[Leica] LUG server was down but now back up

[Brian Reid]

Most cyberattacks are not targeted at specific organizations. Some are, 
of course, but for the most part, cyberattackers just pick IP addresses 
at random and start blasting at them to see what happens.

In the case of the LUG, it's somewhat nonrandom. The LUG server 
leica-users.org is at IP address 199.5.253.5. This is part of the 
netblock 199.5.253.0/24, which has 255 addresses in it (199.5.253.0 
through 199.5.253.254). I own that netblock.

The LUG server is in a data center in Fremont, California (Hurricane 
Electric FMT2), which also houses thousands of other organizations and 
hundreds of thousands of servers. That data center normally charges 
$800/month for a cabinet that has room for about 30 or 40 servers. 
Because I was able to structure my cabinet to look like it belongs to an 
ISP, they let me have it free. To look like an ISP, you must meet 
certain requirements for netblock ownership, fiber capacity, router 
behavior, and traffic volume. When data centers compete for business, 
they brag about how many ISPs are hosted there, and my "looks a lot like 
an ISP" counts as one of them because the only way you might discover it 
is not a real ISP is to look deeply inside its customer base. (Or read 
this message, I suppose. I think I probably ought to delete it from the 
archives after a few weeks).

LUG things occupy 3 of the 255 IP addresses in that netblock. 
LargeFormatPhotography.info occupies another one.

Another major user of my IP address block is the Church of England and 
numerous Anglican dioceses and provinces around the world. 20 years ago 
my servers hosted about half of the Anglican websites in the world, but 
there are now good ISPs in every country and any Anglican/Episcopal 
group that can afford it has moved off my servers into one in their own 
country. This leaves my servers hosting mostly church provinces in 
third-world countries, plus some very visible Church of England stuff 
that remains on my servers because they want to.

Last week the every-10-years Lambeth Conference wrapped up in 
Canterbury, England. Every Anglican/Episcopal bishop in the world was 
invited to it, and about 1200 of them attended. Mostly what they did was 
fight bitterly about gender and sexuality. Third-world bishops are 
passionately opposed to any variant sexuality, and think that anyone who 
doesn't share their view is possessed by Satan. Bishops from the first 
world are more concerned about climate, hunger, war, and refugees and 
are quite weary of arguing about sexuality.

The big cyberattack came 5 days after the end of the Lambeth Conference. 
My theory is that some group from the "if you don't execute homosexuals 
in your country then you are possessed by the devil" camp noticed that a 
number of their enemies had IP addresses in my netblock and paid a 
cyberattack company to pound on the whole netblock. In countries that 
border Ukraine there are a lot of commercial cyberattack companies that 
charge a few thousand Euros per hour to attack anyone you would like. 
This one was in Belarus. The actual addresses used by the 
Anglican/Episcopal groups are 199.5.253.8 through .14, but that level of 
detail is lost on brute-force cyberattackers.

During a cyberattack there is so much malicious traffic that servers 
often give up and shut themselves down. That is what my servers did. 
Like Monty Python's commercial argument service, when the paid time is 
up the attackers turned it off.


On 2022-08-12 20:47, Frank F via LUG wrote:
> When the lowly, small, and insignificant LUG is the target of a foreign
> cyber attack, I think the world baddies have lost their expectations in
> world domination.
> Attackers, get your priorities in order.
> We are not the FBI, we have no connections to nukes, we not have the 
> keys
> to Fort Knox.
> Get a life!
> 
> On Fri, Aug 12, 2022 at 8:20 AM Brian Reid <reid at mejac.carlsbad.ca.us>
> wrote:
> 
>> The LUG server experienced a massive cyberattack from somewhere in 
>> West
>> Asia (perhaps Belarus or Moldova) and was offline for several hours. I
>> was not able to deflect the attack, but the attackers eventually got
>> bored and went to attack someone else. It is now working again.
>> 
>> _______________________________________________
>> Leica Users Group.
>> See http://leica-users.org/mailman/listinfo/lug for more information
>>