Pro-Iran crew turns DDoS into shakedown as Ubuntu.com stays down

Canonical partners with organizations like the U.S. Air Force (USAF) and Platform One to provide secure software and AI/ML capabilities. They have an entire DOD team.

Almost certainly a target of opportunity. The UK has really made a point of staying out of this fight, but is also seen as a close ally of the US. Perhaps the calculus is:

- Iran was able to attack Ubuntu.com

- Iran sees it in its interests to stress the UK / US relationship (albeit in a small way)

Are we/they even sure it is really middle eastern entities and not some group pretending to be one to extort / push / coerce Ubuntu onto a CDN? Perhaps if they published some of the attack packets we could analyze it ourselves and maybe even suggest unorthodox yet simple mitigating controls.

Are all of the package repository mirrors being attacked as well?

[Edit] These [1] seem to be responding to me though I can not reach the one in Iran. Maybe they have a mirror of the static portions of there website somewhere in that massive rsync export.

    # example:
    # TIME="%E" time rsync -avh us.archive.ubuntu.com::ubuntu/ | wc -l
    1m 11.01s
    1701296

    # across the pond
    # TIME="%E" time rsync -avh uk.archive.ubuntu.com::ubuntu/ | wc -l
    1m 28.55s
    1701296

Just need to tell people to update their Ubuntu installations manually rather than relying upon the CVE API. I would just ignore the attackers, they will eventually wander off.

[1] - https://gist.github.com/nathan-osman/bdf4fc0f9174fdc293cf5eb...

It's a well(ish) known org with well known product, and they seem to have been vulnerable. If they had attacked a deli in Newark, would we be having this conversation?

An actual answer because all you've received so far is complete nonsense: because they want press attention as they're using these attacks to advertise their DDoS-as-a-Service tool. Literally every single statement they release (on Telegram) includes text saying that their attacks are "100% powered by $websiteEndingWithDotSu".

They also attacked the likes of Vrbo, Expedia and eBay, but they get more press by targeting Mastodon, Bluesky, Ubuntu and the likes, so they go after those now. People are desperately trying to somehow tie those victims to some ideological nonsense, but it's just advertising.

They work with US military.

Canonical is a UK company, so its a symbolic attack against a Western agent. Ubuntu is used by a lot of tech companies so they knew this attack would get a lot of visibility in the tech community. I'm assuming they think this will garner support from the tech community as well.

Terrorists will generally target anything of opportunity.

It was also perplexing when Iran was shooting missiles at their allies, until you realize they aren't rational humans.

You should have seen so many lies about Iran by now to justify the neocolonial war against them: so why do you assume every time some newly reported "fact" about them to be true? Rather, you should assume the opposite.

I'd have guessed Mint.

That says resolved, but I had a hell of a time trying to run apt update still...

Bluesky and mastodon both strike me as easy targets, they expose protocol level integration points that are probably reasonably expensive to serve and reasonably difficult to detect malicious actors on and/or throttle without significantly degrading the service.

I could see low budget attackers deciding that they were the most (not very much) bang for the (also not very much) buck that they could get...

Ubuntu.com doesn't fit that narrative though. I would have thought canonical would have the servers and skill to weather quite a large attack (on the other hand it did go down...)

Been down most of the day for me, as well as a bunch of related domains. Canonical's status page has them linked

Not for me, I'm not getting any response from it.

Loads for me, but not particularly quickly

It's loading, but very slowly.

Not loading for me right now.

dead here

Maybe they're still mad about systemd.

It's not Linux, it's Ubuntu. Which is developed by Canonical. Which is a military contractor that has a permanent DoD team and works with the USAF. Which is bombing their country.

> I do not understand the connection between Linux and the US/Israel. You'd think Iran would be very pro-Linux since Windows is a very obvious liability for them

Canonical is a British company and the employees are westerners. That makes them targets in the eyes of Iran.

People are forgetting that the Iranian government detests Israel and the entirety of the West. The core principal of the revolution is reversing westoxification (Gharbzadegi) and returning to the norms of the Imam Husayn (Velayat-e Faghih). That's the whole crux of the Islamic Revolution and why the Islamic Revolutionary Guard Corp (IRGC) exists.

Open source and anti-war westerners are viewed opportunistically but with disdain.

Tangent, but I hate snap with the fury of a thousand suns. That single handedly pushed me to pop, then mint.