Bitcoin Forum

Starting about 14 hours ago, there has been a large DDoS against the forum that is apparently still ongoing. The forum was down for a few hours as a result.

I'm not going to use Cloudflare for bitcointalk.org. Cloudflare is a massive central point of failure to the Internet. Tons of sites (including most large Bitcoin sites) use it. Additionally, in most cases Cloudflare can undetectably read any encrypted traffic passing through their service because they have the site's HTTPS key. Even if you use their keyless HTTPS feature, they can still read your traffic (though this is detectable with something like Certificate Patrol) because they have an agreement with a CA which allows them to issue whatever certificates they want (they are essentially a CA). Also, I've heard that Cloudflare is not especially effective at stopping many types of DDoS attack.

Instead, I purchased DDoS protection that works at a lower level. After filtering, it sends user TCP traffic to the forum's server verbatim. This eliminates the need for giving up the forum's HTTPS key. It seems to be effective at stopping this attacker's traffic, but it may be introducing some periodic downtime/slowness/latency. We're still looking into it. DDoS protection services (even the most expensive ones) are notorious for often being useless, shady, or unreliable, so who knows whether this service or any future ones I may try will end up working out... Unfortunately, the Internet is just particularly weak to DDoS attacks, and there are no great solutions available.

Nice to see something has been done, trial and error for a few months it is then. Glad you found an alternative to using Cloudfare. What's the service you are using?

Yup!
Internet is weak too to DDoS attack.

An attacker can even use google as a DDoS tool (google search, google spreadsheet).  ;D ;D

Thanks for the update. Is it possible that DD4BTC is behind this attack ? Have you received any extortion message ? Lately this entity is extorting from various bitcoin sites and there is a bounty on this DDOS attacker.

Details: https://bitcointalk.org/index.php?topic=845595.0

I suspect this service is also run by DD4BTC: https://bitcointalk.org/index.php?topic=1000458.0

Thanks for the updates.
I didn't know that specific information about Cloudflare.

We don't have to worry about it because IMO: the periodic downtime/slowness/latency are going to be occasional. Also, with the current forum DDoS protection there's no need to give the forum HTTPS key to services like the one mentioned before.

Should that be deleted? DDos is illegal and someone who is offering services to ddos others should be banned, in the rules it says that if something is forbidden in your country it is not allowed on the forum

So we may have a downtime again as the attack is still ON? Internet is prone to such attacks and hence such attacks take place day in and day out due to loopholes.

http://ddos-protection-services-review.toptenreviews.com/ This shows that Cloudfare is the 6th in the list compared to Incapsula DDoS Protection.

I thought it was just a joke, but when I read this thread I know that it wasn't a joke.
So, this is a serious problem for the site

I always wondered if making the user solve a captcha before using the site could prevent ddos, my guess its most likely not since every site would have done it already, but why wouldnt it work? Bots that solve captchas?

Pretty much every substantial site is affected by it from time to time. You'll never stop it entirely.


Bots can solve captchas, and as far as I'm aware Satoshi created the capacha that the forum is using. (May of been changed since, I read this a very long time ago) Which is immune to most known OCR captcha solvers. But, if someone can't solve a certain captcha they just send it to a service which uses humans instead.

Captchas are useful, that's why they are used nearly on every single website. They have limitations and only prevents certain users. Although, captchas are mainly used to reducing spam and not for protection against DDOS. DDOS is sending a huge amount of requests to the server.

Didnt even catch the forum offline hehe:):) And you are right cloudfare isn't bulletproof. Nice of u to find a solution! And a good one. Keep it up theymos

Actually, I was kind of relieved to find out that it was "just" a DDoS and not a site hack that could have actually endangered the site. I know a few people probably thought that the avatars were at fault too. It didn't really look like a DDoS attack at first until I saw the post on Twitter since most of the DDoS'd websites that I've encountered either timed out or loaded very slowly rather than not connecting at all.

Is Google prone to DDOS as well ? Has Google search ever been down due to DDOS ?

toptenreviews.com is not a reliable source of information.

I was curious and i investigated a little: http://security.stackexchange.com/questions/73369/how-do-major-sites-prevent-ddos

Seems like it would be pretty hard almost impossible to ddos google

Not only that, there wouldn't be much incentive to do it for a long period of time. Not that I think someone will ever achieve it.

Just the  statistics  (http://www.internetlivestats.com/google-search-statistics/) of google is daunting enough.

Google is highly resistant to DDoS attacks since they have thousands of servers distributed around the world that can handle massive amounts of bandwidth. The amount of traffic that sites like Google and Facebook get every day would probably kill most other sites. It would be difficult but not impossible to launch a successful DDoS attack on sites like these although doing so would probably require the cooperation of multiple parties.

Thanks for the clarification, so at the end it seems that it doesn't exist a real solution for prevent the ddos attack (also with cloudflare, that it is much expensive).

THANK YOU for being one of the few website owners far-sighted enough not to use CloudFlare.

It's especially annoying for any VPN user, as it means they get a goddamn CAPTCHA every visit.

I've taken to simply closing the tab on any CloudFlare using website, the captcha is so annoying. Ya here that, other website owners?

Site was down most of last night in the early hours here in the UK. I say down, what I mean is access was intermittent and incredibly slow, so yep I knew immediately the most likely cause was an attack on the site. Good to see you are taking measures to keep the site online as much as is possible.

no.. this forum does not moderate if something is legal or even legitimate.  the only moderation here is whether or not your post was substantial if you had a signature ad in your profile.

Well thats just plain stupid, they say they dont have time to moderate scams but they do have time to ban for sig spam or ref link spam but when someone posts something illegal they dont care?? I really dont get it

Would you be so kind as to find a quote about this?

so there is a kiddie i guess trying to waste his time attacking this forum :/

i think there will be a log in which IP the attacker used in attacking, maybe blocking his IP can fix this?

Then would you mind telling me why the ddos thread is not deleted and the user banned since offering ddos services is obviously illegal

It is a DDOS attack, do you know how it works? Multiply request to the site at the site time (you cannot stop the attack with a simple block to one or two ip).

at first i though that it was another hdd failure, i guess it's better that instead it is just a ddos attack

it possible to know if it's done by the same attacker?

Especially when the attack is via a redirection vector.

One cannot sell illegal things on this forum. A person few days back tried to sell PayPal guides to chargeback and I reported the same along with few other members and now the thread is deleted. You just need to report the thread and MODs will take action. If they don't means the trade isn't illegal.

That thread is discussing about DDos cases I guess with some log files mentioned. The person whose username was "DD4BC" was banned.

It'd be possible to block certain IP ranges known to be used frequently in DDoS attacks, such as most of China for example. However, this would also affect some users who use anonymity services to access Bitcointalk and I'm guessing this is why theymos hasn't taken this kind of action already as he doesn't want to limit access and limit anonymity online, which is a good thing for sure but does come at this kind of price.

I have read this article (http://www.techrepublic.com/blog/it-security/ddos-attack-methods-and-how-to-prevent-or-mitigate-them/):

The easiest, although a costly way to defend yourself, is to buy more bandwidth. A denial of service is a game of capacity. If you have 10,000 systems sending 1 Mbps your way that means you're getting 10 Gb of data hitting your server every second. That's a lot of traffic. In this case, the same rules apply as for normal redundancy. You want more servers, spread around various datacenters, and you want to use good load balancing. Having that traffic spread out to multiple servers will help the load, and hopefully your pipes will be large enough to handle all that traffic. But modern DDoS attacks are getting insanely large, and quite often can be much bigger than what your finances will allow in terms of bandwidth. Plus, sometimes it's not your website that will be targeted, a fact that many administrators tend to forget.

---

so it is not so easy to prevent or stop a ddos attack, and theymos took the right choice and changed the IP.

Weird.  I was trying to access bitcointalk all evening yesterday without success, then right when I got off of the computer, it worked on my phone... Was it just timing?

Since I mentioned Cloudflare in the OP, I thought I'd note this here: I just learned that Cloudflare's "keyless SSL" feature still allows them to undetectably MITM all traffic. How it apparently works is that you keep the HTTPS key, but session keys are generated in a special way that allows both you and Cloudflare to decrypt the HTTPS traffic. Pretty sneaky, and not at all widely known. My suspicions that Cloudflare exists to spy on encrypted Internet traffic continue to rise.

Yes it is just security theatre to make people feel safer. Cloudflare can read all of your traffic in the clear no matter which of their products you use, some of their anti-DoS protection needs to be able to view all of the traffic in the clear in order to work, its the only way they can properly protect against layer 7 attacks for example.... or at least thats their story and their sticking to it.

Still, for those not requiring https or just generally distributing content, it's a godsend. Anti ddos and geocaching for free. Made my shitty site moderately less shifty .

No doubt it is a useful service, even I use it for some sites. The thing I hate about it most is that they force all Tor users to enter an impossible to read captcha, making it impossible to access any websites that use it over Tor. Most of the time when I encounter a cloudflare-protected website over Tor I have to give up trying to access the website. The difficulty of the captcha seems to get harder as there are more attempts, so due to people using captcha bots over Tor the captcha's are literally not even characters from any language, there is no way you could enter it using a keyboard and if you ask for another captcha it just gets harder.

I also think that most webmasters that use cloudflare are unaware of the powers they are handing over to cloudflare and the enormous amount of trust they are putting in the service. Doesn't help that it's a freemium service either. If your website has any kind of user authentication then you should probably stay away from cloudflare and such services if you can.

Got me all paranoid about CloudFlare now ... xD Afaik (at least with free versions) they can protect DNS but if the attacker knows your IP good luck CloudFlare trying to block that.

You can find out the real IP of many websites using cloudflare really easily. For example, here is how you find out the real IP of the website, ponziup.com, on linux:


Many times email will be delivered directly to the server or there will be a subdomain that allows for direct connection In this case, the command returns this:


The first four IP's are cloudflare, the last one is a DNS record that points directly to the servers real IP to allow for email to be delivered. Simply ping dc-0551f9e6-ipfailover.ponziup.com and you get the real IP of ponziup.com which is 5.135.65.26, in this case the webserver is configured really badly, so you can even directly connect by going to http://5.135.65.26

This doesn't always work, it depends on how you have set everything up but there are many other methods out there to discover the real IP and it's difficult to protect against all of them.

+1 I noticed that last year... I never bothered with it since that feature was clearly targeted towards "easy mode" types, or those who don't understand how to pass the certificate data into CF.