The background traffic is loud.

16 comments on “The background traffic is loud. ”

• Comments are now closed

1. Andre 1

   2 September 2020 at 8:50 am

   Huh. It never occurred to me the reason Wordfence was giving me the single-finger 403 salute might be because I'm with Flip. I just figured it was a side effect of other issues that seemed to be happening at the same time.
2. greywarshark 2

   2 September 2020 at 11:05 am

   We know that there has been a permanent underclass caused by free market, neolib economic practices called the precariat. The whole society has by wholeheartedly adopting tech that has no heart and putting vast amount of our communications and transactions on-line, opened us up to interference from any malefactor or grifter in the world leaving us in a vulnerability that has made our very living precarious.
   • Jum 2.1

     2 September 2020 at 11:13 am

     We also know this is happening just before an election and the particular targets have been chosen carefully.
3. Jum 3

   2 September 2020 at 11:12 am

   collins' shadow portfolio national security and intelligence. brownlee's shadow portfolios GCSB, NZSIS, Covid 19 border response

   do collins/brownlee sit in at all national security meetings?
4. RedBaronCV 4

   2 September 2020 at 11:33 am

   Excuse my ignorance but is it likely these attacks are coordinated or all from the one source? Do they want anything from NZ as a whole? Are they likely to be a practice run for ahem a similar attack on another country? While everyone is busy trying to shut this down is something else being sneaked in through a back door.? Is there a possibility of a commercial imperative – drive everyone onto cloud servers so that the attacks can be repelled by more bandwidth.
   • lprent 4.1

     2 September 2020 at 12:01 pm

     Not particularly coordinated as far as I can see. Looks like a series of different criminal extortion groups trying their luck.

     I suspect that their ‘normal’ targets in other countries like the US and Europe are getting harder due to past experiences. So they’re expanding out to other countries. Basically there are a pile of compromised systems out there that can be hired as botnets from the malware controllers. So they get hired and target prospects.

     In the case of The Standard, every 3 years as part of the election cycle we get a significiant increase in human traffic. This attracts bots and people who’d like to compromise a higher traffic site or who’d like us to put up posts linking to or extolling their services. A third of my visible email comes from them. Since I throw them to the heuristic anti-spam systems for dispersion to the wider email world. I eventually don’t see them any more. My spam folder is rife with them until their score gets high enough and they just get rejected before the email arrives.

     This year, there appear to be a lot robotic emails and systems more than usual even in the election season. Probably because of the longer election period. Possibly because there are more botnets available. The worst I have seen so far is about 104 individual systems attempting brute force logins in a 5 minute period. They get three tries and then they are ignored for an hour. If they persist then they’re tagged as a threat and blocked for days or months. Same for systems trying various wordpress exploits.

     Plus of course the usual spiders from google, bing, baidu, and at least a few hundred more website scrapers are busy scuttling over the site more often because there are more comments.

     It is a bit noisy at present.
   • Stuart Munro 4.2

     2 September 2020 at 12:09 pm

     This year has seen a substantial increase in attacks, which seem to have rolled through a number of countries, of which NZ appears to be the latest. Some large corporations, notably Amazon, have also been targeted.

     It is likely a loose group of attackers, perhaps somewhat like the Macedonian youtubers, but such groups may well be assisted or directed at some level by a state actor.
5. Draco T Bastard 5

   2 September 2020 at 12:59 pm

   Does anyone know of a computer readable and accessible list that can be read – I’d add that to the daily tasks.

   Open Visual Trace Route seems to have such a list. Probably made up of one or more of the licences included in the package such as:

   • Network API : Jpcap (GNU LGPL, http://netresearch.ics.uci.edu/kfujii/Jpcap/doc/index.html)
   • Network API : JNetPcap (GNU LGPL, http://jnetpcap.com/)
   • Ip to city mapping Database : This product includes GeoLite data created by MaxMind, available from http://maxmind.com/
   • Ip to city mapping API : MaxMind (GNU LGPL, http://www.maxmind.com/app/city#api)
   • lprent 5.1

     2 September 2020 at 1:28 pm

     The easiest way is for me to load the NZ IP ranges directly into wordfence.

     I thought of MaxMind. But their country DB is USD 24 per shot or per month. And it is for the whole world.

     I'll have a look at the others once I'm outside corporate firewalls.

     The best one I have seen so far is https://lite.ip2location.com/database-ip-country

     It is a bit annoying that wordfence has a blacklist for countries and it has a global blacklist IP list.

     But it doesn't have a whitelist for countries that overrides the blacklist for IPs. So the only only real way to have the blacklist IPs, but let the whole of the NZ IP list (ie >90% of our human readers) through is to put the whole list of NZ IP ranges into the wordfence list.

     grumble
6. gsays 6

   2 September 2020 at 1:09 pm

   I have heard from a few people now, that part of the problem the NZX has been facing, is a lack of band with. Both at the business level and nationally.

   The analogy is the 'pipe' size coming into NZ is not big enough.

   So… does an answer lie in bigger 'plumbing'? Or can our internet come thru the air/space/satelite?
   • lprent 6.1

     2 September 2020 at 1:31 pm

     They only hit a terabit per second 🙁

     https://www.stuff.co.nz/business/122636582/gcsb-examining-extortion-email-sent-to-nzx-ahead-of-ddos-attack

     It is understood that attackers at one point deluged NZX with more than a terabit a second (Tbps) of spurious data.

     That makes the DDoS attack one of the most intense on record, globally.

     The biggest reported DDoS attack in history peaked at 2.3Tbps on a customer of Amazon Web Services in February, which the United States cloud computing giant successfully defended.

     The attacks in New Zealand appear to be part of a global DDoS campaign first threatened by a group posing as Russian cyber espionage group Fancy Bear in October last year.

     But Little believed the attacks were financially motivated rather than the work of a “state actor”.

     It is a lot on one organisation – but not that much.

     https://en.wikipedia.org/wiki/Internet_in_New_Zealand#International_connections

     We’re getting on about 80Tb/sec for the whole country international links potential capacity.
7. karol121 7

   2 September 2020 at 4:53 pm

   Ransom might just have to be considered a business related expense these days, until such time as many of the systems are "sured up" for a quick fix, completely overhauled or replaced.

   The old story; IFF (Identify Friend or Foe), but in this day and age of IP address spoofs, node "air gaps" and imposters posing as legit requester's or clients, what is guaranteed, let alone considered foolproof?

   GCSB (using the Centre for Critical Infrastructure Protection unit) considered these attacks and other vulnerabilities many years ago, but knowing about something and publicizing it simply affords education to those they serve, not protection.

   Just the cost of an internet presence is what I see.
8. infused 8

   2 September 2020 at 6:00 pm

   stop using consumer ssd's and smart will work properly.
9. Ric Stacey 9

   2 September 2020 at 7:43 pm

   My ISP is Flip. No problems in the last hour. (7.40pm now)
   • Andre 9.1

     2 September 2020 at 8:04 pm

     I've had no problems today or yesterday. It was a few days back that Wordfence was doing the "computer says no" thing.
10. sumsuch 10

    3 September 2020 at 1:02 am

    Sorry to hear, Lynn. They won't get by you. Other Left blogs, not so much.

• Comments are now closed

• Log in
• Donate
• Contribute post

• Articles RSS