MyBB Community Forums

Full Version: DDoSer Threatens For Ransom
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Pages: 1 2 3 4 5 6 7
(2014-12-08, 04:45 PM)Marisa Wrote: [ -> ]OVH 'VAC protection' has been repeatedly bypassed many times in the past - by people who know what they're doing.

Now I'm interested. Care to share some sources for that via PM? I'd really like to know how I can improve our servers stability and security. Quickly searching the internet for sources only wound up with one result about an obscure bug that someone claimed to have found in the VAC system over half a year ago.

The only effective methods against that system that I know of are essentially application layer attacks. Anything that just works by throwing lots of traffic or malformed packets or similar at a server has been detected within minutes and from that point transparently filtered by OVH.

And I'm only considering website and forum hosting, where being slow or down for a minute won't really cause you problems (contrary to gaming servers, where that would result in dropped connections and therefore broken gameplay).
(2014-12-08, 05:41 PM)Jabberwock Wrote: [ -> ]Please show proof for whatever you are saying and if you know a good hosting provider please also specify.
I need protection not against bots accessing my site, as for that I can code a simple DDoS challenge like what CloudFlare does.

Marisa - What do you mean?
Evenprime - Thanks. Seems like a serious company. Maybe I'll consider it.
Euan T - Arvixe

I've heard of quite a few people having problems with VPS services from them in the past. It may be a good idea to try a larger host with more experience.
(2014-12-08, 05:54 PM)Evenprime Wrote: [ -> ]
(2014-12-08, 04:45 PM)Marisa Wrote: [ -> ]OVH 'VAC protection' has been repeatedly bypassed many times in the past - by people who know what they're doing.

Now I'm interested. Care to share some sources for that via PM? I'd really like to know how I can improve our servers stability and security. Quickly searching the internet for sources only wound up with one result about an obscure bug that someone claimed to have found in the VAC system over half a year ago.

The only effective methods against that system that I know of are essentially application layer attacks. Anything that just works by throwing lots of traffic or malformed packets or similar at a server has been detected within minutes and from that point transparently filtered by OVH.

And I'm only considering website and forum hosting, where being slow or down for a minute won't really cause you problems (contrary to gaming servers, where that would result in dropped connections and therefore broken gameplay).

Woah wow wow hold up there buddy.

First off all, most people who breaks stuff doesn't care enough to make a whole blog about it.
Secondly, spam the server via tcp and you'll see that VAC will end up dropping every single tcp packet it gets for a while, there's multiple ways to break it out having to spoof.

Secondly, Ovh is one of the worst companies around imo ranked next to GoDaddy, they have a horrible network, horrible support, horrible hardware support.
Lets start with the network, you can actually google this.. Packet loss, Ovh is the pure definition of it because they have it so often and for a longer period of times many times up to 90% of packets gets lost.

Support, well there is hardly any tbh.

Hardware support, if something breaks you're going to pay for the time that the dedicated server sits there doing nothing and they're going to drag the time out even thought they can have it fixed by about 30 minutes of it being reported as they have quite a lot of backup hardware.

What about being slow + down for over 6 hours due to them flipping their network upside down quite often?
(2014-12-09, 06:07 AM)Rakes Wrote: [ -> ]Woah wow wow hold up there buddy.

First off all, most people who breaks stuff doesn't care enough to make a whole blog about it.
Secondly, spam the server via tcp and you'll see that VAC will end up dropping every single tcp packet it gets for a while, there's multiple ways to break it out having to spoof.

Secondly, Ovh is one of the worst companies around imo ranked next to GoDaddy, they have a horrible network, horrible support, horrible hardware support.
Lets start with the network, you can actually google this.. Packet loss, Ovh is the pure definition of it because they have it so often and for a longer period of times many times up to 90% of packets gets lost.

Support, well there is hardly any tbh.

Hardware support, if something breaks you're going to pay for the time that the dedicated server sits there doing nothing and they're going to drag the time out even thought they can have it fixed by about 30 minutes of it being reported as they have quite a lot of backup hardware.

What about being slow + down for over 6 hours due to them flipping their network upside down quite often?

Woah wow wow hold up there buddy. I can't confirm any of these claims.

If there were an easy way to take OVH servers down for longer than the time it takes for VAC to kick in, it would make its rounds. People are like that, always bragging about such things and/or trying to sell the concept of the attack or their botnets for DDoS attacks. OVH is still (in my opinion) the most asked for server hoster in that regard, e.g. "Can it take down a server at OVH?" is one of the first questions, next to "does this get past Cloudflare? (as much or little sense such questions may make)". They are not indestructible or invulnerable, but for a forum they are more than good enough as a host to prevent DDoS attackers from taking you  down for more than a few minutes at a time. If you go with their business server line at ovh directly, you can also permanently enable the VAC protection, which even further reduces the impact that troublesome people with too much pocketmoney can have on you.

I personally had a small dedicated server with ovh in north america for private projects over a year ago and after a hardware fault (hard drive problems) support was actually pretty fast and good back then. We never had any hardware problems with the "big" server, so can't really say anything about support with that in case of hardware faults. As far as I know you get the support that you paid for, which is written in the contract (what? when? who?).

Never had network problems, never had problems with packet loss, as far as I know. I can't say anything about that tcp connection dropping claim of yours in case of tcp floods. I never noticed any problems like that and even if there were any, it wouldn't matter for a forum if for a short time no new connection would be accepted, as most people will spend a minute or two reading a page before attempting to load another page. I humored you and actually googled "ovh packet loss". Came up with two forum entries which turned out to be problems of the ISP of those users and one thread about network problems with OVH Canada in November.

We are hosted in France, maybe the problems you described happen at another datacenter of OVH? I never had a "gaming server" with them, so can't say anything about that in case of latency, stability etc.

In the last year we had no downtimes due to technical problems of OVH, no "6 hour outtimes due to them flipping their network upside down quite often". That's all I can say about that. If you had different experiences, I'm sorry. But as I said, I have nothing to complain about so far (except that their dashboard doesn't have a lot of options for configurations for "cheaper" lines of servers in Europe).

All I can offer is my personal experience, which has been so far very good with ovh when it comes to hosting of medium-sized forums and a few websites plus a view other services like Teamspeak. I just wanted to give advice about how there are companies that can handle huge DDoS attacks and that people should search for them. I never intended this to be a "OVH is great"-Conversation and intentionally omitted the name of the company in previous comments.

But as some people did have to bring up the topic, I wanted to clarify some things. Also, I still would like to know about those attacks that are bypassing OVHs protection for more than seconds/few minutes and are not application layer, so my PN box is waiting. Beyond that, I won't answer to anymore comments about OVH, as this thread has gone offtopic long enough.
(2014-12-09, 06:07 AM)Rakes Wrote: [ -> ]
(2014-12-08, 05:54 PM)Evenprime Wrote: [ -> ]
(2014-12-08, 04:45 PM)Marisa Wrote: [ -> ]OVH 'VAC protection' has been repeatedly bypassed many times in the past - by people who know what they're doing.

Now I'm interested. Care to share some sources for that via PM? I'd really like to know how I can improve our servers stability and security. Quickly searching the internet for sources only wound up with one result about an obscure bug that someone claimed to have found in the VAC system over half a year ago.

The only effective methods against that system that I know of are essentially application layer attacks. Anything that just works by throwing lots of traffic or malformed packets or similar at a server has been detected within minutes and from that point transparently filtered by OVH.

And I'm only considering website and forum hosting, where being slow or down for a minute won't really cause you problems (contrary to gaming servers, where that would result in dropped connections and therefore broken gameplay).
Lets start with the network, you can actually google this.. Packet loss, Ovh is the pure definition of it because they have it so often and for a longer period of times many times up to 90% of packets gets lost.

If OVH were the undisputed kings of packet loss, then game server providers (and individual large servers) wouldn't be purchasing their services. I personally admin on a Minecraft server hosted on their BHS datacenter infrastructure out of Quebec. Not a single issue other than the ever-present user error (it's also used as a Jenkins build server and some dumbo forgot to purge the Jenkins logs before they filled up the HDD, thus bringing the whole thing down). Nothing related to the network, as in Canada at least, our fibre backbone isn't terrible, and OVH's network seems to be solid.
I would recomend OVH also. They got the best protection i ever used Smile
What I still don't understand is, how it's being done.
Can someone use a single bot to virtualize many bots?
Each bot has its own IP address, so can he spoof its original IP address?
(2014-12-14, 06:51 AM)Jabberwock Wrote: [ -> ]What I still don't understand is, how it's being done.
Can someone use a single bot to virtualize many bots?
Each bot has its own IP address, so can he spoof its original IP address?

If each bot is running its own IP address, he's either spoofing (decently unlikey - though I suppose running multiple VPN instances is doable), running a VPS network (not unlikely, you can get VPS's for around 10 cents on the hour from some places), or a botnet (not that uncommon, but rareish nowadays as most script kiddies just use a paid booter or the VPS's.)

I'd run a IP lookup on the IP's attacking you, if they're from a corporate IP, they're using VPS's or VPN's, if it's residential IP's, you may be looking at a botnet.
A DDOS attack won't be all that effective without a ton of traffic. I don't know anything about spoofing IP addresses, but one little VPS running on a 10mbps network generally isn't going to be able to do a whole lot of damage.
(2014-12-15, 03:29 AM)Darth Apple Wrote: [ -> ]A DDOS attack won't be all that effective without a ton of traffic. I don't know anything about spoofing IP addresses, but one little VPS running on a 10mbps network generally isn't going to be able to do a whole lot of damage.

Simply not the case. Layer 7 attacks don't require much bandwidth at all, take 'Slowloris' for an example.
Pages: 1 2 3 4 5 6 7