Slashdot Mirror
Australian Census Website Shut Down On Census Night After 4 DDoS Attacks (smh.com.au)
Heart44 writes: News sites are reporting that the Australian census website has been shut down until further notice. This happened on census night, Tuesday (Australian time), August 9th, 2016. This is the first attempt at an online census where [the internet] is the default data collection method. You had to call an often busy number to get a paper form. This is on top of a long running controversy that the Australian Bureau of Statistics will keep the names and addresses of everyone for five years. I presume more useful links will appear over time. "The site was targeted by four denial of service (DoS) attacks," chief statistician David Kalisch told ABC radio. The Sydney Morning Herald reports: "The first three caused minor disruptions and did not stop more than two million census forms from being 'successfully submitted and safely stored,' he said. But the site was shut down after a 'gap' in the system's security measures was found during a fourth attack (AEST), Mr Kalisch said. 'After the fourth attack, which took place just after 7:30pm [on Tuesday AEST], the ABS took the precaution of closing down the system to ensure the integrity of the data,' Mr Kalisch said. 'I can certainly reassure Australians the data they provided is safe,' he said."
UPDATE 8/09/16: Many reports are contradicting Kalisch's claim that the website was shut down from DDoS attacks. User @mhackling on Twitter tweeted a screenshot of Digital Attack Map showing "nothing unusual DDoS wise for Australia and yesterday."
UPDATE 8/09/16: Many reports are contradicting Kalisch's claim that the website was shut down from DDoS attacks. User @mhackling on Twitter tweeted a screenshot of Digital Attack Map showing "nothing unusual DDoS wise for Australia and yesterday."
'I can certainly reassure Australians the data they provided is safe
If you believe that I have some ocean front property in Alice Springs I will sell you...
is it possible to legacy the existing necessary technology to produce DDoS attacks and make everyone buy new hardware to access the fucking internet?
The census invades everyone's privacy and is an unnecessary government intrusion in our lives. I'm glad those patriots took the census offline to stand up for privacy and liberty. For once, it appears that freedom has won out over tyranny and invasion of privacy.
Never assume malice when stupidity will suffice.
At this stage all reports indicate that the ABS cocked things up big time. The DDoS angle seems to be furious spin doctoring.
Canadian website worked fine.
As long as the Spice keeps flowing, it's all good.
I got stuck at the "Please enter your credit card details" question.
What's the difference between a DDoS attack and 4 million people all trying to submit their census all at the same time?
Wouldn't surprise me. Politians have a track record of making stupid technical decisions. I'm pretty sure they didn't plan for the server load of 20 odd million people accessing the site in one night. Couple that with the threat of a 180 dollar fine and people will be constantly refreshing their browsers to get in. Reminds me of the time they arbitrarily decided to change daylight savings to cater for the commonwealth games without a single thought of what computer systems that decision would affect. Working at a Telco at the time we had some customers getting changed an extra hour
Well, we did crash it because of demand when the cards were mailed out... Sometimes we canucks are such geeks...
...si hoc legere nimium eruditionis habes...
The web server setup was supplied by IBM - the Bureau of Stats had a $9.6million deal with IBM.
http://www.itnews.com.au/news/ibm-wins-96m-to-host-ecensus-in-2016-397613
Perhaps it's time to declare IBM and its officers persona non grata in Australia - they were also involved in the Queensland Health
payroll fiasco a few years ago.
The DDOS attack was conducted by 23 million Australians.
http://www.itnews.com.au/news/...
ABS ditches in-house plans in favour of outsourcing.
The Australian Bureau of Statistics has opted not to build its own private cloud to host the 2016 eCensus, instead awarding a $9.6 million outsourcing contract to existing partner IBM.
Australia’s national statistics agency first offered Australians the option to avoid completing the Census via its traditional paper-based form with a web-based eCensus in 2006.
It partnered with IBM in a $9 million deal in 2005 to develop and support the web-based eCensus application - which is hosted on IBM’s AIX operating system and a WebSphere application server, out of the company's Baulkham Hills, Sydney data centre.
But the agency later virtualised its server infrastructure (with VMware’s vSphere) to create its own private cloud with the intention of hosting the 2016 eCensus.
Running the Census in-house would help address security perceptions arising from the data being handled from a third-party, the ABS said at the time. It said it also made sense to outsource the project to a third-party rather than deal with the one-off high traffic spike internally.
The agency became 95 percent virtualised after cutting 300 physical servers to 70, which hosted 1500 virtual machines.
But the Bureau of Statistics today confirmed it had decided to once again partner with IBM for hosting of the 2016 eCensus in order to ensure the expected high volumes would be properly managed.
The ABS expects the percentage of Australians completing the census online to double in 2016, forecasting a 65 percent take-up compared to 33 percent in 2011. For the first year of the eCensus, 10 percent of Australians submitted their form online.
“The ABS virtualisation project was successfully completed providing a very efficient platform for ongoing ABS operations, including supporting a number of components of the digital Census in 2016,” a spokesperson said.
“However, due to the peak volume of the online form during Census 2016 it was decided that contracting IBM would provide the best value for money and management of operational risk.”
Duncan Young, head of the 2016 Census within the ABS, said IBM had been contracted through a limited tender after proving it could offer the best value for money.
“This contract capitalises on the investment in the existing online Census system,” Young said in a statement to iTnews.
“Our existing solution has shown itself to be robust, and can be expanded to manage increased volumes. Using a known platform will reduce the risk of costly development and integration issues.”
The IBM contract will expire in October 2016.
I got to do the damned thing twice this year. Once because they thought my PO Box was an apartment. Another because they sent one directly to my home. I filled out both truthfully and marked "0" as the number of residents at my PO Box. The other, I filled out with less than clear answers.
some karma... and kinda lukewarm about it.
IBM was paid A$10m for the project, and apparently using SoftLayer technology.
Anybody familiar with the technology?
"Census Hacked" and taking the angle of if it is so easily hacked then our privacy is not secure. Nevermind that a DoS is not hacking... As as we can sell the story these minor details are irrelevant
All those keywords! Methinks the lady doth protest too much...
ABS decided a while ago to outsource the hosting to IBM, paying $10 million for development (simple webforms) and hosting (the hard part).
Given IBM's record in Australia, you might argue this choice was a cockup.
The ABS handed over $10M to IBM to do this. They only had one thing to do. You know the rest.
http://www.abc.net.au/news/201...
Now they are saying it's not been attacked from overseas.
How hard would it have been to "do a Netflix" and block IP addresses based on location anyway? - That would at least stem the amount of foreign intelligence services from trying to hack the website which contains information on Australian citizens.
I read that they tested the system to 150% capacity, where 100% capacity was estimated to be 1 million forms processed per hour.
http://www.abc.net.au/news/201...
That estimate was a gross underestimation of the numbers of sessions needed to handle an estimated 16 million households - all of whom most likely would have logged in during a 4-6 hour period in the evening. You don't have to be a rocket scientist to calculate that the system didn't have the capacity to deal with this spike in traffic.
The capacity should have been somewhere in a ball park of 5-10 million forms processed per hour, or more.
Couldn't have been cheap to have load balancers maxxed out trying to maintain that many accelerated SSL sessions.... but there you go.
READY.
PRINT ""+-0
For those who don't know the rest: IBM farmed out all labor to the 3rd world and it the product was delivered in a busted, useless state.
Who would've thunk that 22 million Australians would get home, eat dinner, and all try and complete that stupid census at 7pm to avoid the risk of a $180/day fine for being late?
"The system can handle 1 million requests an hour". indeed, just not all at once right IBM?
For those who don't know the rest: IBM farmed out all labor to the 3rd world and it the product was delivered in a busted, useless state.
Fuck off. As bad as the Australian economy it isn't third world.
Some of the best teams in IBM work out of Australia.
Details about the results of last nights census available here:
http://www.theshovel.com.au/20...
It was actually because the folks behind the server didn't test it with the graphics enabled. The Stats Can webform could handle something like 60,000 concurrent connections when they tested it. Then after testing, they added the graphics to make it look pretty and didn't do any more testing.
Put it live, and BLAMMO.
If you're a zombie and you know it, bite your friend!
No, he means the Aust government awarded the contract to IBM Australia, who outsourced the whole development to IBM India. What IBM Australia got back was the usual Indian fuckup.
No. He means they sent it to America. /is from US
But not an attack
They designed the system to handle 1,000,000 submissions per hour
Trouble is, 70% of the population live on the east coast, and I'm guessing many people decided to do their civic duty after dinner
So, several million people all tried to log on at the same time from different location, this is distributed - causing catastrophic failure as the system was overloaded - a denial of service
Government claim the "switched off" the site down to protect the data, (although they also say the data was never at risk). They also say that they wouldn't be bringing it back up that night - yet, less than 3 hours after the failure, I managed to log on successfully - on a site the government said was "switched off"
Politicians lie - in other breaking news, the sky is blue, water is wet and Phelps wins a gold medal.
Watch out, there are Llamas!!
If I were Australian the last group I'd want to have access to this data would be the Australian government. They are the group most likely to attack/steal from me and one of the hardest to defend against. Does my situation get much worse if the information becomes public?
If anything, the focus should be on evading the census to begin with. There's basically no benefit to submitting census information other than to avoid the governments threats.
Never assume malice when stupidity will suffice.
At this stage all reports indicate that the ABS cocked things up big time. The DDoS angle seems to be furious spin doctoring.
Basic Electoral fraud starts with gerrymandering - an input of which requires census data to be amenable to the district hacking.
Make sure everyone's vote counts: Verified Voting
Such a simple solution to that problem, that *not* doing it makes them look incompetent.
Incompetence at large scale is indistinguishable from malice in the outcome. Insiders should be suspect in such a clear case of fucking up.
Gray's Law
http://wikidumper.blogspot.com...
"Any sufficiently advanced incompetence is indistinguishable from malice."
Make sure everyone's vote counts: Verified Voting
They tried at some point but the geo-blocker fell over and then ONE router owned by a different company (so thus untouchable until their staff arrived) fell over.
Isn't outsourcing to the "cloud" wonderful?