Three Days in August: What a DDoS Attack Exposed in Our Network

tshanmu•about 3 hours ago

"We found three concrete gaps during this incident, and we would rather be upfront about them than gloss over them." claudism?

trentnix•about 1 hour ago

Sticks out like a sore thumb, doesn't it?

jareklupinski•about 3 hours ago

> There was no unauthorised access and no compromised systems. This was an overload attack, not an intrusion.

"AI said it's all good. There are no attackers within our walls."

ErroneousBosh•about 1 hour ago

I sometimes work on a system so byzantine and poorly-documented with so many horribly obsolete systems - they have Windows XP machines all over the place - that there's no way it hasn't been popped.

I think it's safe though.

I think various groups have popped it, taken a look around with growing expressions of horror on their faces, and gotten back out as quickly as they could. Nah man, no way, not touching that, don't want my prints on this particular gun, there's no way this is legitimately how they've left it, this has to be some kind of a setup.

BLKNSLVR•3 minutes ago

Security by obsolescence layered with security by complexity.

jareklupinski•1 minute ago

it's not enough to salt your hash; you must mold your Swiss Cheese

someonebaggy•about 3 hours ago

Did AI write this?

nine_ch•about 2 hours ago

Yes. The blog version was drafted with AI assistance and then edited and reviewed by us. The facts, numbers and timeline are ours and match the technical postmortem PDF linked in the post, which is the drier, more complete version. Happy to go into any of the technical details here.

majke•about 3 hours ago

  8. 80.239.216.210.  0.0%    78  123.2  64.6  42.9 141.8  30.6
  9. vl202.zur-itx1-dist-1.cdn77.com. 0.0%    78   60.1  58.8  43.7 136.5  24.2
  10. 89-187-165-194.bunnyinfra.net. 0.0%    78   45.9  63.5  41.8 131.9  31.0

so cdn77.com and bunny.net

nine_ch•about 3 hours ago

Yes, that's bunny.net, it's named in the post. Their Zurich PoP appears to sit on CDN77's network, which is on their side of the setup, not something we configured.

Three Days in August: What a DDoS Attack Exposed in Our Network

⚡ Community Insights

Discussion (10 Comments)Read Original on HackerNews