NZX DDoS 3 Days and counting

Forums › Off topic › NZX DDoS 3 Days and counting

1 | 2 | 3 | 4 | 5

BDFL - Memuneh
79294 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2553083 31-Aug-2020 12:11

eracode:

MikeB4: Apparently the attacks are wider than just NZSX. Other organisations and government agencies are being hit

In NZ?

Yes. It seems the attacks have some collateral damages and infrastructure problems too. But these other organisations aren't talking - no need for targets on their backs.

703

131 posts

Master Geek

#2553084 31-Aug-2020 12:17

freitasm:

What website is that?

freitasm

BDFL - Memuneh
79294 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2553085 31-Aug-2020 12:18

https://horizon.netscout.com/

703

131 posts

Master Geek

#2553087 31-Aug-2020 12:22

freitasm:

https://horizon.netscout.com/

Currenly around 1Gbps. Doesn't sound like a big attack, but then there are probably traffic they don't see. Seems like NZX have moved their stuff over the weekend to new providers.

yitz

2080 posts

Uber Geek

#2553094 31-Aug-2020 12:29

703: Seems like NZX have moved their stuff over the weekend to new providers.

Going by that map must be a new data centre near Manapouri? 😄

Ge0rge

2055 posts

Uber Geek

Trusted

Lifetime subscriber

#2553098 31-Aug-2020 12:40

yitz:
703: Seems like NZX have moved their stuff over the weekend to new providers.

Going by that map must be a new data centre near Manapouri? 😄

Good use of the excess power from Tewai Point !

Fred99

13684 posts

Uber Geek

#2553104 31-Aug-2020 12:47

Radio NZ are reporting that they've been targeted over the past 24 hours.

*NZX seems to be down for me now.

*intermittently

Sharesies

Trade NZ and US shares and funds with Sharesies (affiliate link).

rugrat

3107 posts

Uber Geek

Lifetime subscriber

#2553157 31-Aug-2020 14:02

How come radio NZ can thwart the attack but the NZX is not able to.

They also say they believe it is the same group.

https://www.rnz.co.nz/news/business/424853/stuff-rnz-say-they-were-the-target-of-a-failed-cyberattack

chevrolux

4962 posts

Uber Geek
Inactive user

#2553161 31-Aug-2020 14:09

That doesn't seem like much traffic at all? Surely modern-ish gear could deal with that?

MikeB4

18435 posts

Uber Geek

ID Verified

Trusted

#2553164 31-Aug-2020 14:12

rugrat:

How come radio NZ can thwart the attack but the NZX is not able to.

They also say they believe it is the same group.

https://www.rnz.co.nz/news/business/424853/stuff-rnz-say-they-were-the-target-of-a-failed-cyberattack

Its a sophisticated well organised attack that gives defenders constantly moving targets to try and scrub. The effectiveness and results for organisations being targeted will depend on several factors including the defences being deployed and the defences organisations are prepared to pay for.

JaseNZ

2576 posts

Uber Geek

ID Verified

Lifetime subscriber

#2555105 1-Sep-2020 19:26

The GCSB is being hit as well as many other nz companies.

Its on like donkey kong.

Ding Ding Ding Ding Ding : Ice cream man , Ice cream man

neb

11294 posts

Uber Geek

Trusted

Lifetime subscriber

#2555117 1-Sep-2020 19:42

chevrolux:
That doesn't seem like much traffic at all? Surely modern-ish gear could deal with that?

That's the thing about asymmetric attacks, you can bring a system down with tiny amounts of just the right traffic. Google "slowloris attack" which is the most famous one, but in general it relies on finding the worst-case performance of a typical amortised algorithm and triggering that every time. In plain English, you look for something where the worst-case performance on atypical data is vastly worse than the average-case performance on standard data and make sure it only sees the atypical data. So you can for example take out firewall packet filters with a few hundred packets per second by ensuring they don't go through the fastpath processing and then triggering worst-case behaviour in the software-based slow path.

gzt

17140 posts

Uber Geek

Lifetime subscriber

#2555181 1-Sep-2020 20:07

ezbee:

Apparently Zdnet are going for a shakedown by a group that's been attacking a number of companies
https://www.zdnet.com/article/ddos-extortionists-target-nzx-moneygram-braintree-and-other-financial-services/

An attempt to extort NZX is unlikely. National infrastructure like NZX an extortionist has as much chance as the government paying up for an attack on a government service. Zero.

My first thought on hearing of the attack was an attempt to manipulate local or international markets via side effects.

It's also a good demonstration of capability or good cover for some other purpose.