MTGox vs mysterious Russia

[allinvain]

Lovely, mtgox is down again Anyone have a clue what happened now? Another server move, more DDoS'ing? Gremlins?

Hi,

MtGox is not down, however chances are you got blocked if you tried to hammer in.


Mark

Yeah that may very well be the case. I merely tried to refresh the page at random intervals. Can I PM you my IP address or hostname or domain etc so you can add me to the whitelist?

Hi,

There is no more whitelist, and blocks are handled by the ISP now. You may want however to do a "ip hop" if you can, or wait for the block to expire.


Mark

What is the expiry time set to?

[1714194360]

1714194360

[1714194360]

1714194360

[1714194360]

1714194360

[1714194360]

1714194360

[FooDSt4mP]

What is the expiry time set to?

Just use a proxy or tor or i2p.  Knowing how to route around damage (like blocking) is an important skill for fully utilizing the internet.

[allinvain]

What is the expiry time set to?

Just use a proxy or tor or i2p.  Knowing how to route around damage (like blocking) is an important skill for fully utilizing the internet.

I know how to do that yrral86, but for me it's not super critical as I mainly use mtgox to keep an eye on the btc/usd exchange rate. But thanks nonetheless for your tip

[DukeOfEarl]

The blocking is a bit more aggressive than catching those hammering the site.  I'm blocked on my home IP on which I checked the site perhaps once per hour.

duke

[FooDSt4mP]

The blocking is a bit more aggressive than catching those hammering the site.  I'm blocked on my home IP on which I checked the site perhaps once per hour.

duke

I've done probably 50 requests in the past hour and it's working great for me.  Perhaps something else about your traffic pattern is triggering it.

[allinvain]

Yeah not sure what triggers it specifically but I got around the block by loading up the Tor browser bundle.

[mewantsbitcoins]

What is the expiry time set to?

Just use a proxy or tor or i2p.  Knowing how to route around damage (like blocking) is an important skill for fully utilizing the internet.

I know how to do that yrral86, but for me it's not super critical as I mainly use mtgox to keep an eye on the btc/usd exchange rate. But thanks nonetheless for your tip

allinvain if you get on irc, on freenode there are couple of channels you can watch trades and rates in real time. #bitcoin-watch lets you not only do that but also watch every transaction on the network in real time. the other channel is called #bitcoin-market

[allinvain]

What is the expiry time set to?

Just use a proxy or tor or i2p.  Knowing how to route around damage (like blocking) is an important skill for fully utilizing the internet.

I know how to do that yrral86, but for me it's not super critical as I mainly use mtgox to keep an eye on the btc/usd exchange rate. But thanks nonetheless for your tip

allinvain if you get on irc, on freenode there are couple of channels you can watch trades and rates in real time. #bitcoin-watch lets you not only do that but also watch every transaction on the network in real time. the other channel is called #bitcoin-market

Oh wow I can't believe I forgot about that. In fact I've been idling in that channel for a month now. lol...*face palm*

[DukeOfEarl]

I've done probably 50 requests in the past hour and it's working great for me.  Perhaps something else about your traffic pattern is triggering it.

That could be, from home I do check using different devices...same IP tho.

[qed]

My IP got blocked as well. I made a bitcoin transfer and went to sleep, woke up and mtgox.com was unreachable. I have a static IP and i'm the only owner (and user) of it.

May be there is something wrong with the handling of "aggressors IPs".

[true]

Can't access from my iPhone or home connection. Thought it was down again... has cost me money :/

[MagicalTux]

The attack has stopped, with a promise to start again in 2 hours.

Previous attack had no impact as the ddos protection successfully blocked it (and a few dozen of normal users too). We are trying to get the ddos filtering to not block normal users.

For reference, a subset of the observed ips this time:
http://paste.pocoo.org/raw/382648/

[zby]

Maybe this cannot be answered honestly - but was there any hint about what was the motivation of the attackers?  Did you receive 'protection' offers or something?

[MagicalTux]

Maybe this cannot be answered honestly - but was there any hint about what was the motivation of the attackers?  Did you receive 'protection' offers or something?

The attacker sent an email from a stolen address offering to stop his attack for $5000 via libertyreserve.

This was - of course - denied. We do not negociate with internet terrorists!

[orcy]

The attacker sent an email from a stolen address offering to stop his attack for $5000 via libertyreserve.

This was - of course - denied. We do not negociate with internet terrorists!

DDOS protected hosting probably would be cheaper and more reliable.

[MagicalTux]

The attacker sent an email from a stolen address offering to stop his attack for $5000 via libertyreserve.

This was - of course - denied. We do not negociate with internet terrorists!

DDOS protected hosting probably would be cheaper and more reliable.

It was cheaper, and it seems more reliable. All win.

[Vladimir]

Should have asked him to come back again in two weeks or so with a new botnet. Publicity is priceless.

[niooron]

Maybe this cannot be answered honestly - but was there any hint about what was the motivation of the attackers?  Did you receive 'protection' offers or something?

The attacker sent an email from a stolen address offering to stop his attack for $5000 via libertyreserve.

This was - of course - denied. We do not negociate with internet terrorists!

Please post the email.

[proudhon]

The attack has stopped, with a promise to start again in 2 hours.

Previous attack had no impact as the ddos protection successfully blocked it (and a few dozen of normal users too). We are trying to get the ddos filtering to not block normal users.

For reference, a subset of the observed ips this time:
http://paste.pocoo.org/raw/382648/

Did the attacker attempt to make good in his/her promise of an attack 2 hours later?  I haven't had any problems connecting to MtGox today, so I assume the DDoS protection is still working well.  Well done with this whole annoyance, and thanks for the updates.

[eleuthria]

Great work on resolving the problem and defending subsequent DDoS attempts Tux.  This whole event has made me feel a bit more secure with the valuation of BTC.  For such an extensive (multi-day) attack shutting down the largest exchange, the price has barely been affected.  I was expecting a price dump into the $2.00-2.25 range as a result of people getting scared.