Slashdot Mirror
Why the Silencing of KrebsOnSecurity Opens a Troubling Chapter For the Internet (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: For the better part of a day, KrebsOnSecurity, arguably the world's most intrepid source of security news, has been silenced, presumably by a handful of individuals who didn't like a recent series of exposes reporter Brian Krebs wrote. The incident, and the record-breaking data assault that brought it on, open a troubling new chapter in the short history of the Internet. The crippling distributed denial-of-service attacks started shortly after Krebs published stories stemming from the hack of a DDoS-for-hire service known as vDOS. The first article analyzed leaked data that identified some of the previously anonymous people closely tied to vDOS. It documented how they took in more than $600,000 in two years by knocking other sites offline. A few days later, Krebs ran a follow-up piece detailing the arrests of two men who allegedly ran the service. A third post in the series is here. On Thursday morning, exactly two weeks after Krebs published his first post, he reported that a sustained attack was bombarding his site with as much as 620 gigabits per second of junk data. That staggering amount of data is among the biggest ever recorded. Krebs was able to stay online thanks to the generosity of Akamai, a network provider that supplied DDoS mitigation services to him for free. The attack showed no signs of waning as the day wore on. Some indications suggest it may have grown stronger. At 4 pm, Akamai gave Krebs two hours' notice that it would no longer assume the considerable cost of defending KrebsOnSecurity. Krebs opted to shut down the site to prevent collateral damage hitting his service provider and its customers. The assault against KrebsOnSecurity represents a much greater threat for at least two reasons. First, it's twice the size. Second and more significant, unlike the Spamhaus attacks, the staggering volume of bandwidth doesn't rely on misconfigured domain name system servers which, in the big picture, can be remedied with relative ease. The attackers used Internet-of-things devices since they're always-connected and easy to "remotely commandeer by people who turn them into digital cannons that spray the internet with shrapnel." "The biggest threats as far as I'm concerned in terms of censorship come from these ginormous weapons these guys are building," Krebs said. "The idea that tools that used to be exclusively in the hands of nation states are now in the hands of individual actors, it's kind of like the specter of a James Bond movie." While Krebs could retain a DDoS mitigation service, it would cost him between $100,000 and $200,000 per year for the type of protection he needs, which is more than he can afford. What's especially troubling is that this attack can happen to many other websites, not just KrebsOnSecurity.
They don't care that IoT is a horrible idea, and they ignore countless other security practices to increase their own pocket wads. Power holders want to track your every move and dig every loose penny they can find out of _your_ pocket in the process.
Stop connecting every damn thing to the Internet, and start securing what you have to have connected. This is not a mentally challenging thought process, so if you don't "get it" that makes you...
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
Give it a day or two and a solution will exist. It's only when problems become real that people start taking notice. If heroes can go down, then all of us must rise up.
In a normal country, you can setup things called "laws" that companies need to adhere to.... I know it's a foreign concept but it does actually happen in some places!
Krebs' site had the full backing of Akamai until it became too expensive for them to continue fending off the attacks. If it's too expensive for Akamai to do this, it means that the attackers can take any site offline, no matter how big or how powerful. So, no, it's not just about one site. How long until Akamai itself can't keep up with attacks and has to shut down?
(Score: -1, Stupid)
In a normal country, you can setup things called "laws" that companies need to adhere to.... I know it's a foreign concept but it does actually happen in some places!
Just not anywhere of importance. Tell us again: how many Goldman-Sachs bankers are in jail? How about HSBC bankers? How much competition does Microsoft have in the PC OS space? How many people at Sony landed in jail after the rootkits?
>Krebs' site had the full backing of Akamai until it became too expensive for them to continue fending off the attacks
It wasn't too expensive for Akamai to continue fending off the attacks. It was too expensive to them to fend off the attacks for free
It''s not our computers doing this, it's the damn refrigerator. Don't blame me when your black box goes on the fritz. And don't go after the users until they can sue Microsoft and Apple, and Frigidaire for their feeble security.
“He’s not deformed, he’s just drunk!”
If I understand this correctly, Akamai threw Krebs out because Akamai could not handle the DDS. This means I'm never sending any business to Akamai because they can't handle it properly. But it doesn't mean Krebs is off the air for long.
For example, I bet Cloudflare would take him on. They've differentiated themselves on the ability to handle DDS.
Bruce Perens.
The web, like e-mail, is going through death throes.
Gimmie a break. You know how often I've heard "email is dying"? Generally it's from some stupid millennial, or the mouthpiece of a social networking company that offers a messaging feature that, for all intents and purposes, is email (except with formatting and picture/video inserting bells and whistles). What they really mean is "we wish email were dead, so everyone would be forced to become one of our users and we could become the new defacto email".
When those kids go out and get a job and have to communicate in a serious fashion, it's not Facebook they're going to be launching -- it's Outlook.
To ISPs "servers" are considered 'harmful devices', but botnets of these sorts of clients with out of development closed source firmwares are considered "nonharmful devices". Lol.
Which central server did these non-peers cache the newsgroups from?
Slashdot: where don knuth is an idiot because he cant grasp the awesome power of php