Forum Moderators: buckworks
The first time I called, I got the credit department. They told me that all calls were accidentally routed to them. Did some hacker really get to them in two ways?
Is it typical that a ddos would last 5 days?
Why can't they give customers an IP address to use if their domain name is under attack?
Why can't they redirect their domain name if their IP is under attack?
I'm losing revenue along with everyone else.
The absence of ANY mention of the DOS In the press makes me question whether it's not true.
If computers are compromised it makes sense that the attacks would increase as more of the computers infected were turned on for "business use". Thus less traffic on weekends, but more on weekdays.
I'm disappointed there is no announcement of any sort. 2Checkout.com was very communicative in terms of sending out e-mail notices to customers the last time it happened to them.
At one point the attacks were overpowering 100MB of bandwidth. Anet has increased bandwidth to 1 gig and is working with vendors on new security.
2Checkout.com was very communicative in terms of sending out e-mail notices to customers the last time it happened to them.
2CO had a DDOS attack when I was with them and except for a 2 sentence blurb on the log-in page (which was not accessible till after the attacks) there was nothing. That attack came right during my largest advertising campaign of the summer... its hard enough to make money in the summer anyway. Don't want to turn this thread into a 2CO vs. Anet war, but you know where I stand, lol.
So, since our Verisign account basically stays open until the merchant tells them to close it, we've been able to use it this week as a backup. If Anet fails (status <> 200 lately) then try Verisign we've definitely saved some business by having two. I think this new code will just stay in place now.
Can't routers and firewalls detect garbage traffic versus legitimate credit card transaction traffic?
No, these sorts of attacks send what look like legitimate requests. The payment gateway has to process them to discover which are genuine and which are not. In an overload attack like this the requests come in faster than the gateway can accept/reject them, and the pipe clogs.
So, is this an issue of bandwidth? What if AuthorizeNet say were hosted with a giant web hosting service?
If it is coming from a compromised workstation, what then? Is the traffic banned indefinitely, or just for a period like say 15 minutes?
> the requests come in faster than the gateway can accept/reject themSo, is this an issue of bandwidth? What if AuthorizeNet say were hosted with a giant web hosting service?
Bandwidth is a part of it, but the gateway's computing power will limit throughput before bandwidth limits are reached. The gateway can add more computing power- lets say they use 1U servers at $4000/per, and each can handle a sustained 25 requests/second. But the DDOS attackers can get an additional 10,000 compromised zombie PCs to launch attacks for only $2,000*. Or free, if it was their worm that compromised the PCs in the first place.
The economics of these attacks make scaling a losing solution. Evasion and active blacklisting is the best bet.
Aside: if routers could detect which packets were valid credit card transactions, we wouldn't need credit card gateways. We'd just submit to our routers. :)
* source: USA Today 9/8/04
I just got notified by my shopping cart company http://www.salescart.com/pressrelease/press040921.htm ....I originally thought there was a problem with the cart.
I contacted VeriSign and they said their total downtime was 12 seconds last year? Of course I hate VeriSign....
[edited by: DaveAtIFG at 11:25 pm (utc) on Sep. 21, 2004]
[edit reason] DeLinked URL [/edit]
Found short blurb on NetCraft re: DDOS:
http://news.netcraft.com/archives/2004/09/20/ddos_attacks_target_authorizenet.html
[edited by: DaveAtIFG at 11:26 pm (utc) on Sep. 21, 2004]
[edit reason] DeLinked URL [/edit]
- no IP blocking going on
- nothing wrong and no merchants are experiencing problems "but you"
- no more intermittent outages
I beg to differ.
As of yesterday, attacks continued but on a lesser scale, and with diminishing frequency.
No site is immune to a DDoS attack, however the response preparedness is what's important. And these primarily "russian" extortion plots have been increasing in frequency this year. Where once their primary targets seemed to be online gaming sites, they now appear to be setting their sights on financial services sites.
Authorize.Net is not a particularly large company. Not to excuse them, but it takes a lot of money to get to the same security level as an E-Bay or a Microsoft. From what I've been told they are spending the bucks this week.
Most of the problem for my site this week has been the carousel of Ip addresses employed by ANet, since my server does not use a DNS pointer (although we opened up the possibilities). I 'm pleased to report that I've not seen any problems in the last 24 hours with connections.
Thanks for the IP addresses posted though. I seem to be up and running again. :-)
We are moving fast, however, to get Verisign incorporated.
