stardot ORG slow and sometimes not working

[vanekp]

The site is extremely slow today and has thrown up a SQL error a few time for me is there a problem with the site?

stardotorg.jpg

[paulb]

The site is extremely slow today and has thrown up a SQL error a few time for me is there a problem with the site?

I noticed this as well, and it isn't a network problem at my end. Maybe the server is being worked a bit hard for some reason.

[tricky]

I couldn't even get on at 7 this morning.

[Rob_hawk]

Snap same challenge early today and again this evening.

[BigEd]

I think there's some flood of connections coming in... seeing this counter keep going up, lots of anonymous sessions:

In total there are 297 users online :: 11 registered, 0 hidden and 286 guests (based on users active over the past 5 minutes)
Most users ever online was 1036 on Sun Nov 01, 2020 4:48 pm

and a minute later

In total there are 341 users online :: 11 registered, 0 hidden and 330 guests (based on users active over the past 5 minutes)

[danielj]

The wonderful people at netnorth have, at least for now, fixed things. It is an external issue though

[BigEd]

Hurrah! Perhaps all those anon users were frustrated stardotters refreshing their pages, or something. That user count has calmed down now, anyway.

[vanekp]

seems to be behaving itself now, its once again responsive when you click something, no 5 min waiting

[danielj]

DDOS.

[vanekp]

Yes that did cross my mind as well, as it sometimes was fine and other times was totally dead.

[daveejhitchins]

I'm still having issues - 21:15 . . .

Dave H.

[BeebMaster]

Yes, it's still happening for me here, same problems as have already been reported. Also I noticed (because as part of my unswerving policy to make life as difficult as possible for myself, and thereby never using bookmarks or anything like that, I always manually type the URL of any website I want to visit, but my brain hasn't updated to using the new URL for the forum yet, so I still ask for www.stairwaytohell.com/forums) that when it redirects to the correct site, Firefox gives me the old "secure site not available" http/https thing, which you then have to override, which it didn't do before today.

[BeebMaster]

DDOS.

Oh, the Opus one? ADFS would be quicker.

[tricky]

Still very slow here, just in case you haven't noticed !

[danielj]

I can absolutely guarantee that by the time someone reads it in this thread they'll have already noticed that it's slow.

It's external, it's not anything we can directly do anything about other than request the hosts investigate and block the offending IPs. We are doing this.

@beebmaster - I'm afraid you're either going to have to remember the forum address or just live with it. Or use bookmarks. It will be the redirect pointing at an http site. I've no control over that.

[1024MAK]

Also I noticed (because as part of my unswerving policy to make life as difficult as possible for myself, and thereby never using bookmarks or anything like that, I always manually type the URL of any website I want to visit, but my brain hasn't updated to using the new URL for the forum yet, so I still ask for www.stairwaytohell.com/forums) that when it redirects to the correct site, Firefox gives me the old "secure site not available" http/https thing, which you then have to override, which it didn't do before today.

Just search for “StarDot forum”, it’s the first result normally…

Mark

[BeebMaster]

Well, interestingly, I did it again just now, and I didn't get the "insecure" screen from Firefox, it went straight to the forum. So in that respect, something has "improved".

[sweh]

Well, interestingly, I did it again just now, and I didn't get the "insecure" screen from Firefox, it went straight to the forum. So in that respect, something has "improved".

My guess is that during the attack you entered a "bare" URL (without http or https prefix), so firefox attempted to auto-upgrade to https, but that took too long 'cos of the attack, and so firefox considered that a failure and printed the warning telling you it was going to the insecure http site instead.

[Kweepa]

DDOS.

We need to strike back!

[MartinB]

…attack…

attack…?

Sounds dramatic to us non-internet savvy types…?

[sweh]

Yes, attack.

DDoS means "Distributed Denial of Service". It's a pretty self descriptive phrase. For a website suffering under a DDoS it means someone is trying to stop the web server from serving pages.

Typically this is done via resource starvation; send more requests to a website than it can handle. Now the site is spending all of its time trying to respond to the bad requests and has no time to handle real user requests. This sounds like the sort of stuff we saw here (based on what people have said and the high "guest" numbers).

Another sort of DDoS is to try and use up all the network bandwidth. This is normally overkill, especially for small sites like ours, but may be done on major sites (e.g. megabanks).

In the cyber security industry (where I work) we call this activity an attack because it is a deliberate action to prevent the correct and normal running of a service. It's literally an attack on the service availability.

Now the "distributed" nature of a DDoS is normally achieved by using a "bot army". These are typically compromised machines; they could be other compromised web servers or (more frequently) compromised desktops. There's a lot of Windows malware that exists solely to "recruit" desktops into bot armies. The desktop owner doesn't even know it's happened! The malware just listens for instructions sent from a C3 (aka CCC - Command and Control Center) and performs actions accordingly.

It's really cheap as well; if you know where to look you can hire small bot networks for a few dollars. A site like ours wouldn't need a large bot army. And because armies can change IP addresses (just change what compromised machines are used to do the attack) it's a whack-a-mole defense; as soon as you block the existing bad IPs a new set pop-up.

(There are commercial offerings that are smarter than just IP blocking; this is also an area where AI/ML is showing some worth in identifying attack patterns and blocking before the traffic even gets to the server).

Bot armies are used for more than DDoS attacks. If you've received email spam recently then it's probably been sent via a bot. And anyone who runs a webserver and looks at the logs will definitely see bots being used to run automated probes (no, I don't run Wordpress you dumb bot; you'll never find a WP vulnerability on my machine!).

I just don't know why someone decided to attack this forum. Odd.

[danielj]

Also attacked the Exxos forum by the looks of things. Seemed to be run from Amazon Web Services. Very odd.

Deep seated hatred of retrocomputers?

Edit:
I think it's a general attack on phpbb forums:
https://forums.raspberrypi.com/viewtopic.php?t=349000

[sweh]

Hmm. I've asked at https://www.phpbb.com/community/viewtopic.php?t=2638941 (but my post is awaiting moderation since I'm a new user there). I linked to this thread and the rPi thread.

[lovebug]

I had ddos issues on my website, I have no idea why anyone would target my crappy website

so I linked it up with cloudflare (free) which has a ddos protection mode and everything has been fine since
maybe it could help here too ?

[1024MAK]

I think it's a general attack on phpbb forums:
https://forums.raspberrypi.com/viewtopic.php?t=349000

Hmm, well I’ve not had problems with the other “retro” computer phpbb forums that I regularly visit.

Mark

[MartinB]

Thanks for the explanations. I saw Daniel write just ‘DDOS’ and Ian’s reply - I genuinely thought it was some kind of retro-related ‘in’ joke and that he was referring to our familiar DDOS mnemonic. Not everyone on here is necessarily a general computing technology ninja….

[sweh]

Hmm. I've asked at https://www.phpbb.com/community/viewtopic.php?t=2638941 (but my post is awaiting moderation since I'm a new user there). I linked to this thread and the rPi thread.

And, apparently, that was enough to get my account deleted. Ummm... OK?

[BigEd]

just possibly they have rules about posting links to forums? Who knows...

[BigEd]

Seemed to be run from Amazon Web Services. Very odd.

Someone with a bit of cash and a grudge... is there any reason why it would be counterproductive to block great swathes of AWS address space? I can't quite think why legitimate access would come from a cloud service. (I don't like broad bans - sometimes people under attack ban whole countries, but that seems wrong to me. AWS is not a country!)

[danielj]

Someone with a bit of cash and a grudge... is there any reason why it would be counterproductive to block great swathes of AWS address space? I can't quite think why legitimate access would come from a cloud service. (I don't like broad bans - sometimes people under attack ban whole countries, but that seems wrong to me. AWS is not a country!)

Lots of PHPBB instances have suffered as far as I know. Some speculation it's a badly written search engine bot. The relevant user agent was barred and that seems to have shut it up.