Series of DDoS attacks plague Linode data centers, infrastructure

merci, je n’avais pas vu passer celui-là

J’avais oublié le texte officiel de Linode ▻http://status.linode.com/incidents/mmdbljlglnfd que je recopie ici au cas où il disparaisse :

In progress
An update from Linode about the recent DDoS attacks
Posted 3 days ago. Dec 31, 2015 - 22:45 UTC
Scheduled
I’d like to share some updates about the recent DDoS attacks.

I am one of several network engineers at Linode who have been working around the clock on DDoS mitigation. While things are stable, I would like to take a moment to publicly address the large and frequent DDoS attacks that we have been receiving since Christmas Day.

It has become evident in the past two days that a bad actor is purchasing large amounts of botnet capacity in an attempt to significantly damage Linode’s business. The following is a partial list of attacks we have received in no particular order:

– Multiple volumetric attacks simultaneously directed toward all of our authoritative nameservers, causing DNS hosting outages
– Multiple volumetric attacks simultaneously directed toward all of our public-facing websites, causing Linode Manager outages
– Layer 7 (“400 bad request”) attacks toward our web and application servers, causing Linode Manager outages
– Large volumetric attacks toward our colocation provider’s upstream interconnection points, overwhelming the router control planes and causing significant congestion/packet loss
– Large volumetric attacks toward Linode network infrastructure, overwhelming the router control planes and causing significant congestion/packet loss

All of these attacks have occurred multiple times. Over the course of the last week, we have seen over 30 attacks of significant duration and impact. As we have found ways to mitigate these attacks, the vectors used inevitably change.

As of this afternoon, we have mostly hardened ourselves against the above attack vectors, but we expect more to come. We are working extremely closely with all of our technical partners, including our network equipment vendors and our colocation providers, to prevent future attacks.

Once these attacks stop, we plan to share a complete technical explanation about what has been happening. Additionally, we will be announcing the details of an ongoing project to significantly improve our internet connectivity and resiliency.

We would like to apologize for the lack of detail in some of our recent status-page updates. Please know that we are dedicating all resources from multiple departments to stopping these attacks. We acknowledge the amount of downtime we’ve been experiencing is completely unacceptable, and we appreciate the understanding and support we have received over the past several days. We will share more information as our investigation continues.

Alex Forster
Network Engineer at Linode
Posted 3 days ago. Dec 31, 2015 - 22:23 UTC

Ça va un peu mieux mais ce n’est pas terminé ▻http://www.theregister.co.uk/2016/01/04/linode_back_at_last_after_ten_days_of_hell ►http://www.scmagazine.com/cloud-hosting-company-linode-sees-service-interruptions-for-ddos-attacks/article/462535

I guess the DDoS also served as a cloak for other types of attacks: a possible data breach has lead Linode to expire all customer passwords because of unauthorised logins on there customer accounts.

▻https://blog.linode.com/2016/01/05/security-notification-and-linode-manager-password-reset

@erratic Quite possible. dDoS attacks are often used for that.

Autres articles : sur l’attaque dDOS ▻https://securityintelligence.com/news/ddos-attacks-storm-linode-servers-worldwide Sur la fuite de données ▻http://www.eweek.com/security/linode-resets-passwords-as-ddos-attacks-continue.html