The background traffic is loud.

Written By: - Date published: 8:41 am, September 2nd, 2020 - 16 comments
Categories: Financial markets, internet, Media, The Standard - Tags: , , ,

Along with the grey weather, the weather around our local net is downright annoying at present. There are a massive increase in attempts to break into this site via backend systems and brute force front-end logins, a surge in scans from the search engine spider bots, and a lot of requests for putting up paid content. All of which have been ignored or dealt with.

Just looking through the logs, I’d say that over the last couple of months we have had at least a ten-fold increase in total traffic, and a mere doubling of human traffic heading into our moving election.

Most of which has been handled just by our usual security systems. But I suspect that this is just a side-effect of a more general run on out local net based on news reports of hacking and denial of service attacks.

For instance from Stuff “Govt spy agency has ‘no clues’ on source of cyberattacks on NZX” where amongst reporting on other attacks they detail attacks on media and other financial institutions.

Stuff spokeswoman Candice Robertson said Stuff had been targeted by a DDoS attack on Sunday which it had successfully defended itself against.

“Importantly, the Stuff site remains secure,” she said.

Radio NZ spokeswoman Charlotte McLauchlan said it had also experienced multiple DDoS attacks during the past 24 hours.

“We understand this may have been the same group that has been attacking the NZX and we are currently investigating,” she said.

“Our site remains secure and this has not impacted our audience.”

The country’s biggest banks are tightening security to protect themselves from similar attacks.

It is understood banks have been facing attempted attacks, although the Reserve Bank said it had not been advised of any significant issues over the weekend.

Little said most organisations were prepared for DDoS attacks and were able to “absorb them without disruption”.

“They fizzle out once it is clear they are not going to yield any response that the attacker might want,” he said.

Stuff “Govt spy agency has ‘no clues’ on source of cyberattacks on NZX“

The MetService web site went down, as I noticed when I reached for their rain radar before biking to work.

MetService is the latest organisation to be hit by the same cyber attack that crashed the NZX website for five days.

The weather forecaster was hit by a DDoS (distributed denial of service) attack today, but a spokesman said it was dealt with “in a timely manner”.

“As of 5pm today, there has been no notable loss of performance to any MetService digital platforms,” he said.

“MetService also operate a back-up site, this site contains all safety critical information, and includes authorised MetService severe weather watches and warnings, MetService rain radar imagery and brief forecast information.”

NZ Herald “MetService latest NZ organisation to be hit by targeted cyber attack, TSB experiences tech issues“

It seems to be ongoing, as I’m getting the same thing today as I’m reaching for my bike helmet.

As this site is purely volunteer (thank you authors and moderators), financed by unsolicited donations (thanks a lot of for the higher donations in August) and my occasional spurts of work, we’re not a high value target. So personally I mostly notice the traffic on the background net by the pitch of the hum of my system fans in our living room.

Of course not all outages are the result of malicious action. While our site had an outage on 23th and 24th of August. That eventually proved to be a failing SSD drive slowing down the RAID array that runs the database of the The Standard on my home server. I sat down over weekend and wrote a routine to low level test for drives that were actually slowing down, but which were not triggering SMART errors so it could retire drives. I also added 3 spare drives to The Standard array to add to the single spare drive still running on it.

It is a case of closing door after the fact – but I’m sure that there has been a lot of that happening elsewhere around the local network this week.

Because of the extra load on my network, I added a feature two weeks ago to be a little more paranoid. The Wordfence utility, that does the bulk of the protection at the The Standard server, has a feature that will block known malicious IP numbers based on attacks coming from those locations. I turned it back on, and the unwanted traffic at the site dropped markedly.

But like all good security features, it is a double sided weapon. It also blocked at least one reader coming from the Flip ISP – probably because they had a dynamic IP from a previous bad actor. They reached out to me and I put in an over ride for the whole of the Flip address range. It anyone else notices a blockage, then could you contact me giving me your internet service provider, and I’ll make a case-by-case exception.

Since the 90% of our human traffic comes from within the NZ network, I’d like to put a free gateway around the local NZ IPv4 and IPv6 addresses – which are accessible here. Does anyone know of a computer readable and accessible list that can be read – I’d add that to the daily tasks.

16 comments on “The background traffic is loud. ”

  • Comments are now closed

  1. Andre 1
    2 September 2020 at 8:50 am

    Huh. It never occurred to me the reason Wordfence was giving me the single-finger 403 salute might be because I'm with Flip. I just figured it was a side effect of other issues that seemed to be happening at the same time.

  2. greywarshark 2
    2 September 2020 at 11:05 am

    We know that there has been a permanent underclass caused by free market, neolib economic practices called the precariat. The whole society has by wholeheartedly adopting tech that has no heart and putting vast amount of our communications and transactions on-line, opened us up to interference from any malefactor or grifter in the world leaving us in a vulnerability that has made our very living precarious.

    • Jum 2.1
      2 September 2020 at 11:13 am

      We also know this is happening just before an election and the particular targets have been chosen carefully.

  3. Jum 3
    2 September 2020 at 11:12 am

    collins' shadow portfolio national security and intelligence. brownlee's shadow portfolios GCSB, NZSIS, Covid 19 border response

    do collins/brownlee sit in at all national security meetings?

  4. RedBaronCV 4
    2 September 2020 at 11:33 am

    Excuse my ignorance but is it likely these attacks are coordinated or all from the one source? Do they want anything from NZ as a whole? Are they likely to be a practice run for ahem a similar attack on another country? While everyone is busy trying to shut this down is something else being sneaked in through a back door.? Is there a possibility of a commercial imperative – drive everyone onto cloud servers so that the attacks can be repelled by more bandwidth.

    • lprent 4.1
      2 September 2020 at 12:01 pm

      Not particularly coordinated as far as I can see. Looks like a series of different criminal extortion groups trying their luck.

      I suspect that their ‘normal’ targets in other countries like the US and Europe are getting harder due to past experiences. So they’re expanding out to other countries. Basically there are a pile of compromised systems out there that can be hired as botnets from the malware controllers. So they get hired and target prospects.

      In the case of The Standard, every 3 years as part of the election cycle we get a significiant increase in human traffic. This attracts bots and people who’d like to compromise a higher traffic site or who’d like us to put up posts linking to or extolling their services. A third of my visible email comes from them. Since I throw them to the heuristic anti-spam systems for dispersion to the wider email world. I eventually don’t see them any more. My spam folder is rife with them until their score gets high enough and they just get rejected before the email arrives.

      This year, there appear to be a lot robotic emails and systems more than usual even in the election season. Probably because of the longer election period. Possibly because there are more botnets available. The worst I have seen so far is about 104 individual systems attempting brute force logins in a 5 minute period. They get three tries and then they are ignored for an hour. If they persist then they’re tagged as a threat and blocked for days or months. Same for systems trying various wordpress exploits.

      Plus of course the usual spiders from google, bing, baidu, and at least a few hundred more website scrapers are busy scuttling over the site more often because there are more comments.

      It is a bit noisy at present.

    • Stuart Munro 4.2
      2 September 2020 at 12:09 pm

      This year has seen a substantial increase in attacks, which seem to have rolled through a number of countries, of which NZ appears to be the latest. Some large corporations, notably Amazon, have also been targeted.

      It is likely a loose group of attackers, perhaps somewhat like the Macedonian youtubers, but such groups may well be assisted or directed at some level by a state actor.

  5. Draco T Bastard 5
    2 September 2020 at 12:59 pm

    Does anyone know of a computer readable and accessible list that can be read – I’d add that to the daily tasks.

    Open Visual Trace Route seems to have such a list. Probably made up of one or more of the licences included in the package such as:

    • lprent 5.1
      2 September 2020 at 1:28 pm

      The easiest way is for me to load the NZ IP ranges directly into wordfence.

      I thought of MaxMind. But their country DB is USD 24 per shot or per month. And it is for the whole world.

      I'll have a look at the others once I'm outside corporate firewalls.

      The best one I have seen so far is https://lite.ip2location.com/database-ip-country

      It is a bit annoying that wordfence has a blacklist for countries and it has a global blacklist IP list.

      But it doesn't have a whitelist for countries that overrides the blacklist for IPs. So the only only real way to have the blacklist IPs, but let the whole of the NZ IP list (ie >90% of our human readers) through is to put the whole list of NZ IP ranges into the wordfence list.

      grumble

  6. gsays 6
    2 September 2020 at 1:09 pm

    I have heard from a few people now, that part of the problem the NZX has been facing, is a lack of band with. Both at the business level and nationally.

    The analogy is the 'pipe' size coming into NZ is not big enough.

    So… does an answer lie in bigger 'plumbing'? Or can our internet come thru the air/space/satelite?

  7. karol121 7
    2 September 2020 at 4:53 pm

    Ransom might just have to be considered a business related expense these days, until such time as many of the systems are "sured up" for a quick fix, completely overhauled or replaced.

    The old story; IFF (Identify Friend or Foe), but in this day and age of IP address spoofs, node "air gaps" and imposters posing as legit requester's or clients, what is guaranteed, let alone considered foolproof?

    GCSB (using the Centre for Critical Infrastructure Protection unit) considered these attacks and other vulnerabilities many years ago, but knowing about something and publicizing it simply affords education to those they serve, not protection.

    Just the cost of an internet presence is what I see.

  8. infused 8
    2 September 2020 at 6:00 pm

    stop using consumer ssd's and smart will work properly.

  9. Ric Stacey 9
    2 September 2020 at 7:43 pm

    My ISP is Flip. No problems in the last hour. (7.40pm now)

    • Andre 9.1
      2 September 2020 at 8:04 pm

      I've had no problems today or yesterday. It was a few days back that Wordfence was doing the "computer says no" thing.

  10. sumsuch 10
    3 September 2020 at 1:02 am

    Sorry to hear, Lynn. They won't get by you. Other Left blogs, not so much.

The server will be getting hardware changes this evening starting at 10pm NZDT.
The site will be off line for some hours.