NZX DDoS 3 Days and counting

Forums › Off topic › NZX DDoS 3 Days and counting

1 | 2 | 3 | 4 | 5

BDFL - Memuneh
80652 posts

Uber Geek
+1 received by user: 41037

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2553083 31-Aug-2020 12:11

eracode:

MikeB4: Apparently the attacks are wider than just NZSX. Other organisations and government agencies are being hit

In NZ?

Yes. It seems the attacks have some collateral damages and infrastructure problems too. But these other organisations aren't talking - no need for targets on their backs.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

703

131 posts

Master Geek
+1 received by user: 47

#2553084 31-Aug-2020 12:17

freitasm:

What website is that?

freitasm

BDFL - Memuneh
80652 posts

Uber Geek
+1 received by user: 41037

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#2553085 31-Aug-2020 12:18

https://horizon.netscout.com/

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

703

131 posts

Master Geek
+1 received by user: 47

#2553087 31-Aug-2020 12:22

freitasm:

https://horizon.netscout.com/

Currenly around 1Gbps. Doesn't sound like a big attack, but then there are probably traffic they don't see. Seems like NZX have moved their stuff over the weekend to new providers.

yitz

2239 posts

Uber Geek
+1 received by user: 594

#2553094 31-Aug-2020 12:29

703: Seems like NZX have moved their stuff over the weekend to new providers.

Going by that map must be a new data centre near Manapouri? 😄

Ge0rge

2114 posts

Uber Geek
+1 received by user: 2060

Trusted

Lifetime subscriber

#2553098 31-Aug-2020 12:40

yitz:
703: Seems like NZX have moved their stuff over the weekend to new providers.

Going by that map must be a new data centre near Manapouri? 😄

Good use of the excess power from Tewai Point !

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

Fred99

13684 posts

Uber Geek
+1 received by user: 10018

#2553104 31-Aug-2020 12:47

Radio NZ are reporting that they've been targeted over the past 24 hours.

*NZX seems to be down for me now.

*intermittently

rugrat

3142 posts

Uber Geek
+1 received by user: 944

Lifetime subscriber

#2553157 31-Aug-2020 14:02

How come radio NZ can thwart the attack but the NZX is not able to.

They also say they believe it is the same group.

https://www.rnz.co.nz/news/business/424853/stuff-rnz-say-they-were-the-target-of-a-failed-cyberattack

chevrolux

4962 posts

Uber Geek
+1 received by user: 2638
Inactive user

#2553161 31-Aug-2020 14:09

That doesn't seem like much traffic at all? Surely modern-ish gear could deal with that?

MikeB4

MikeB4
18775 posts

Uber Geek
+1 received by user: 12766

ID Verified

Trusted

Subscriber

#2553164 31-Aug-2020 14:12

rugrat:

How come radio NZ can thwart the attack but the NZX is not able to.

They also say they believe it is the same group.

https://www.rnz.co.nz/news/business/424853/stuff-rnz-say-they-were-the-target-of-a-failed-cyberattack

Its a sophisticated well organised attack that gives defenders constantly moving targets to try and scrub. The effectiveness and results for organisations being targeted will depend on several factors including the defences being deployed and the defences organisations are prepared to pay for.

Here is a crazy notion, lets give peace a chance.

JaseNZ

2576 posts

Uber Geek
+1 received by user: 1489

ID Verified

Lifetime subscriber

#2555105 1-Sep-2020 19:26

The GCSB is being hit as well as many other nz companies.

Its on like donkey kong.

Ding Ding Ding Ding Ding : Ice cream man , Ice cream man

Geekzone support

Support Geekzone with one-off or recurring donations Donate via PressPatron.

neb

11294 posts

Uber Geek
+1 received by user: 10018

Trusted

Lifetime subscriber

#2555117 1-Sep-2020 19:42

chevrolux:
That doesn't seem like much traffic at all? Surely modern-ish gear could deal with that?

That's the thing about asymmetric attacks, you can bring a system down with tiny amounts of just the right traffic. Google "slowloris attack" which is the most famous one, but in general it relies on finding the worst-case performance of a typical amortised algorithm and triggering that every time. In plain English, you look for something where the worst-case performance on atypical data is vastly worse than the average-case performance on standard data and make sure it only sees the atypical data. So you can for example take out firewall packet filters with a few hundred packets per second by ensuring they don't go through the fastpath processing and then triggering worst-case behaviour in the software-based slow path.

gzt

18679 posts

Uber Geek
+1 received by user: 7820

Lifetime subscriber

#2555181 1-Sep-2020 20:07

ezbee:

Apparently Zdnet are going for a shakedown by a group that's been attacking a number of companies
https://www.zdnet.com/article/ddos-extortionists-target-nzx-moneygram-braintree-and-other-financial-services/

An attempt to extort NZX is unlikely. National infrastructure like NZX an extortionist has as much chance as the government paying up for an attack on a government service. Zero.

My first thought on hearing of the attack was an attempt to manipulate local or international markets via side effects.

It's also a good demonstration of capability or good cover for some other purpose.