Chat window and DOS attack on the forum. - Page 1
Forum section: electronics / general

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2012, 03:57:45 am
content: Sorry guys, have had to remove the (Nchat) chat window.The forum was getting attacked by some bot targetting Nchat with 12KB requests.This is what caused the big bandwidth spike and presumably the slow forum performance.Now they are attacking the main forum index, so I'll have to start blocking IP's...Dave.

author: Mint.
author_rank: Frequent Contributor
timestamp: July 22, 2012, 04:18:42 am
content: Ahh thats nasty, hope everything will be fine by tomorrow

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2012, 04:21:47 am
content: IP's now banned.Forum speed should be back to normal and lightning quick now.Dave.

author: samgab
author_rank: Frequent Contributor
timestamp: July 22, 2012, 04:45:27 am
content: Things like that really piss me off. Don't the losers who design those things have anything better to do with their time?Anyway, speed is fine my end, cheers. Do you host the forum yourself, or is it an off-site service, Dave?

author: SeanB
author_rank: Super Contributor
timestamp: July 22, 2012, 06:40:32 am
content: Don't think Dave hosts it on a poor Telstra ADSL line, more like it is on a hosting service and on a virtualised server in a rack in some colo in Houston, run by Godaddy.

author: EEMarc
author_rank: Regular Contributor
timestamp: July 22, 2012, 06:52:13 am
content: I wonder if there is a correlation between the DoS attack and the AdSense warning.

author: Simon
author_rank: Unknown
timestamp: July 22, 2012, 07:17:03 am
content: the forum is hosted by a hosting company. I think Dave has a whole server but I may be wrong

author: Mint.
author_rank: Frequent Contributor
timestamp: July 22, 2012, 07:55:22 am
content: Quote from: EEVblog on July 22, 2012, 04:21:47 amAhh thats great!What about the shout box, is it gonna come back up?

author: Simon
author_rank: Unknown
timestamp: July 22, 2012, 07:56:01 am
content: probably not unless the developers can make it more secure

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2012, 09:30:42 am
content: Quote from: EEMarc on July 22, 2012, 06:52:13 amGood point, but I doubt it. They were just targeting the Nchat app.Dave.

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2012, 09:35:43 am
content: Seems to be over now.Look like that NChat module was chewing a bit of bandwidth too.Dave.

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2012, 09:42:28 am
content: Quote from: Simon on July 22, 2012, 07:17:03 amYes, it's a full dedicated box at HostGator, no one else shares it, it's all mine.Intel Xeon 3360 (Quad Core)4 GB DDR3 Memory2 X 250 GB Hard Drives (one main, one backup)10 TB Bandwidth5 Dedicated IPsAnd a team of oompa loompa's who look after it.One of these boxes:Dave.

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2012, 09:44:45 am
content: Quote from: Mint. on July 22, 2012, 07:55:22 amCan't risk it.I need something new...Dave.

author: hans
author_rank: Super Contributor
timestamp: July 22, 2012, 09:48:08 am
content: Quote from: samgab on July 22, 2012, 04:45:27 amI run a site on some machines. I created an admin with a log file if someone tried to break in it. I checked the logs the other day.. 90 IP requests < 2minutes from 1 IP. A few weeks later it happened again, 10 more times.So I looked up the access logs of Apache, and it turns out they crawl the server for directories like install/, admin/ , sqladmin/ phpmyadmin, etc (all those directories people typically put their site or database administration in). They hope to find out someone forget to put a password on their database admin (which happens more often than you think), or forget to remove the install or maintenance scripts for forums (so you can create a new root administrator or something).. Picked the first 10 directories of the list, created an auto IP ban script for it, problem solved. Over 400 IP's have been banned nowI believe all these attacks are automated. If they can figure out where a leak is , they can figure out how to write a script for it to automatically attack everything. That's why it's quite important to keep software updated. If there is a severe leak, hackers can just crawl every site, check the software versions and try to exploit it. And the bottom of the page tells the board software version, the HTTP headers the server software; nothing is hidden on the internet..@Serverpark: Hmmm, nice machines. I wonder if it wouldn't be more efficient to use racks instead of full desktop PC enclosures. Ah well, that's the hosters problemHow much traffic does the eevblog.com use per month for the forum?However, out here the forum still seem kinda slow..

author: SeanB
author_rank: Super Contributor
timestamp: July 22, 2012, 09:58:31 am
content: http://ars.userfriendly.org/cartoons/?id=20120721A suggestion as to what you should do to them.......

author: SeanB
author_rank: Super Contributor
timestamp: July 22, 2012, 10:01:10 am
content: Dave, what about opening another Twitter account, and using that? People can auto join and no admin on your side, just put the disclaimer in the blurb and away you go. You probably will want to turn off the notifications to you though.........

author: Simon
author_rank: Unknown
timestamp: July 22, 2012, 10:32:03 am
content: Quote from: hans on July 22, 2012, 09:48:08 amYes with everyone using things like worpress most of the net is now standardised so it would be easy to write a script to target known paths. Even with my basic skills I know how to find out if a website is running on wordpress..... I try and log into it. If I get a wordpress login page appear bingo I was right. If it gives me an error page i know it's not run on wordpress. But in my case I have no ill intentions just idle curiosity.

author: DarkPrince
author_rank: Regular Contributor
timestamp: July 22, 2012, 03:09:27 pm
content: So this is strange. I get home from a buddies last night, head to the eevblog, and get a 403 Permission Error when trying to go through ether domain (www or not). This morning I cannot even connect to either domain. Not sure whats going on, or why I have been affected.

author: Simon
author_rank: Unknown
timestamp: July 22, 2012, 03:10:59 pm
content: it's been fine for me although just now I got a connection error message. All working now though, lasted a few seconds

author: DarkPrince
author_rank: Regular Contributor
timestamp: July 22, 2012, 03:51:16 pm
content: I forgot to mention this is continous and not at random. Using my mobile data to access the site.

author: Simon
author_rank: Unknown
timestamp: July 22, 2012, 03:56:06 pm
content: are you sure it's not a connection problem your end ?

author: DarkPrince
author_rank: Regular Contributor
timestamp: July 22, 2012, 05:23:59 pm
content: I don't think so. The DNS seems to be fine. Seems like the server is ignoring the connection request. Suspicious with the 403 error just 12 hours before. Could be patient and hope it works itself out but this is strange.

author: Rufus
author_rank: Super Contributor
timestamp: July 22, 2012, 06:05:05 pm
content: Quote from: DarkPrince on July 22, 2012, 05:23:59 pmObviously your IP address Dave banned

author: SeanB
author_rank: Super Contributor
timestamp: July 22, 2012, 06:09:33 pm
content: Turn off router and go for the IP roulette........ must be the guy next door to you.

author: Simon
author_rank: Unknown
timestamp: July 22, 2012, 06:18:05 pm
content: not sure if your IP have been banned. Banning Ip addresses can cause no end of problems. It might be the most fool proof method but it is too risky in blocking legit connections. Unless you have been attacking the shout boxEDIT: just reread the first post from Dave. seems he has needed to start blocking IP's. Best thing is contact him with your Ip if you know it and see if yours is banned. If it is Dave may have to rethink how he keeps trouble out.

author: Monkeh
author_rank: Super Contributor
timestamp: July 22, 2012, 06:42:13 pm
content: Quote from: EEVblog on July 22, 2012, 09:44:45 amI think a lot of it was just lots of open tabs. I have four machines here, all often with multiple tabs on the forum. Unsurprisingly, my IP ended up banned (and still is, Dave, if you could fix that..). This is a design flaw, rather than a deliberate attack.

author: Simon
author_rank: Unknown
timestamp: July 22, 2012, 06:45:14 pm
content: that is a possibility, any live chat will need constant communication with the server. I also have a few tabs open and sometimes more than one machine on so it is understandable that there is a fair amount of traffic being generated by it. Probably 3 to 10 times the amount of tabs open causing continuous communication than there are actual members online.

author: SeanB
author_rank: Super Contributor
timestamp: July 22, 2012, 07:12:41 pm
content: As well remember transparent proxies are often used, so many requests appear to be originating from a single IP, but behind there can be a lot of separate users. Phone companies often do this for mobile data, you will find a single cell or group of cells have a single gateway address.

author: Simon
author_rank: Unknown
timestamp: July 22, 2012, 07:18:24 pm
content: this is why you can't ban the IP, one of the IP's behind the public one will be the offender, but if you block the public IP you will block all of those users. I did get complaints from a user on another forum I set up that he was being asked to verify he was human every time he loaded the page he was using a mobile phone dongle. As soon as he used a home computer all was well again.

author: chrome
author_rank: Regular Contributor
timestamp: July 22, 2012, 08:55:18 pm
content: Quote from: EEVblog on July 22, 2012, 09:42:28 amThat seems so inefficient both space-wise and power-wise. Why didn't they just use 19" racks?Also were there other setups you could have chosen because that seems a bit overpowered for a forum/website (right?) unless i'm missing something else you do with it.

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2012, 10:50:05 pm
content: Quote from: chrome on July 22, 2012, 08:55:18 pmNot overkill, the amount of SQL database accesses a popular forum generates is phenomenal. I have posted that stats before, but it's many hundreds per second. And that's just the accesses, not to mention the actual bandwidth.I actually posted my stats to some professionals in the business, and all said a dedicated machine was required, VPS was poo-poo'd by all. Many of them said I needed a hybrid machine or machines (optimised for both database and bandwidth etc.)I also have to account for continued growth.Dave.

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2012, 10:51:04 pm
content: FYI, the list of IP's being blocked:15 189.110.36.15225 81.166.238.1726 149.135.147.8827 91.135.8.11128 110.174.113.20328 110.175.175.18128 121.210.33.13928 147.108.253.25428 64.185.130.2928 66.68.142.24828 70.187.95.12228 95.222.124.18829 113.161.78.25229 118.208.96.4829 184.66.131.21329 199.7.156.4329 67.128.226.23029 71.139.6.2229 74.222.246.8329 91.156.133.13629 97.101.176.5229 99.29.92.11656 98.69.130.14557 124.149.120.5857 78.32.146.20484 108.95.96.45

author: Monkeh
author_rank: Super Contributor
timestamp: July 22, 2012, 10:53:30 pm
content: Could you get mine off of that, please? My phone is not a comfortable way to use a forum..

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2012, 10:54:56 pm
content: Quote from: Monkeh on July 22, 2012, 10:53:30 pmI've taken it off cPanel, but Alan needs to do penguin stuff to take it off the firewall as well. I've let him know.Dave.

author: Monkeh
author_rank: Super Contributor
timestamp: July 22, 2012, 10:58:57 pm
content: Quote from: EEVblog on July 22, 2012, 10:54:56 pmThanks. Can I ask what the preceding numbers are?

author: EEVblog
author_rank: Unknown
timestamp: July 22, 2012, 11:03:23 pm
content: Quote from: Monkeh on July 22, 2012, 10:58:57 pmNumber of Nchat hit count requests over a few minutesDave.

author: Monkeh
author_rank: Super Contributor
timestamp: July 22, 2012, 11:06:45 pm
content: Quote from: EEVblog on July 22, 2012, 11:03:23 pmThought so. Way up there.. I think this was just the result of bad browsing habits, not an attack.

author: DrGeoff
author_rank: Frequent Contributor
timestamp: July 22, 2012, 11:52:09 pm
content: Quote from: EEVblog on July 22, 2012, 10:51:04 pmThat's my IP address.What tests were performed to determine if the IP was required to be blocked?There are no zombies or bots running on this network.

author: DarkPrince
author_rank: Regular Contributor
timestamp: July 23, 2012, 12:13:37 am
content: Yeah I am in that list also. So is it really just a software issue being misinterpreted as an attack afterall? So you keeping the IP s banned? Should I pm you my IP that's on the list?Those numbers are interesting. Even if I left 3 windows open over the sample of 2 minutes that's one request every 17 seconds per window. Poorly written shout box.Actually all of those are probably innocent forum users that didnt know.

author: Unknown
author_rank: Unknown
timestamp: July 23, 2012, 12:40:23 am
content: Quote from: chrome on July 22, 2012, 08:55:18 pmInefficient? No not really? Ever calculated the cooling required for racks stacked with pancake or blade servers? Ever done an energy comparison between regular and 1RU power supplies.Then do a cost comparison with mid-range tower boxes vs rack equivalent. Even eventual resale comes into play with tower boxes more likely to be on-sold for domestic and small business use.The big cloud and server farm providers didn't start out yesterday they know what offers the best value, the same reasons why you don't see Aston Martins as taxi's.

author: DrGeoff
author_rank: Frequent Contributor
timestamp: July 23, 2012, 12:51:12 am
content: Quote from: Uncle Vernon on July 23, 2012, 12:40:23 amI like the access too, easy to swap out without having to fiddle about in the back of a tight rack with nests of cables.

author: EEMarc
author_rank: Regular Contributor
timestamp: July 23, 2012, 02:42:22 am
content: A mid sized desktop is equivalent to a full 4u server space. A 1U server can be problematically small from my experience dealing with them. The optimal space is closer to a 2U.Google uses I believe in a 2U rack servers but I know for sure that they each come with a specially designed high efficiency UPS that achieves over 99.5% efficiency. Their transformers on site also get over 99.5% efficiency. Their cooling system is optimized for efficiency as well. They have gone to the extreme to maximize their server efficiency and reliability while minimizing their overall cost.HostGator simply buys off the shelf desktop units and passes the additional cost over optimal to their customers. Dave's photo clearly shows that space isn't an important consideration for them. They're a small fish and the best for them may be different than other companies. Their choice has served them well in their business model. At the end of the day, that is what matters.

author: Unknown
author_rank: Unknown
timestamp: July 23, 2012, 02:55:40 am
content: Quote from: EEMarc on July 23, 2012, 02:42:22 amOptimal for which particular set of circumstances?QuoteGoogle builds from the ground up the use their own custom housings.QuoteHere's a quick quiz, why don't you take another look and report back how many of those boxes are Inspirons desktops, and how many are PowerEdge Server grade towers?QuoteWhy does space have to be a consideration? It only comes to play when you are silly enough to build a data centre on prime CBD real estate. The rooms still need to be cleaned, equipment serviced and revised, climate needs to be maintained throughout the room. High density isn't always the best strategy.

author: EEMarc
author_rank: Regular Contributor
timestamp: July 23, 2012, 06:16:21 am
content: If you have to lay fiber optic cable at ~$100k per km to a suitable low cost building for low density servers, the economics of a higher density server room doesn't sound nearly as bad.

author: EEVblog
author_rank: Unknown
timestamp: July 23, 2012, 06:39:03 am
content: Quote from: EEMarc on July 23, 2012, 02:42:22 amI believe that photo is the dedicated servers only, and almost certainly not all of them.They have other rack based systems too:http://www.hostgator.com/network.shtmlThey have done all the numbers, and use what is appropriate, you can bet your bottom dollar.Dave.

author: EEVblog
author_rank: Unknown
timestamp: July 23, 2012, 06:45:54 am
content: Quote from: DarkPrince on July 23, 2012, 12:13:37 amThose who are on the list please email me and let me know your IP.ThanksThe server was definitely being attacked, big time. Sorry I do not know the tech details, Alan Garfield was handling that. We had to ban a bunch of IPs to stem off the attack, and it turns out it picked up a few real users too, sorry.Dave.

author: Rerouter
author_rank: Super Contributor
timestamp: July 23, 2012, 07:08:37 am
content: hmm seems my previous IP was banned, or atlead getting 403, forbidden errors.... (dynamic IP), either way i'm back on now and hope we dont have any other people trying to exploit the forum just to proove they can do it :/

author: EEMarc
author_rank: Regular Contributor
timestamp: July 23, 2012, 08:28:59 am
content: Quote from: EEVblog on July 23, 2012, 06:39:03 amI should have specified their dedicated service. My bad.

author: Simon
author_rank: Unknown
timestamp: July 23, 2012, 11:54:45 am
content: The thing with IP's is that it is easy to appear to come from another Ip and many ISP's have a whole load of users behind one IP. I cannot download from most file hosting sites because it tells me i am already downloading a file, this is because someone else not too far away on the same exchange possibly is already downloading a file and we have the same IP. It was different when i had cable but then I will no longer tolerate virgin media's arrogance and treachery.I don't know how the IP system works but i guess there are not enough to go round.

author: Bloch
author_rank: Unknown
timestamp: July 23, 2012, 12:14:23 pm
content: Quote from: Simon on July 23, 2012, 11:54:45 amYes IP4 is outdated.Why dont we all switch to IP6

author: Simon
author_rank: Unknown
timestamp: July 23, 2012, 12:23:51 pm
content: what is the difference ?

author: Monkeh
author_rank: Super Contributor
timestamp: July 23, 2012, 12:37:58 pm
content: Quote from: Simon on July 23, 2012, 11:54:45 amI doubt you have the same IP as anyone else. More likely your current choice of scumbag ISP uses a transparent proxy.Quote from: Simon on July 23, 2012, 12:23:51 pm96 bits. I have as many IPv6 addresses as my disposal as there are possible IPv4 addresses.

author: Bloch
author_rank: Unknown
timestamp: July 23, 2012, 12:40:00 pm
content: Quote from: Simon on July 23, 2012, 12:23:51 pmA bit more IP adressesQuoteSo a need for a router per modem is not necessary. My guess is that every modem will get 1000 IP adresses.

author: Monkeh
author_rank: Super Contributor
timestamp: July 23, 2012, 12:46:11 pm
content: Quote from: Bloch on July 23, 2012, 12:40:00 pmNo, everyone should get a /48, unless the ISP is being stupid. That's 18,446,744,073,709,551,616 IPs. I have two at my disposal and can easily replace them with /64s if I choose. Which is, well, rather a few more.You still need a router and a firewall. Don't confuse NAT with real routers.

author: madires
author_rank: Super Contributor
timestamp: July 23, 2012, 01:49:33 pm
content: Quote from: Simon on July 23, 2012, 11:54:45 amFor full/real internet access one needs to have a dedicated public IP address, even if it's a dynamic one. All other solutions with proxies and carrier grade NAT where several users share the same public IP address(es) are broken by design. You may call that web access :-) Unfortunately we'll see more of those in the near future caused by the exhaustion of IPv4 addresses. Most ISPs seem to be reluctant in providing IPv6. It isn't brand new, it's over ten years old! More than enough time to engineer your network and OSS for IPv6.

author: Rufus
author_rank: Super Contributor
timestamp: July 23, 2012, 01:51:39 pm
content: Quote from: Monkeh on July 23, 2012, 12:37:58 pmMore likely someone reported kiddy porn on the file hosting site which put it on the UK Internet Watch Foundation list and causes all access to the entire site to be routed through a proxy which blocks access to the URLs claimed to contain kiddy porn. That makes just about every access from the UK appear to be from the same IP address.For a few days no one in the UK could edit Wikipedia because the IWF thought the British needed to be protected from this articlehttp://en.wikipedia.org/wiki/Virgin_Killeror perhaps that the girl needed to be protected from the British 32 years too late, or something. I have no idea what the IWF thinks they are achieving.

author: Monkeh
author_rank: Super Contributor
timestamp: July 23, 2012, 02:01:54 pm
content: Quote from: Rufus on July 23, 2012, 01:51:39 pmFUD. That little incident never affected me or anyone not on the big-name consumer ISPs.

author: Rufus
author_rank: Super Contributor
timestamp: July 23, 2012, 02:27:08 pm
content: Quote from: Monkeh on July 23, 2012, 02:01:54 pmOh SorryQuoteWhen I said no one I should have said 95%.

author: Monkeh
author_rank: Super Contributor
timestamp: July 23, 2012, 02:32:05 pm
content: Estimated 95%.This is why smart people don't use BT. Or Virgin, or Talktalk, or Orange, or Sky, or..

author: IanB
author_rank: Super Contributor
timestamp: July 23, 2012, 02:36:32 pm
content: Major speed problems as of right now (1430 UTC). Very slow server responses and page updates.

author: Rufus
author_rank: Super Contributor
timestamp: July 23, 2012, 03:04:25 pm
content: Quote from: Monkeh on July 23, 2012, 02:32:05 pmand peedyfiles.Quote

author: Rufus
author_rank: Super Contributor
timestamp: July 23, 2012, 03:10:06 pm
content: Quote from: IanB on July 23, 2012, 02:36:32 pmSay that againwww.eevblog.com99 packets received/99 transmitted : 0% PACKET LOSSRound Trip Time (in milliseconds) Max/Min/Av: 1457/768/1045www.google.com99 packets received/99 transmitted : 0% PACKET LOSSRound Trip Time (in milliseconds) Max/Min/Av: 16/15/15all the delay to eevblog is in the last hop.

author: SeanB
author_rank: Super Contributor
timestamp: July 23, 2012, 03:16:52 pm
content: Having a machine paer customer for the dedicated servers is to make it easy to manage, as if you get a court order you can point to a machine and PC Plod ( who in the best case is wary of IT, and thinks a rack of 100 blades is one computer) can take one only, without wiping out 99 other clients on the same server rack.

author: Kevin.D
author_rank: Frequent Contributor
timestamp: July 23, 2012, 03:33:59 pm
content: EEV forum really slow from here today ,much worse than it was yesterday .it's almost unusable

author: chrome
author_rank: Regular Contributor
timestamp: July 23, 2012, 03:57:04 pm
content: Quote from: SeanB on July 23, 2012, 03:16:52 pmYou can still do a 2U rackspace server per customer and still save a lot of room...

author: SeanB
author_rank: Super Contributor
timestamp: July 23, 2012, 04:20:38 pm
content: Chrome, the plods took an entire rack because it had **ONE** server that they were taking. A box on a shelf is something that even a TSA agent can understand is a "compuuter thingie".

author: Simon
author_rank: Unknown
timestamp: July 23, 2012, 05:02:41 pm
content: The forum is having some slow page loads for me too. At home on the PC or at work on my mobile phone (that is getting it's connection off the work pc not mobile network..... yet)

author: Monkeh
author_rank: Super Contributor
timestamp: July 24, 2012, 12:20:42 pm
content: Quote from: EEVblog on July 23, 2012, 06:45:54 amHave emailed, have sent PM, still having to tunnel.

author: nitro2k01
author_rank: Frequent Contributor
timestamp: October 12, 2012, 10:01:16 pm
content: Quote from: Simon on July 22, 2012, 06:18:05 pmActually, if you put some research into it, you can tell something about the IP address. I run a small forum with almost no real activity, which currently acts more as a spam trap. IP addresses are assigned to entities in blocks. An address might belong to a block which belongs to a consumer ISP. In this case, yes, it's risky. On the other hand, the address might belong to a range that belongs to a data center. In this case I generally block not only that IP, but all of the ranges I can find belonging to that data center. I've noticed that a provider by the name Ubiquity Servers are hosting a few servers that are used for spamming forums.Another thing one might try is to ban TOR and other proxies, at least from doing some things. Or, requiring an extra captcha or so to be filled in when registering a new account over a proxy. However, I wouldn't generally advise banning proxies without putting thought into the decision since some people in some regimes might rely on them to connect to the outside world.