What's Up With ProtonMail Outages? (bleepingcomputer.com) 88
ProtonMail, a secure email service provider used by more than two million users and references of which has been made in shows like Mr. Robot, has been facing outages for the last two days as it fights numerous DDoS attacks. "The attacks went on for several hours, although the outages were far more brief, usually several minutes at a time with the longest outage on the order of 10 minutes," a ProtonMail spokesperson told BleepingComputer, adding that it has tracked the attack to a group that claims to have ties to Russia. But things are more complicated than that, and it appears ProtonMail users, who are already annoyed at the frequent outages over the last few days, are up for more such downtimes in the coming days. BleepingComputer: But in reality, the DDoS attacks have no ties to Russia, weren't even planned to in the first place, and the group behind the attacks denounced being Russian, to begin with. Responsible for the attacks is a hacker group named Apophis Squad. In a private conversation with Bleeping Computer today, one of the group's members detailed yesterday's chain of events. The Apophis member says they targeted ProtonMail at random while testing a beta version of a DDoS booter service the group is developing and preparing to launch.
The group didn't cite any reason outside "testing" for the initial and uncalled for attack on ProtonMail, which they later revealed to have been a 200 Gbps SSDP flood, according to one of their tweets. "After we sent the first attack, we downed it for 60 seconds," an Apophis Squad member told us. He said the group didn't intend to harass ProtonMail all day yesterday or today but decided to do so after ProtonMail's CTO, Bart Butler, responded to one of their tweets calling the group "clowns."
This was a questionable response on the part of the ProtonMail CTO, as it set the hackers against his company even more. "So we then downed them for a few hours," the Apophis Squad said. Subsequent attacks included a whopping TCP-SYN flood estimated at 500 Gbps, as claimed by the group.
The group didn't cite any reason outside "testing" for the initial and uncalled for attack on ProtonMail, which they later revealed to have been a 200 Gbps SSDP flood, according to one of their tweets. "After we sent the first attack, we downed it for 60 seconds," an Apophis Squad member told us. He said the group didn't intend to harass ProtonMail all day yesterday or today but decided to do so after ProtonMail's CTO, Bart Butler, responded to one of their tweets calling the group "clowns."
This was a questionable response on the part of the ProtonMail CTO, as it set the hackers against his company even more. "So we then downed them for a few hours," the Apophis Squad said. Subsequent attacks included a whopping TCP-SYN flood estimated at 500 Gbps, as claimed by the group.
Not clowns (Score:5, Insightful)
Not clowns. Assholes is the proper term.
Re:Get medieval... (Score:4, Funny)
Re: (Score:1)
I see (Score:5, Interesting)
The group didn't cite any reason outside "testing" for the initial and uncalled for attack on ProtonMail
As opposed to, er, "called for" (justified?) attacks?
He said the group didn't intend to harass ProtonMail all day yesterday or today but decided to do so after ProtonMail's CTO, Bart Butler, responded to one of their tweets calling the group "clowns."
Oh. Well then. That's perfectly reasonable then ...
They are a bunch of clowns. Or paid by GMail ...
Re: (Score:1)
There's also the issue of taking admitted criminals at their word.
Given that the gross majority of for-profit cyber crime operations are Eastern European, Russian, or Russian state affiliated (Or all of the above) it's not a bad assumption either.
Thugs feel righteous (Score:1)
Yeah, such as on the Trump's administration officials [dailywire.com]...
Re: (Score:2)
Wondering whether they have anything to do with Slack being DOA world wide for a good part of yesterday?
Re: (Score:2)
The group didn't cite any reason outside "testing" for the initial and uncalled for attack on ProtonMail
As opposed to, er, "called for" (justified?) attacks?
As opposed to paid-for attacks, which is what their system is intended to be used for.
So they act like APK (Score:5, Interesting)
Little short bursts, and then when someone does anything they perceive as a slight, constant shitstorm until they autistic-fit themselves to exhaustion.
Amusing. I wonder what they'd have done had the CTO called them fags instead.
And only a mere 200 Gbit? That's child's play, I've got an easy order of magnitude more bandwidth than that just on my remote office servers alone.
Betting none of them are over the age of 25, otherwise they'd know where to get real bandwidth.
Re: (Score:3)
What are you using for the physical layer? I call BS on your 2 Tbps claim. I manage 100 Mbps connections to Level 3, Wave, and Verizon, and we're paying over $1k per month each for a connection 20,000 slower than your ridiculous claim.
Re: (Score:3)
No, but I've seen OC-768 equipment owned by AT&T in a datacenter which is huge, but still less than 40 Gbps. Still waiting on the answer as to how to get a 2 Tbps connection that was claimed. Even OC-3840, which I last I heard isn't being deployed yet, is still only 1/10 of the claimed speed.
Re: (Score:2)
Your answer was provided.
And so you know what equipment is used - https://i.imgur.com/wZ0cjjt.pn... [imgur.com] in each and every location I have servers.
Come back when you actually do real global networking, boss. You're about 15 years behind me.
Re: (Score:2)
" remote office servers"
I mean, if you can't even think that particular statement through, you shouldn't even be in IT, son.
As in, GLOBAL REMOTE. When you run a remote virtual office company, you need fucking BANDWIDTH, son.
Re: (Score:2)
Where can you get this magical order of a magnitude greater than 200 Gbps connection you claim? I'm in one of the largest exchange points on the west coast, and they're just now rolling out 100 Gbps ethernet.
You could have 20 100 Gbps links. That would give you 2Tbps.
Worse than clowns (Score:3, Insightful)
I hope every member of this group that is identified has his balls ripped off.
Re: (Score:2)
Ovaries perform the comparable function in ladies.
Free advertising for hacker group (Score:2)
Great, all this does is provide advertising for people that will want to contract for their "new and improved" DDoS service.. Nice.
Internet infrastructure is retarded (Score:3)
As an owner of an IP I should be able to tell a service provider to simply cut off traffic from given IPs on his network (or his entire network if they don't do effective ingress/egress filtering). Start up internet 2 with a less retarded infrastructure already, this shit got ridiculous 20 years ago and the fact that we haven't even attempted to fix it is just insane.
Re:Internet infrastructure is retarded (Score:4)
The problem is scale. It's not just a couple machines doing this... It's thousands or 10s of thousands of machines that are usually spread across entire countries or multiple countries. And those machines don't even do sustained traffic anymore. Maybe 20% of them will do The Thing(tm), then they'll go quiet and another batch will start doing The Thing(tm).
That's why DDOS' ard so hard to mitigate against.
Re: (Score:2)
It's not like they can afford to only send a single packet per compromised device, there are still limits to their pool. They each send hundreds of thousands of packets in an attack, if you can detect an IP as an attacker after say a 100 packets and push a rule to their provider which blocks them for a couple of days it will put a huge crimp on the potential.
Also you can create IP blacklists and ISP blacklists (for the ones with no ingress/egress filtering) similar to the email blacklists. Being attacked, j
Re: (Score:2)
In other words, you want to set up an official, institutionalized DDOS?
I mean, what's the prevent a bad actor from pushing this list to providers which will cut off people for days, with no oversight?
Re: (Score:2)
PKI based proof of ownership of the IP.
Re: (Score:2)
PS. I should add that if it were not clear, you only block traffic from the suspected attacker's IP to the attacked IP. You don't cut them off the internet, you cut them off from the ability of reaching you. That's why it has to happen at the originator ISP, you can't do it at your own firewall and if you tried to do this even at the backbone level the wire speed and the required sizes of the lookup tables make it all far too expensive. If it happens at the originater's ISPs the resources required are minim
Re: (Score:2)
Firewalls don't help unless they are way upstream, that's my point ... as the owner of an IP I should be able to put up a firewall upstream, preferably all the way at the ISP of the attacker (or blocking an entire ISP at the backbone level if the ISP is a known attacker which doesn't bother with ingress/egress filtering).
Message to Apophis Squad (Score:1)
You guys fucking suck!
Signed,
totally the real Microsoft CEO, I swear on his life.
What's up with ProtonMail outages? (Score:1)
And what's the deal with airplane peanuts?
Impressive numbers (Score:3)
And the thing is, what goes around, comes around. Eventually.
Sorry, we got the wrong target (Score:2)
http://www.nydailynews.com/new-york/ny-metro-teen-murdered-in-bronx-nypd-explorer-20180623-story.html
Clowns? (Score:2)
Re: (Score:3)
Calling these guys clowns are an insult to clowns. This group needs jail time and a ban from the internet.
So do clowns. Ick Yuck Scary.
Let alone dealing with Pennywise, who keeps trying to get us to float.
Re: (Score:2)
I've gotten to the point where people like this simply need to be removed from society. This isn't an accident or something they didn't know they shouldn't do. They know perfectly well what they're trying to accomplish.
This goes for all criminals at this point in time. It's not as if the rules of society aren't known. One can't claim they didn't know they shouldn't rob/rape/murder/steal from someone. These basic rules weren't enabled yesterday.
And yes, this is a r
Total American Dude (Score:5, Funny)
I'm not sure which language this was translated to English from, but my guess is Russian.
Re: (Score:1)
His Whollyness doesn't care for the fact the the American people were lied to and manipulated by corrupt politicians who sold themselves out to a foreign power, in order to achieve that vote. And I don't, either.
But the truth is coming out as more of their activities and connections are being brought out and exposed under the bright light of day.
#TICKTOCK
Re: (Score:2)
Well, yeah--that's sort of the *point*, genius.
Re: (Score:2)
Butt-hurt script-kiddy detected.
Re: (Score:2)
Exactly. "Hacker culture" means something completely different.
Will someone please find these people (Score:2)
and beat them to within an inch of their lives?
Do not trash talk in Local (Score:2)