SOH Under DDOS Attack

[Ickie]

Since Thursday noonish, we came under a DDOS attack mostly out of France, we are getting hundreds of attacks per hour.
As of 6 PM eastern tonight, I am turning off France (Blocking).
If you are from France send me a PM with your IP address and I will white list you.
go here and get your IP Address
http://www.whatismyip.com/
thank you.

below is just a few of these attacks from 6 am today until 2 pm today:
2863
2864
2865
2866

[dhazelgrove]

Don't they have anything better to do?

Dave

[Roger]

Thanks for the info Ickie. All our French members send your IP to Ickie.

[Ian Warren]

My Brother Rick, not a PC or tech person said one thing a few months back, tho its impossible to do in today's world ... as I said he's not a PC person but one thing he say is people need to have a licence to own a computer, people start mucking around like the example above ... in come the PC Police !

[pilottj]

Are people's lives so boring that they take to attacking flight sim enthusiast sites for fun? I mean the behavior is bad enough but you would think if they are going to engage in this kind of thing, they would set their sights a little higher, maybe go hit a bigger 'target' like the FCC. :a1310:

[Francois]

I hope you blocked the NSA as well?

[KellyB]

I hope you blocked the NSA as well?

I don't think of myself as a conspiracy theorist, but my outrage and embarrassment over the NSA has started me thinking. Why is it that this country, which has its Bill of Rights protecting the individual citizen's freedoms, has not seen this sort of thing as fundamentally wrong? I had to lie down laughing when Google and Facebook cried foul, since the only thing they regret is that the scandal has illuminated what they have been doing right along.

In other countries, Google and Facebook are being controlled to a certain extent, so why not here? Perhaps because NSA needs their databases?

Ours is a wonderful country; it's just an odd culture at times, and an even stranger government. I watch them and am filled with a terrible wonder.:a1451:

[stansdds]

I don't think of myself as a conspiracy theorist, but my outrage and embarrassment over the NSA has started me thinking. Why is it that this country, which has its Bill of Rights protecting the individual citizen's freedoms, has not seen this sort of thing as fundamentally wrong? I had to lie down laughing when Google and Facebook cried foul, since the only thing they regret is that the scandal has illuminated what they have been doing right along.

In other countries, Google and Facebook are being controlled to a certain extent, so why not here? Perhaps because NSA needs their databases?

Ours is a wonderful country; it's just an odd culture at times, and an even stranger government. I watch them and am filled with a terrible wonder.:a1451:

"Why is it that this country, which has its Bill of Rights protecting the individual citizen's freedoms, has not seen this sort of thing as fundamentally wrong?"

Because we are sheeple and we have been told that this allows our shepherds to protect us from the big bad wolf. We want to be protected and feel safe, for we are sheeple.

[Dumonceau]

"Why is it that this country, which has its Bill of Rights protecting the individual citizen's freedoms, has not seen this sort of thing as fundamentally wrong?"

Because we are sheeple and we have been told that this allows our shepherds to protect us from the big bad wolf. We want to be protected and feel safe, for we are sheeple.

I think the reason for this is something that is going on all over the world. Our elected aren't looking out for our interests as they should be. It's not about the right or the left, but it is the whole political community. They just don't look after the people who elected them in the first place as they should be doing. Politicians have in a way become part of the military industrial complex.

We the sheeple, are just there to get them elected. After which they don't give a rats *ss about us anymore. Again, this is a global thing and spread out all over the political spectrum...

I just hope that this post doesn't get me banned...

[Ickie]

D don't worry you won't get banned for speaking the truth, lol
I wish I could put into print my thoughts on this :banghead:

[Ickie]

tomorrow when these children go back to school, these attacks will stop.

[Viper007]

Hello,

SOmeone wants to blame the poor bloaks; it probly isnt someone in France doing it though; I looked at one picture; with all the different ips it makes more sense that they are possibly pop-mail account computer hacks; one program can probly send out a message to the trojan that sends out massive emails all at once from different people; you would have to send a email to all those people and tell then they have a hacked email account on their computer or something.

Wow that is pretty bad to knock off a whole country and the solicitor is probly a russian kid just testing his trojans or worms or whatever he uses; interesting it seems as though this crap always seems to hit the fan with flight sim groups; hasnt this happened to flightsim and avsim; wait I remember Avsim lost a whole crap load of files; I got so much FS9 stuff it isnt funny; I been meaning to collect it all and donate it back to avsim; you have to have offline backups of your stuff especially since you guys here seem to have to pay so much for it.

These morons know how to hide their tracks; if a trojan/worm is run on someone's computer to send out a pop-mail they would probly never know unless someone told them; this is just a guess on my part.

I use Wireshark whenever I feel my computer is threatened; I have yet to report anything to authorities AND I never use POP MAIL (!) on my own computer !

Viper

[Ickie]

than what you are sayin' is to let them have their way and make this site useless to anyone.

when all I have to do is block the offending country, if I were to take a vote my guess is, I would win.

[Dumonceau]

Hello,

SOmeone wants to blame the poor bloaks; it probly isnt someone in France doing it though; I looked at one picture; with all the different ips it makes more sense that they are possibly pop-mail account computer hacks; one program can probly send out a message to the trojan that sends out massive emails all at once from different people; you would have to send a email to all those people and tell then they have a hacked email account on their computer or something.

Wow that is pretty bad to knock off a whole country and the solicitor is probly a russian kid just testing his trojans or worms or whatever he uses; interesting it seems as though this crap always seems to hit the fan with flight sim groups; hasnt this happened to flightsim and avsim; wait I remember Avsim lost a whole crap load of files; I got so much FS9 stuff it isnt funny; I been meaning to collect it all and donate it back to avsim; you have to have offline backups of your stuff especially since you guys here seem to have to pay so much for it.

These morons know how to hide their tracks; if a trojan/worm is run on someone's computer to send out a pop-mail they would probly never know unless someone told them; this is just a guess on my part.

I use Wireshark whenever I feel my computer is threatened; I have yet to report anything to authorities AND I never use POP MAIL (!) on my own computer !

Viper

Not wanting to offend anyone, here is what I have to say about this as someone who works in IT for the federal government of his country:



Do you realize what this costs in bandwidth? These are thousands of little requests to connect to the server that amount to quite a bit of that;
Do you realize what this amounts to in server load? I do and so does Ickie;
Have you ever been a server or forum admin?
Do you realize what usually happens after a DDOS attack? Because the real damage is usually done after the attack when the server is about to shut down and is almost defenseless. Depending on the config of the server, a lot of things can be done to it right after the attack.


All the things you say are quite viable for PC's, sadly not so for servers on a high bandwidth connection. A server is not just a big PC. Rebooting one is not like rebooting a gaming PC with minimal services running and an SSD disk. Good rebooting of a server takes time and a lot of checks.

The SOH staff cut off a whole country indeed, for all of our safety. But not before offering the possibility to be whitelisted. Server admins sometimes have to take drastic measures for safety. It might seem harsh, but it is the simple truth. And even then, if the hackers use the different available possibilities of being untraceable, you still might have problems. Attacks seemingly coming from France might not even come from there. Several attacks coming from that country usually point to the right source. But again, you're never totally sure about that.

In short, cut Ickie some slack here.

Sorry for the rant.

Dumonceau

[stovall]

Thanks Dumonceau for your comments, speaking for the moderators and administrators, Ickie is the guy we all listen to. What he say goes. We know he has only Sim Outhouses best interest at heart. If Ickie say a country should be cut off for a while, so be it. He knows that he is doing and would not do so unless it was absolutely necessary. It is called experience and know how. Thanks Ickie for protecting Sim Outhouse.

[Sieggie]

The logs indicated it was not just someone using a pop slave network to send spam. They were port scanning looking for a way to gain control of the server. If they were doing that to one of my servers, I would have killed entire groups of class A's to stop it.

Dave

[Ickie]

we went from 200 attacks an hour to about 3-4 by blocking France
I did let it run for 48 hours and spoke to the staff in the admin forum
than I went public with my findings.
I also am white listing SOH members from France who send me their IP to white list
I don't think I missed anything or anyone.

[Daube]

Ah, so that's why I couldn't connect to the site since a few days....
Thanks for the explanations, Ickie.

[airattackimages]

Wow that is pretty bad to knock off a whole country and the solicitor is probly a russian kid just testing his trojans or worms or whatever he uses; interesting it seems as though this crap always seems to hit the fan with flight sim groups; hasnt this happened to flightsim and avsim; wait I remember Avsim lost a whole crap load of files; I got so much FS9 stuff it isnt funny; I been meaning to collect it all and donate it back to avsim; you have to have offline backups of your stuff especially since you guys here seem to have to pay so much for it.
Breakin my heart

[Ickie]

The attack seems to be over and I removed France from the blocked IP list.

[Dev One]

Thanks Ickie, I'm glad to be back & catching up with the News!
Regards
Keith

[Doumet57]

Good to know why I couldn't log to SOH in the past few days.

I don't know how does it work in United States but in France, most of the providers use DHCP (for no-professional users), so it's hard to block IP addresses.

And I agree with ViperOO7, I'm not sure that's the culprits are French, but you've done the right thing Ickie, first of all protect the servers.

Sure, if I could "talk" to one of those idiots, I would explain them the French "savoir-vivre" with my Lumberjacks' hands...

Glad to see you again guys ! :encouragement:

[pivo11]

Thanks much, Ickie.

Cheers,
Fritz