Nov 15, 2020 06:21 PM
(This post was last modified: Nov 15, 2020 06:21 PM by Omniscient.)
Well this is going to be the truth about what happened the past 72 hours even though it's going to be a bit embarrassing.
HF gets attacks, a lot of them, all the time. I have a lot of automated security and get alerts if I'm away from my computer and HF goes offline.
When I take vacations I do not announce it for security reasons. Well, it just so happened a reasonable sized attack hit HF just as I was driving to California for the weekend to spend with family and friends. It's a 5 hour drive and I sat in agony the whole time as HF loaded slowly and I tried to communicate some actions to Xerotic. I was not driving btw.
I arrived in California Thursday afternoon around 3pm but immediately I have something planned till about 6pm. I know HF is loading slowly and the web socket isn't working and SSL Handshake errors are all over the place. Unfortunately I didn't have availability to deal with it.
Note that Xerotic is not a system administrator and his access to HF servers is limited. He does not have root access nor the skillset (yet) to manage the server. It's something I hope to guide him more with our test servers before giving him access to the HF servers.
About 6pm hits and I'm back at my hotel room and I whip open my laptop to take a look. I'd say that I'm a DDOS mitigation specialist because that's one of my main tasks running HF and I've been doing it for 14 years.
This is where it gets embarassing for me. I normally don't need to use my laptop on trips. I always bring it but rarely have needed it. My automated DDOS protection has been fairly strong. But I always carry with me my credentials for access. When I finally did begin working with the laptop I was having trouble logging into the server as root. Root access is very much required to deal with a DDOS attack. I had only about 2 hours Thursday night before our dinner plans. I was not able to login as root.
Then on Friday morning I woke up extra early to get it sorted out. I got very close but again, did not gain root access in the two hour window I had before my scheduled events. It was really frustrating for me. I was kicking myself for not 100% confirming my access and setting up the laptop before leaving for vacation. I'm certain given enough time I'd have gotten into the server but it was unfair to my family and friends to also ruin their plans.
By Friday afternoon I made the decision to turn HF off for the weekend until I returned Sunday to properly deal with the issue.
It took me about 15 minutes to normalize HF. Took about 10 minutes more for attacks to resume and even less time for me to stop the attack. One person is claiming responsibility and trying to blackmail me for 1 BTC. Another person on social media claims HF has a RAT on the server. I'm sure other rumors were spread during the downtime.
1. No RAT on the server. That's ridiculous because you don't install RAT's into a LINUX server. You install a SHELL.
2. Not gonna ever pay any ransom.
3. Attack was shit and easily stopped once I was in the server.
4. I don't care about the identity of the attacker nor about their motivation. I'm only ever concerned about keeping HF online.
5. HF is secure. Our server is not compromised. All data is safe and also backups exist off-server.
I assume the attacker will continue attacking. I don't really care. I'll figure it out and adjust and we'll continue business as usual. The ONLY reason we were effected was because I was on vacation. DDOS attacks are very normal part of my day.
On Friday I had Xerotic extend all HF paid advertising (Banners, Stickies, Sales Tags, and Featured Forum) for 3 days. So anyone with advertising should not be upset over lost time.
Meh, back to business as usual. I certainly want to apologize to everyone for being an idiot and locking myself out of server. Really noobish thing to do. It won't happen again.
Thank you.
HF gets attacks, a lot of them, all the time. I have a lot of automated security and get alerts if I'm away from my computer and HF goes offline.
When I take vacations I do not announce it for security reasons. Well, it just so happened a reasonable sized attack hit HF just as I was driving to California for the weekend to spend with family and friends. It's a 5 hour drive and I sat in agony the whole time as HF loaded slowly and I tried to communicate some actions to Xerotic. I was not driving btw.
I arrived in California Thursday afternoon around 3pm but immediately I have something planned till about 6pm. I know HF is loading slowly and the web socket isn't working and SSL Handshake errors are all over the place. Unfortunately I didn't have availability to deal with it.
Note that Xerotic is not a system administrator and his access to HF servers is limited. He does not have root access nor the skillset (yet) to manage the server. It's something I hope to guide him more with our test servers before giving him access to the HF servers.
About 6pm hits and I'm back at my hotel room and I whip open my laptop to take a look. I'd say that I'm a DDOS mitigation specialist because that's one of my main tasks running HF and I've been doing it for 14 years.
This is where it gets embarassing for me. I normally don't need to use my laptop on trips. I always bring it but rarely have needed it. My automated DDOS protection has been fairly strong. But I always carry with me my credentials for access. When I finally did begin working with the laptop I was having trouble logging into the server as root. Root access is very much required to deal with a DDOS attack. I had only about 2 hours Thursday night before our dinner plans. I was not able to login as root.
Then on Friday morning I woke up extra early to get it sorted out. I got very close but again, did not gain root access in the two hour window I had before my scheduled events. It was really frustrating for me. I was kicking myself for not 100% confirming my access and setting up the laptop before leaving for vacation. I'm certain given enough time I'd have gotten into the server but it was unfair to my family and friends to also ruin their plans.
By Friday afternoon I made the decision to turn HF off for the weekend until I returned Sunday to properly deal with the issue.
It took me about 15 minutes to normalize HF. Took about 10 minutes more for attacks to resume and even less time for me to stop the attack. One person is claiming responsibility and trying to blackmail me for 1 BTC. Another person on social media claims HF has a RAT on the server. I'm sure other rumors were spread during the downtime.
1. No RAT on the server. That's ridiculous because you don't install RAT's into a LINUX server. You install a SHELL.
2. Not gonna ever pay any ransom.
3. Attack was shit and easily stopped once I was in the server.
4. I don't care about the identity of the attacker nor about their motivation. I'm only ever concerned about keeping HF online.
5. HF is secure. Our server is not compromised. All data is safe and also backups exist off-server.
I assume the attacker will continue attacking. I don't really care. I'll figure it out and adjust and we'll continue business as usual. The ONLY reason we were effected was because I was on vacation. DDOS attacks are very normal part of my day.
On Friday I had Xerotic extend all HF paid advertising (Banners, Stickies, Sales Tags, and Featured Forum) for 3 days. So anyone with advertising should not be upset over lost time.
Meh, back to business as usual. I certainly want to apologize to everyone for being an idiot and locking myself out of server. Really noobish thing to do. It won't happen again.
Thank you.
![[Image: Lw5BVVZ.gif]](https://i.imgur.com/Lw5BVVZ.gif)
![[Image: 0nouhj.gif]](https://files.catbox.moe/0nouhj.gif)
![[Image: 1111.gif]](https://i.ibb.co/7XG4t9y/1111.gif)
