S'identifier ou s'inscrire

TorGuard.net - Anonymous VPN Service + Torrent Proxy

TorGuard: 1 - Skids: 0

Discussion dans 'News' créé par Scamp, 13 Novembre 2013.

Page 1 sur 2

Scamp rm -monkey

Inscrit le:

3 Octobre 2013

Messages:

335

Page d'accueil:

http://twitter.com/scaemp

ED account:

Scampini

How one site beat back botnets, spammers, and the “4chan party van”

One Sunday late last month, administrators at Orlando, Florida-based TorGuard were in high spirits. They had just successfully rebuffed the latest in a series of increasingly powerful denial-of-service attacks designed to cripple their virtual private networking service. Despite torrents of junk traffic that reached peaks as high as 15Gbps, the admins had neutralized the offensive by locking down the TorGuard servers and then moving them behind the protective services of anti-DoS service CloudFlare.

"This seemed to anger the attackers, however, because on Monday things got a bit more personal," TorGuard administrator Ben Van Pelt told Ars. "Unable to spam, DDoS, hack, or social engineer us, they employed the tactics of the '4chan party van.' Throughout the day our office received multiple unrequested deliveries from local pizza chains, Chinese food, and one large order of sushi. A handful of local electricians and plumbing services were also disappointed to be turned away. To my knowledge no fake calls have been placed to law enforcement yet, however nothing would surprise me at this point."

The two-month-long campaign of harassment and attacks, which Van Pelt suspects was carried out by a competing virtual private networking service, illustrates the lengths some people will go to goad their online adversaries. His experience provides a vivid account of what it’s like to be on the receiving end of a relentless stream of distributed denial-of-service attacks and ultimately what can be done to mitigate them.

10 million e-mail onslaught

The attacks began in late August, shortly after TorGuard announced a promotional campaign that slashed normal fees by 50 percent for both new and existing customers. Within 24 hours, the company's support inbox received torrents of junk e-mails, and not the typical kind that flog male enhancement pills or sham investment proposals, either.

"The messages were spoofed to appear as [if] they were coming from our own support desk while the subject and body were left blank or filled with random gibberish," Van Pelt recalled. Referring to the Simple Mail Transfer Protocol many e-mail systems use, he continued: "The SMTP servers generating the massive onslaught of 10 million daily e-mails were in Argentina and we were unsuccessful in contacting the provider. After a few added rules on [Apache firewall module] mod-security we were successfully blocking the 'mailbomb' attack."

The lull didn't last long. A month later, TorGuard sent out a newsletter notifying customers of new network nodes added in Germany, Iceland, Japan, and Australia that were designed to make connections in those countries faster. Once again, about 24 hours after the e-mail went out, TorGuard came under another paralyzing attack. The 10Gbps waves of traffic appeared to come from PowerStresser.com, AvengeStressor.com, and a handful of other so-called "booter services." They directed the junk traffic only at IP addresses used by the new VPN nodes announced in the newsletter. To Van Pelt, the intent was clear—disrupt TorGuard's stated plan to deliver faster services to new customers.

Enlarge / A graph showing the bandwidth of TorGuard's OpenVPN server in Germany during its first 24 hours in operation. The drop off at 23:00 is the result of the gateway being rebooted at that time.
TorGuard
"In this particular attack, the sole purpose was to knock services offline by saturating the OpenVPN server's UDP port with invalid requests," he said. "In the VPN business, 'downtime' is a bad word and will cause customers to look elsewhere quickly."

Enlarge / Bandwidth for the same server as measured by data center operator Level3. Almost identical attacks also hit new TorGuard servers in Australia, Japan, and Iceland.
TorGuard responded by periodically changing the IP addresses used by the targeted nodes. But almost without fail, shortly after a new address was provisioned, it would come under attack. The ability of the attackers to rapidly target new IP addresses led Van Pelt to suspect that they were running the TorGuard service so they could keep track of the internal servers it used. Ultimately, that didn't matter. Van Pelt was able to block the assault by modifying the company's border gateway protocol. The new routes funneled the junk traffic into a virtual black hole rather than to the VPN servers. Once again, Van pelt said, operations returned to normal.

Then, near the middle of October, the service released new proxy software that made it easier for customers to use TorGuard with Vuze, uTorrent, and other BitTorrent programs. Once again, TorGuard found itself under a new tidal wave of junk traffic. This time, the DoS attack came from some two million separate end users, an indication that the attackers were now deploying one or more extremely large botnets of infected computers.

For a while, Van Pelt was able to repel the attack by hardening TorGuard's CSF Firewall, which allows for "stateful packet inspection." That measure augmented the tweaks he had done already using a "DDoS deflate" script, an Apache module known as Mod_evasive, and sysctl to fend off the smaller DoS attacks. Eventually, those measures proved futile as the new round of attacks delivered data floods as high as 15Gbps.

The distributed nature of the attack and the much larger amount of data it delivered once again knocked TorGuard offline, despite the previous tweaks Van Pelt made. It was at this point that he sought the help of anti-DDoS mitigation service CloudFlare. Almost immediately, service was restored.

Thank you for DoSing

With TorGuard back online, Van Pelt and his colleagues were on the receiving end of a rash of phishing e-mails, attempts to brute-force crack their e-mail account passwords, and repeated calls to the company's toll-free support number. When those didn't produce any results, the unsolicited food deliveries and service calls started. Throughout them all, however, the TorGuard service didn't go down. Then, finally, there was silence. The attackers seemed to give up and there have been no significant attacks since.

Van Pelt said he suspects a rival VPN service was behind the attacks. He has no conclusive proof, but he cites this tweet, which he said acknowledged in-progress DoS attacks at a time when there was no public knowledge of them. He also estimated that the attackers may have spent upwards of $7,000 in costs for booter services, SMTP servers, and botnets for hire.

"There is not a doubt in my mind that the perpetrators behind the attacks are from a rival VPN provider," he said. "I believe the targeted nature and costly budget requirements for an attack of this size rule out the notion that someone is doing it just for the 'lulz.' The person or groups involved have obvious interests invested in seeing that TorGuard's operations were interrupted time and time again."

He also cited a rash of attacks on other VPN services.

Ultimately, Van Pelt said the attacks have been a boon for TorGuard. Including costs for anti-DoS mitigation and increased bandwidth, the company is paying only $800 more per month now than it was before. In return, he said, the service has been pushed to become much more robust than it otherwise might have been.

"If I could say two words to our attackers, it would be this: 'Thank you,'" he said. "Because of your due diligence, we have performed extensive security audits on our network and I can confidently say we are now ready for anything. Also, please note that our staff prefers healthy foods and doesn't eat pizza or Chinese takeout."

Since TorGuard is one of our main advertisers they deserve the rub.

If you have $5 a month to spare on a quality VPN, highly recommended.
http://torguard.net/aff.php?aff=024

Source http://arstechnica.com/security/201...ack-botnets-spammers-and-the-4chan-party-van/

Scamp, 13 Novembre 2013

#1

GSTalbert1, minty, MedicalParrot et 6 autres personnes aiment ça.
- Like x 9
- OP is a Faggot x 2
KoalaRimjob EDF Hero

Inscrit le:

14 Juillet 2011

Messages:

1 882

Occupation:

Server Administration

ED account:

ProgrammerTroll

No SSTP No Sale!

PPTP? WTFRTHEYSMOKING

3rd party vpns suck donkey balls

KoalaRimjob, 13 Novembre 2013

#2

Lyle aime ça.
- Like x 1
jack EDF Elite

Inscrit le:

20 Juillet 2011

Messages:

2 694

I love it when two ant hills of scum and villainy fight each other over a dead bird.

jack, 13 Novembre 2013

#3

VX Salesman, eigdew, Whatever et 6 autres personnes aiment ça.
- Like x 9
Dr. Rice Girlvinyl

Inscrit le:

18 Juillet 2011

Messages:

8 729

Occupation:

The Avatar of Goebbels

Page d'accueil:

https://twitter.com/Ben_Neato

ED account:

Uncle_Ben%27s_Rice

I see the proliferation of cyber-weapons continues

Dr. Rice, 13 Novembre 2013

#4

VX Salesman aime ça.
- Like x 1
Aroukar EDF Elite

Inscrit le:

12 Mars 2012

Messages:

3 576

Occupation:

Professor emeritus

Is this the beginning of the end of DDoS attacks?

Aroukar, 13 Novembre 2013

#5
Milwin 2013 Faggot of the Year

Inscrit le:

15 Janvier 2013

Messages:

5 060

Occupation:

The Toast Cult

Page d'accueil:

http://gay.porn.com/

ED account:

milwin

When a fail hacker makes his target even better, he should check whatever privilege he has left and then kill himself.

Milwin, 13 Novembre 2013

#6

ilovejesus69 aime ça.
- Like x 1
- Shit Post x 1
The Lieutenant EDF Hero

Inscrit le:

29 Août 2011

Messages:

630

Occupation:

The Lieutenant

ED account:

Lieutenant

In other news, it turns out that maybe Anonymous is a reason for enhancing national security in the same way that vaguely Asian looking people are a reason for building concentration camps.

The Lieutenant, 13 Novembre 2013

#7
Atomic_Joe Joevahkiin

Inscrit le:

22 Juillet 2011

Messages:

6 775

Occupation:

Throat Puncher

Page d'accueil:

http://www.pown.it/3209

ED account:

Atomic_Joe

Yes, I'm sure the brightest 14 year olds /b/ has to offer were bringing out the biggest shitty script attacks for this whole thing. I'm willing to bet the farm they were butt FRENZIED when they found out that competent computer programmers were deflecting their shitty attacks.

Atomic_Joe, 13 Novembre 2013

#8

MedicalParrot aime ça.
- Like x 1
- Shit Post x 1
Slavoj Jizzek Girlvinyl

Inscrit le:

28 Mars 2012

Messages:

2 062

Occupation:

I'm an evil Scotsman and my name is Jock

Let me see if I understand this. They decided to prevent their website from going down intermittently by switching it to cloudflare.

Slavoj Jizzek, 13 Novembre 2013

#9
MrGask #FreeGask

Inscrit le:

28 Novembre 2011

Messages:

12 137

Occupation:

Bastard child of Jigsaw and Kayako

Page d'accueil:

http://www.nucleardarkness.org/nuclear/nuclearexplosionsimulator/

ED account:

mrgask

No mention of LOIC. I am sadded.

MrGask, 13 Novembre 2013

#10

xMaGgOtX aime ça.
- Like x 1
- Shit Post x 1
xMaGgOtX Dramacrat

Inscrit le:

3 Mars 2012

Messages:

73

Occupation:

nice

wow, owned

xMaGgOtX, 13 Novembre 2013

#11
zaiger Kawaii on the streets. Senpai in the sheets.

Inscrit le:

14 Juillet 2011

Messages:

6 698

Occupation:

Dramaticorp

Page d'accueil:

http://twitter.com/zaiger

ED account:

zaiger

TorGuard is an A+ service. We use them on ED and I use them with my own computer.

zaiger, 14 Novembre 2013

#12

xMaGgOtX aime ça.
- Like x 1
Baya Rae 4900 Lawlman

Inscrit le:

14 Juillet 2011

Messages:

24 706

Occupation:

Nazi Chocolate (25.8069)

Page d'accueil:

http://encyclopediadramatica.se/Nest_Of_Vipers

ED account:

Deusapien

15Gbps.

I can't even fathom that.

Baya Rae 4900, 16 Novembre 2013

#13
scumhook Managing account details

Inscrit le:

15 Juillet 2011

Messages:

14 078

Occupation:

Fellator of the homeless

Page d'accueil:

http://www.ungod.ly

ED account:

Scumhook

Baya Rae 4900 a dit: ↑

I can't even fathom that.

Then get ready for this...

Teraflop

scumhook, 16 Novembre 2013

#14

Whatever et Solution aiment ça.
- Like x 2
ilovejesus69 So Classy

Inscrit le:

2 Septembre 2011

Messages:

4 007

Occupation:

Community Outreach

scumhook a dit: ↑

Then get ready for this...

Teraflop

Petabyte

ilovejesus69, 17 Novembre 2013

#15

scumhook aime ça.
- Like x 1
ilovejesus69 So Classy

Inscrit le:

2 Septembre 2011

Messages:

4 007

Occupation:

Community Outreach

Thumbs up to any VPN service using OpenVPN instead of L2TP/IPSec.

ilovejesus69, 17 Novembre 2013

#16

scumhook aime ça.
- Like x 1
Baya Rae 4900 Lawlman

Inscrit le:

14 Juillet 2011

Messages:

24 706

Occupation:

Nazi Chocolate (25.8069)

Page d'accueil:

http://encyclopediadramatica.se/Nest_Of_Vipers

ED account:

Deusapien

scumhook a dit: ↑

Then get ready for this...

Teraflop

It also sounds like a name I'd give my .

Baya Rae 4900, 17 Novembre 2013

#17

minty, Solution et scumhook aiment ça.
- Like x 3
scumhook Managing account details

Inscrit le:

15 Juillet 2011

Messages:

14 078

Occupation:

Fellator of the homeless

Page d'accueil:

http://www.ungod.ly

ED account:

Scumhook

Baya Rae 4900 a dit: ↑

It also sounds like a name I'd give my .

lol

fosters flop or baya flop

and check this out....

these are what i play with

http://www.networkworld.com/reviews/2009/022309-juniper-firewall-test.html

well ok not literally these ones, but their little brothers

scumhook, 17 Novembre 2013

#18
Likeicare 13yo super trolelord 420 EDF modstar #swag

Inscrit le:

31 Mars 2012

Messages:

11 659

Occupation:

Shitposter and stuff

Page d'accueil:

http://encyclopediadramatica.se/User:Likeicare

ED account:

Likeicare

Lol at our admins riding Torguards dick for more monehz

Likeicare, 17 Novembre 2013

#19

MrGask aime ça.
- Like x 1
ilovejesus69 So Classy

Inscrit le:

2 Septembre 2011

Messages:

4 007

Occupation:

Community Outreach

scumhook a dit: ↑

lol

fosters flop or baya flop

and check this out....

these are what i play with

http://www.networkworld.com/reviews/2009/022309-juniper-firewall-test.html

well ok not literally these ones, but their little brothers

I don't like Juniper firewalls very much.

ilovejesus69, 17 Novembre 2013

#20

(Vous devez vous identifier ou vous inscrire pour répondre ici.)

Page 1 sur 2

Tags: No tags, TorGuard

Partager cette page

Facebook:

Langue

Français (FR)

Copyright 2011-2014 EDrama LIMITED

Conditions et règles

Politique de confidentialité

Nous contacter

Accueil

Haut

RSS