Slashdot Mirror
'Catastrophic' DDoS Attack Hits Linode Servers Over Labor Day Weekend (softpedia.com)
An anonymous reader writes: A coordinated DDoS attack hit Linode (VPS provider) over the weekend, which the company has described as "catastrophic." The attack targeted the company's Atlanta data center, and was timed for the extended Labor Day weekend when the company had fewer employees on hand to deal with the incident. At the start of the year, after suffering a two-week-long DDoS attack, Linode announced a data breach with attackers accessing some user accounts. The company reset passwords after it detected the intrusions. Linode engineers told customers they were "experiencing a catastrophic DDoS attack which is being spread across hundreds of different IP addresses in rapid succession, making mitigation extremely difficult." The report adds: "During all this time, connectivity to the service was down, affecting Linode customers such as Clojars, a repository of open source Clojure libraries that relies on the Linode infrastructure."
"a repository of open source Clojure libraries that relies on the Linode infrastructure"
So these libraries are only available in one place? Haven't these guys heard of mirror sites? I know its easy to fool Joe ixpack into thinking The Cloud is some safe secure place and he never needs to worry about his data ever again (honest!) , but one would hope people involved in writing programming libraries would have a bit more common sense.
Hosting static binaries such as jar files is a great use case for ipfs.
In fact, it would be good to see package managers in general support IPFS downloading, and possibly good for privacy as well as availability.
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
We could use that and not have a single point of failure.
n/t
It was almost universally true that Slashdot would fail to describe what a Linode was, in any of their other astroturf articles. At least now we know - just another VPS provider but with a Linux-y sounding name.
Happy Birthday Martin Milner!
Black Coffee on Me
So they don't keep staff on-call? They don't have outside security firms already on speed dial? They don't have plans already in place?
They've HAD attacks already. They should know better.
And honestly, if the attackers are expecting you to be weak on a big holiday, and you know they are, then you MUST be prepared. Place where I used to work was notorious for taking a couple major holidays where literally not one single employee was in any of the facilities. There were only a couple on-call people for big clients to use. But otherwise nobody was there.
What were probably Russian hackers hit us on one of those weekends and nobody did anything about it until 9AM the next work day. The company had no clue how much damage had been done or data stolen. It was all buried and customers were told a webserver had failed. Right.
Duh. Linode is one of the few hosting services that "helpfully" assigns systematic aliases (such as "linode1234.members.linode.com") to all virtual machines, basically providing a host lookup for hackers to easily target Linode hosts.
It boggles the mind.
I get that a monoculture is bad, but... When was the last time AWS lost an entire data centre to a DDOS?
It's probably exactly what the attackers want, but as someone with a responsibility first to my employer, how can I ever recommend a company like Linode?
They need to figure this out, because every time one of these articles hits the news the reputation damage is pushing them further and further into a spiral.
This statement is forty-five characters long.
this is a DDOS attack, providing DNS is a dumb idea, as the attack continues even if the IP is switched.