Wikileaks moves to Amazon's cloud to evade massive DDoS

[PeaceNikki]

Source: Ars Technica

Controversial information disclosure site Wikileaks reportedly faced an intense distributed denial of service (DDoS) attack this morning. The site was temporarily disrupted by the onslaught, but is functioning again after migrating its services to Amazon's cloud.

Wikileaks recently published thousands of confidential diplomatic cables that were sent between the US State Department and embassies around the world. The leaked documents shed light on US intelligence gathering efforts and reveal sensitive information pertaining to US foreign relations. The disclosure of the cables has proved embarrassing for the US and a number of other governments.

It's possible that the DDoS against Wikileaks was orchestrated by a government in effort to retaliate against the leak and disrupt access to the documents. Prominent figures in the US government, including a congressman, are calling for an extreme response to the leak, arguing that Wikileaks should be treated as a terrorist organization. The group is clearly facing considerable pressure and close scrutiny as a result of the leak.

Wikileaks says that the DDoS was pummeling its servers at 10 gigabits per second, forcing its Swedish hosting provider to discontinue operation of the site. In order to continue operating smoothly, Wikileaks moved its site to Amazon's elastic cloud computing infrastructure. This will allow it to scale better in the face of massive DDoS attacks.

Read more: http://arstechnica.com/security/news/2010/11/wikileaks-moves-to-amazons-cloud-to-evade-massive-ddos.ars

[bemildred]

1. Well, the obvious solution to a Distributed Denial of Service attack is

a Distributed Provider of Service (DPOS) defense. So yeah. If you don't have bottlenecks or single points of failure, nobody can attack them.
:thumbsup:

[PeaceNikki]

2. I've had recent up close and personal exposure to these DDoS attacks so I find it all very

interesting.

[bemildred]

10. Well, it is worth remembering that everybody had permanent DDOS not so long ago.

And a lot of the planet still does. It's not an impressive hack, no matter how you do it.

[PeaceNikki]

12. The way they distribute it is impressive and often quite effective.

The hack itself doesn't have to be highly sophisticated to do damage.

[bemildred]

13. Can be.

That is relevant in this context, to why they won't be able to shut Wikileaks down, or the idea of it down, assuming as I do that they won't. You can make it as messy as you need to, a classic arms race. And I will be the first to admit that it takes skill and effort.

But good hacks do good. DDOS is just showing off, censorship, and there is no repairing that flaw.

[Pavulon]

19. DDOS is childish. Man in the middle

and compromising certificates with a disposable vm running in main memory of say a printer is elegant. Breaking EC2's (amazon app and web hosting) backend and skimming data is elegant.

Elegance is nice but combined with root level access to Core Routers (12816 class gear), Cache Engines, and telecom gear allows data to actually be changed in flight.

Like the Iranian nuclear scientist who is now inside out proves targeting technology is far more difficult than targeting the people involved or people they are concerned about.

[bemildred]

22. Well, I don't follow that shit, never have.

I think security on the web is an oxymoron, and always have. But yeah. I do remember reading about the printers, I think I mentioned it.

[bemildred]

26. Approximate translation:

Italics are mine.

DDOS is childish. Man in the middle (the sort of routing redirection alleged to have been done by the Chinese a few days ago) and compromising (encryption) certificates with a disposable vm (virtual machine) running in main memory of say a printer is elegant. Breaking EC2's (Elastic Computing Cloud's) (amazon app and web hosting) backend (non-web processing, whatever that might be) and skimming data is elegant.

Elegance is nice but combined with root level access to Core Routers (12816 class gear) (Fast Cisco network routers), Cache Engines and telecom gear allows data to be changed in flight. (This is about where you insert yourself into a transaction and lie to both parties while collecting information, doing evil etc.)

Like the Iranian scientist who is now inside out (dead) proves that targeting technology is far more difficult than targeting the people involved or the people they are concerned about.

I had to google a few things and infer a few things, but I think that's more of less right?

[Pavulon]

32. Yep, kids come in and break the dishes.

professionals leave everything untouched and no one knows anything even happened. Professionals would just wait and let the parties do their thing whole gathering info useful to deal with them legally (or illegally). Elegance is injecting minor variations into motor controllers to cause a centrifuge to fail. That is elegant because it accomplished what a bomb would do with no harm to people.

CALEA allows legal interception of both voice and data on networks.

The whole security logic always revolves around people. People can take a highly secure system and circumvent it by loaning out their ID badge and password.

[bemildred]

35. Social engineering has always been the gold standard in these things.

A couple questions:

1.) From what I read in Schneier, encryption certificates ought not be hackable by man in the middle attacks. I mean that's the whole idea. Is that wrong, and if it is wrong, how is it wrong? Am I just out of date? Are we assuming some social engineering? Quantum computers?

2.) Near as I can tell, Wikileaks is not about hacking as such, it just provides a place for leakers to send things, so it's not correct that either Amazon or Wikileaks have hacked the federal government. If Assange or Wikileaks gets it in the legal system, it will be about publishing classified stuff. So the only way hacking is relevant to Wikileaks (excluding Assange's past) is them being hacked by various parties they have pissed off. Right?

[Pavulon]

3. Break the API calls used by amazon to manage the workload

workload dies. Cloud compute has some interesting vulnerabilities. Kinda mainfraimish, rob the workload of resources and it will be sad.

[PeaceNikki]

4. It's amazing to watch the attacks evolve with the infrastructure changes made to fight them

and they do.

[liberation]

5. LOL...

... "break the API calls" You got no clue what you're talking about, do you?

[Name removed]

6. Deleted message

Message removed by moderator. Click here to review the message board rules.

[liberation]

25. Derp... derp.... derp....

All that noise and yet not a word on how you exactly "break the API calls."

LOL

[Pavulon]

30. How would you step in the middle of an encrypted conversation? How would you interrupt

the conversation. You can google CVEs for EC2 backend management.

I am not going to discuss how to commit a felony, you can look up how to make TATP or how to run a man in the middle, port based attacks, how to use wireshark, or cert hack on your own.

You dont even have to break into the conversation, all you have to do is interrupt the conversation across a range of ports.

Could be malformed packets, could be some published exploit, breaking the calls does not mean intercepting them, just making them time out.

Nothing in this post is not common knowledge, none of this construes intent on my part to encourage or commit a crime.

[sudopod]

34. Because if it's so easy, you'd think someone would do it and steal

an Amazon customer's online business database or something.

[Pavulon]

38. Different system, this is a hosting solution

and it is not easy and people do steal from e com sites every day.

[SirRevolutionary]

37. Ooooooooof, way to call your fellow DUer....

a fucking POON. You were referring to the plant, right??? Seriously Sgt Gunnery Hartman, are you just pissed because Julian didn't ask you out first? Explain in 50 words or less how your cloud definition floats in superiority to your competitor's clouds. Here's the catch though, don't sound stupid. Ready? GO!!

[SirRevolutionary]

8. See? It's a series of tubes...

break a tube and they all get flooded with crapteria. :popcorn:

[bemildred]

9. Do it.

:popcorn:

[Pavulon]

11. Thats a felony brotha.

I was careful not to post anything that could even come close to advocating hacking people who hacked the federal government..

[boppers]

14. Hack the gibson!

:rofl:

[bemildred]

15. Ah, so you are merely suggesting that it could be done.

No question about that.

[Pavulon]

16. I could post CVE's would that be over the line?

This is a well known vector and something most people who run in a distributed environment account for anyway. Breaking telemetry is nothing new to the "cloud". Fuck I hate that term, Julian should leak the name of the person who first used that in the last few years. Tired of hearing about it and someone should put an ass beating down on the Cisco/VMware/whichever powerpoint guru that dropped that term.

[bemildred]

17. People who are interested will find it.

It's not hard. No need for you to get involved. Changes all the time anyway.

I have always considered "cloud computing" to be marketing bullshit anyway.

[boppers]

18. That would be a beat down for Ramnath Chellappa

He adopted it from the existing cloud metaphor long used for used for the PSTN/POTS.

[Pavulon]

20. I fucking hate that term. First cloud machines, then cloud apps, cloud storage, now MS

is pitching cloud on stupid TV. I think it is actually illegal to make a powerpoint now without the term cloud included.

Its like, we have a fairly simple thing, but need to give it a stupid catchy name. I actually had someone give me a visio with "cloud" and the little cloud stencil, fucking made them put the infrastructure in.

[bemildred]

21. LOL.

:thumbsup:

[xor]

40. Clouds have always been used as an abstraction of systems

It's not really an incorrect usage of the word cloud. After all, whether you're using IaaS, PaaS, SaaS *cough* now those are marketing terms, aye? *cough* then you have many of the complexities hidden away from you, and you interface with it at well defined points that eliminate much of the human interaction needed.

[sudopod]

33. Oh wow you're such a leet hax0r. *eye roll* nt

[Pavulon]

39. No I get paid for my work, own a home,

and dont eat hot pockets while sitting in front of 4chan. Never claimed it was a "hack". Is it a hack if someone calls the water company in your name and has your water cut off?

Those hacks were always more interesting than some code based solution.

[sudopod]

66. This is my super-impressed face. :P nt

[KamaAina]

56. That's "l33t haX0r" to you.

:P

[jtuck004]

7. Hmmm... /\ /\

:popcorn:

This discussion could be interesting

[Earth_First]

23. Couldn't they just call Al Gore?

:rofl:

[BrightKnight]

24. Where are they getting the resources?

You don't usually setup and maintain something like that in your basement. They must be paying someone for infrastructure and services. If I ran a data center the last thing that I would want is very angry and highly funded intelligence agencies coming after me. That could be very very bad for business.

[bemildred]

27. Sounds like Amazon lets you do that.

It's an interesting question whether this will lead to changes in that policy.

[jtuck004]

36. You can read about it here...

http://aws.amazon.com/ec2/

[SnakeEyes]

28. A 'hacktivist"

has claimed responsibility for the DDoS.

I wonder if moved to Amazon's cloud makes them vulnerable to US laws

[Pavulon]

31. I am surprised amazon would host them.

their terms of use could be read as not allowing criminal activity.

[Ruperto31]

50. Me too.

But then, as Lenin said, the capitalists will sell us the rope we use to hang them.

[Kurska]

29. This will last all of five seconds.

Before Amazon kicks them off after the massive consumer backlash.

As hard as it may be to tell from the normal "Fuck yeah" echo chamber, most people don't like this guy or what he is doing. At least as far as Americans go.

[PeaceNikki]

42. Yeah, it's going to be interesting.

http://www.kirotv.com/news/25966400/detail.html

[xor]

41. I was wondering why they haven't switched to a service like EC2

They don't even have to put much thought into how to handle this. I believe AWS now has an autoscaling service that will start up new instances without you needing to write the code to do it. Using that and the elastic load balancing seems like it would give them high availability. Then again, I wonder how long Amazon will host it if they are under constant attack and when customers start complaining. :/

[Seedersandleechers]

43. Wikileaks is now hosted by Amazon after massive DDoS attack

Source: geek.com

When Wikileaks spilled thousands of confidential diplomatic cables to the world last week, they made themselves a few more enemies, not just in Washington, but in the capitols of many cities in the rest of the world. Retaliation came swiftly, not by way of a surgical execution squad, but rather by a massive DDOS (or distributed denial of service) attack, which through upwards of 10 gigabits per second at Wikileaks’ Swedish host.

That’s a lot of traffic, and it has all the hallmarks of a government-led attack. In fact, the DDoS attack on Wikileaks’ homepage was so massive in scope that it successfully knocked the leak site off of the Internet, and forcing the host to discontinue ioperation of the site.

You simply can’t keep a site like Wikileaks down for the count, though. Wikileaks is now back up, speedier than ever, thanks to Amazon.

Yep, Amazon is now hosting Wikileaks thanks to their Amazon’s incredible and elastic cloud-hosting service, S3.

Read more: http://www.geek.com/articles/news/wikileaks-is-now-hosted-by-amazon-after-massive-ddos-attack-2010121/

---

Don't know how reliable geek.com is. Does anyone?

[SkyDaddy7]

44. I think they are...Other sources are saying the same thing...

http://www.google.com/search?hl=en&source=hp&biw=942&bih=435&q=Wikileaks+is+now+hosted+by+Amazon+&btnG=Google+Search&rlz=1R2GGLL_enUS345&aq=f&aqi=&aql=f&oq=&gs_rfai=CBixKAnn2TO2tDYr0zQSil-XKDgAAAKoEBU_Q4GZk

[mike_c]

45. they might be reasonably reliable-- WL has moved to Amazon-- but...

...they sure don't proof read!

[florida08]

46. looks like the WSJ is running it

[NoodleyAppendage]

47. I will be buying a book today from Amazon to reward this behavior. Recommend others do too. n/t

J

[BrightKnight]

58. Amazon made the wrong decision and I will not do business with them.

There is nothing heroic about posting classified documents that put American lives and diplomatic missions at risk. This goes beyond any political or regional conflict and is simply treason or espionage.

I am in favor of Internet freedom but what Amazon is doing is irresponsible.

[intheflow]

59. Hope you haven't been shopping yet.

WikiLeaks Site Kicked Off Amazon Servers

[fatbuckel]

48. I wonder who is really behind the DDoS. Thats really massive to be just anyone.I could`nt do it.

That takes alot of computer. He should wikileak docs on who`s responsible.

[molly77]

49. fatbuckle

Do you think it is possible to know who is behind it?

I am barely computer literate. Sorry.

[PeaceNikki]

52. Yes. The FBI can drill into the source.

The attacked site won't be able to find out, but the FBI investigates these botnets.

[BrightKnight]

55. The FBI will be more interested in protecting National

security than any of Amazon's self inflicted hacking problems. Allowing Amazon to become a lightning rod for this kind of attack is a very bad security policy. It is not possible to defend against all treats. If I were hosting with Amazon now I would be worried and pissed off.

[PeaceNikki]

57. They have different people/divisions to handle these cyberattacks.

And they do take them seriously. I know from recent experience.

[ProudDad]

64. What if the FBI or CIA IS the source?

And I think it is...

[PeaceNikki]

65. lolz

[PeaceNikki]

51. Anyone can BUY the botnets to do this kind of thing- they're cheap, too.

That's all I will say about that.

[Pavulon]

60. not any more. amazon kicked thier asses right out..

they will now be hosted somewhere else.

[PeaceNikki]

61. Go look at their Twitter feed

http://twitter.com/#!/wikileaks

WikiLeaks
WikiLeaks servers at Amazon ousted. Free speech the land of the free--fine our $ are now spent to employ people in Europe.

WikiLeaks
If Amazon are so uncomfortable with the first amendment, they should get out of the business of selling books.


WikiLeaks
WikiLeaks is the first global Samizdat movement. The truth will surface even in the face of total annihilation.

Drama queen much?

[Pavulon]

62. Amazon does not want their systems

on the end of a targeted attack. Wikileaks breaks their terms of use anyway.

[PeaceNikki]

63. Totally understandable. I wouldn't, either.

[Name removed]

53. Deleted message

Message removed by moderator. Click here to review the message board rules.

[PeaceNikki]

54. It could be ANYONE. DDoS attacks are really common and really cheap to buy