are not progressing in life other than getting some sort of satisfaction on causing other people pain.