[Leica] LUG server was down but now back up

[Brian Reid]

On 2022-08-13 15:45, Frank Filippone via LUG wrote:
> I have
> always wondered.... what does a cyber attack actually look like? Just
> a whole bunch of  email traffic?  Order of magnitude, if that can be
> mentioned.....?

It depends on the goal of the cyberattack. Various goals include

  1. Disable the servers so they cannot do anything while the attack is 
happening
  2. Try to gain access to the server to steal information it contains
  3. Try to gain access to the server to install ransomware, which is a 
special case of
  4. Plant malware on the servers so that they will do harmful things to 
legitimate users
  5. Be annoying (you see this a lot in attacks from teenagers)
  6. Impress your friends (https://en.wikipedia.org/wiki/Counting_coup)

The recent attack against the LUG server was a mixture of 1 and 2.

To achieve goal 2, the attacker opens tens of thousands of windows and 
in each window makes robotic attempts at guessing login names and 
passwords. My servers record failed login attempts, and there is a 
steady background stream of about 1 failed login per second on every one 
of my servers. During an attack, you see maybe 100 failed login attempts 
per second. The server defenses can spot this and slow down their 
response times, waiting 10 or 20 seconds before saying "no". To achieve 
100 attempts per second you have to have a pool of hundreds of IP 
addresses from which you can do this. The goal of most computer viruses 
is to allow attackers to use the virus-infected computer's IP address to 
launch attacks.

To achieve goal 1 (usually called a Denial of Service attack, or DOS 
attack) the attacker needs to know about what's inside the server and do 
something that is known to use a lot of server-side resources.

Back in the days when telephone bells were actually mechanical bells, 
the sound made by a telephone bell was designed to be as annoying as 
possible so that people would answer the phone quickly. Initiating a 
telephone call used a huge amount of telco resources, but once the call 
had been connected, those resources were released. The principle of DOS 
attacks keys on a similar principle. Setting up a connection to a 
computer uses a lot of resources on that computer; once the connection 
is established, it is much more efficient.

To make a connection to a server computer, the client computer follows a 
"handshake" protocol. The client sends a request to the server. The 
server responds with a question. The client answers that question and 
makes another request. If the server accepts the request, it responds 
with a connection ID and the client can start talking. In normal 
operation this connection protocol takes a fraction of a second. But 
some internet services (e.g. from airplanes) are very slow, so servers 
usually wait 30 to 60 seconds for the expected response. While they 
wait, there is memory set aside on the server that holds information 
about what the client has asked for.

DOS attacks work by clients sending the first round of the connection 
handshake and then exiting. The server waits and waits for the client's 
followup response, which never comes. Only when the server gives up 
waiting does it release the resources that it had been holding in 
anticipation of the client's response. During a DOS attack it is not 
unusual to see 15,000 connection requests on the server, each waiting 
for the reply that will never come. This means there are 15,000 blocks 
of memory that is not usable for anything else.

Email is different, but is easer to defend against. There is a steady 
flow of inbound malicious email. Here is a link to a screen shot from 
the device I use to keep bad email out.

http://gallery.leica-users.org/v/bkreid/misc/Screen+Shot+2022-08-13+at+4_22_02+PM.png.html

It shows an average of 40k to 50k emails per day that were directed to 
my netblock but rejected. There are about 2,000 valid emails per day. 
All of the rest are unwanted and unwelcome.