January 9, 2005

• PLANET MORONIA

  
  

   

  
  

   

  
  

   

  
  

  “Another Round in Progress”

  
  

  Attack on Blogopshere Host, Part II

  
  

   

  
  

  

  
  

   

  
  

  Hosting Matters has “confirmed attack” for second time since yesterday.

  
  

   

  
  

  The attack was discovered by HM staff this evening at 21:21 CST.

  
  

   

  
  

  All Hosting Matters client sites are down presently.

  
  

   

  
  

  
  

  
  

   

  
  

   

  
  

  UPDATE   22:52 -

  
  

   

  
  

  AS I just posted at Free Republic, it looks like HM may be getting wise to the ways of the dark side. Annette from HM says:
  
  “…we managed to trace the attacker back to what looks to be the actual origination point. The current attack has been blocked. If we see another round, I have requested that the NOC simply nullroute the IP address that is the target of the attack. Should this happen, we will re-IP all sites on that IP except the target site. If it comes to that, we will naturally post an update to that effect.”
  
  In otherwords, HM says they are back, but so far the sites seem still inaccessible.

  
  

   

  
  

   

  
  

   

  
  

  UPDATE II   23:33 (Hopefully the last) -

  
  

   

  
  

  HM sites seem to be up again. Looks like sending the packets to the affected IP into the etherworld did the job. Congrats again to HM. Every time this happens HM gains a little more information about the source, so disgruntled and uncreative Lefties beware.

  
  

   

  
  

   

  
  

   

  
  

  UPDATE III   23:40 –

  
  

   

  
  

  HM sites seem to be up again. Or Not:

  
  

   

  
  

   

  
  

  “This is in progress at the upstream level. While we have been seeing intermittent access, there will be a few moments of complete inaccessibility (which may have passed while this was being typed) as the NOC stops advertising our IP space in order to get source and destination pairs for blocking. Stand by.” – Annette @ HM support forum

  
  

   

  
  

   

  
  

   

  
  

  UPDATE IV   00:37

  
  

   

  
  

  “All IP space except for one block is accessible at this time. We are awaiting word on whether we can expect to have the affected IP only nullrouted or if the entire block will remain nullrouted for the time being. Stand by.” – Annette @ HM support forum

  
  

   

  
  

  …Apparently that last block includes Little Green Footballs, Wizbang! and some others including my future home, Blogbat.us.

  
  

   

  
  

   

  
  

   

  
  

  So far, dramatic as watching a cat sleep. More to Come.

  
  

   

  
  

   

  
  

   

  
  

  UPDATE V   00:56

  
  

   

  
  

  Blogbat.us made the wrong Top Ten Seven…

  
  

   

  
  

  “The following servers will have new IPs assigned immediately: ares, bia, davinci, hermes, iambe, minerva, urania. Unless you manage your own DNS, and are in the affected IP block, this will not affect you.” – Annette @ HM support forum.

  
  

   

  
  

   

  
  

  This means these seven holdouts should be back up shortly.

  
  

   

  
  

   

  
  

  

  
  

   

  
  

   

  
  

   

  
  

  Earlier posts:

  
  

   

  
  

  Yesterday’s Attack

  
  

   

  
  

   

  
  

  Related Posts:

  
  

   

  
  

  DMAT Servers Hijacked to Attack Others in “Official Act of Cyber Terrorism”

  
  

   

  
  

  GOP CONVENTION: Protest Warrior Site Hacked

  
  

   

  
  

   

  
  

   

  
  

   

  
  

  

  
  

   

  
  

  ____________________________________________________________

  
  

   

   

  • 11:18 pm
  • Leave a comment