The Thailand expat forum for Travel, Lifestyle and Fun.

Mid

Jul 25, 2008 (DVB)–The website run by the Oslo-based Democratic Voice of Burma radio and TV station has been hit by a persistent and severe Distributed Denial of Service attack rendering the site mostly inaccessible since 20 July 2008.

__________________
"Keeping quiet while monks and other peaceful protesters are murdered and jailed is not evidence of constructive engagement." - Arvind Ganesan, Human Rights Watch.

"I think...I think it's in my basement. Let me go upstairs and check" - M.C. Escher

dirtydog

Why isn't there server just blocking the attacking ips?

Ivor Biggun

Is that the same as why weren't there any torpedo nets when japan attacked PH ?

Mid

from the Rackspace blog :

The Dirty Work You Never See
by Tom Sands on April 11, 2008

A common problem across the Internet today is malicious activity. Things like: DDoS Attacks, botnets, IP hijacking, viruses, spyware, worms, and phishing make up just some of the things that we deal with on a daily basis.

From a Networking perspective one of the common things that we deal with is DDoS attacks. Basically, this is that act of someone’s website being targeted with the intent of taking it offline. DDoS attacks can come in many forms and vary in effectiveness, including: SYN floods, ICMP/UDP floods, amplification or reflective attacks, and bulk data to just name a few.

In my years here at Rackspace there has been a great deal of change in the methods and mentalities used to perform attacks, from spoofing IP’s and bulk data to try and just max out someone’s connectivity, to much more precise attacks against applications. Because of this, the detection of attacks can become a lot more complicated, where you are no longer just looking for large spikes in traffic, receiving threshold alerts with SNMP, or traffic anomalies via Netflow. Attacks today can be very small in size, slipping under the radar of some systems, and still be affective at crippling a website.

Rackspace’s internal systems provide alerting to over 200 anomalous events per week that require investigation. These events are detected both inbound and outbound of the Rackspace network. This gives Rackspace the ability to proactively detect and alert customers of events like: DDoS attacks, and compromised servers.

In addition to these internal alerts, Rackspace also participates in several industry security groups to receive additional notifications of anomalous and potentially malicious activity, and the coordination and communication of some DDoS activity. The combination of these tools and resources greatly improve the ability to detect and mitigate compromised servers and malicious activity within the Rackspace network in a very timely manner.

We pay great attention to running a safe and clean network for customers, and being a very Internet “friendly” hosting company.

rackspace.com

dirtydog

Every server suffers ddos attacks, you just block the ips, can't understand why rackspace doesn't do that, you don't let a ddos attack of 1gb a second to carry on for days.

Mid

Mizzima website under attack
Mizzima News Tuesday, 29 July 2008

New Delhi — The Burmese website of Mizzima News, a Burmese Independent News Agency based in New Delhi, has come under persistent and severe Distributed Denial of Services attack causing the website to become inaccessible since Sunday.

The DDoS attacks flood the communication channel of Mizzima's servers with data up to the extent that the site can no longer handle.

According the Mizzima's webmaster, a DDoS attack is an attempt to disable a website, by overwhelming the site with information requests so that it cannot respond to regular traffic.

Mizzima website received more than five Gigabytes of data in less than 15 minutes, many times more than it usually receive, said the webmaster adding that the enormous amount of information received is more than the site can handle.

While, technically, the origin of the attack is impossible to trace, Mizzima's friend, a technocrat who monitors the site, said the attack is clearly targeted.

He said, while this is not the first attempt, there had been plenty of attempts t intrusion from servers in China, Russia and Hungary. At least 30 servers are involved in the case of the attack on the Mizzima Burmese website, he added.

Mizzima News Agency, run by Burmese journalists, is an independent Burmese multi-media group focusing on Burma and related news and issues, and maintains four different websites – Mizzima.com, Mizzimaburmese.com, Mizzima.tv, mizzimaphoto.com.

Besides updated daily news both in English and Burmese, Mizzima also Podcast video stories on its mizzima.tv site, which are frequently picked up by other news organizations.

Both Mizzima's Burmese and English site normally attract an average of 10,000 to 15,000 unique visitors per day but the readership suddenly jumped to hundred thousands during the September protests in Burma last year and in the month of May and June 2008, following the killer Cyclone Nargis' hitting the country.

While it is difficult to determine who is behind the recent attack, with intrusion attempts coming from servers in China, Russia, Hungary, the Burmese military junta, which has several of its technocrats and engineers studying in these countries, could be behind the attack.

Burma's military rulers have banned Mizzima's sites in Burma and bypassing the government's internet filtering systems with the use of proxy and browsing the Mizzima's sites, if caught, could lead to users paying a heavy penalty.

Mizzima, however, is not the only Burmese news organization to have recently suffered such attacks. The Oslo based Democratic Voice of Burma's website also came under similar attack since July 20.

In a statement released on Friday, the DVB deputy executive director, Khin Maung Win said the attacker is trying to shut-down the DVB's site from the internet as the attack has been getting more severe and persistent over the last four days.

"And we are still under attack," said Khin Maung Win.

"Technically, it is of course difficult to say who is behind the attack. But we can easily say that Burmese government is behind this attack," Khin Maung Win said.

mizzima.com

...............................................


and I came across this also .................

Junta Approves Investment in Cyber City

Meanwhile, the Burmese military regime approved www.khitlunge.com.mm, a Web site launched by ITCS to spread government propaganda and counter media attacks by exiled Burmese media groups.

irrawaddy.org

zedhex

Because the IP's are not be consistent. One way of doing a DDoS is to get lots of slave machines to send requests to single server. That way the source IP's will be those of the host machines. This kind of attacks is done by spreading a virus which does not affect the host directly, but bombards the target with requests of various sorts. This is why it's call a Distributed DoS - the source IP's are distributed all over the net.

Mid

DVB hit by DDoS attack

The Democratic Voice of Burma website has again been hit by a severe Distributed Denial of Service attack, rendering it inaccessible since the morning of 17 September.

Access to the site may be sporadic over the next few days while the problem is being tackled.

A DDoS attack is a malicious attempt to disable a website, including by overwhelming the site with information requests so that it cannot respond to regular traffic.

DVB was targeted in a similar attack in July this year.

We are working to restore normal service as soon as possible and we thank our readers for their patience.

english.dvb.no


.................................................


Dear Irrawaddy readers

Mid

http://theirrawaddy.blogspot.com/

On Tuesday, we received reports that the Internet in Burma was running slowly, suggesting a concerted effort to prevent information from going in or out of the country.

Then on Wednesday, our colleagues and subscribers in the US, Japan and Malaysia notified our Thailand-based office that they were unable to access our Web site.

A few hours later, I-NET, the largest host server in Thailand, confirmed: “Your site has been under distributed denial-of-service (DDoS) attack since around 5pm.”

I-NET finally decided to shut down our server.

Singlehop, which hosts The Irrawaddy’s mirror site, explained: “Your server is under a major attack. Due to the size of the attack our network engineers had to null route the IP to negate it. When the attack has subsided we will remove the null route.”

Singlehop told us that the cyber attack was very sophisticated.

Currently, our Web site is disabled and we have been forced to launch our daily news in blogs. Fellow exiled news agencies Democratic Voice of Burma and New Era were also disabled.




theirrawaddy.blogspot.com

Free Image Hosting [xs.to]

Camel Toe

See what Toxic's soft loan gave to them?

Mid

The Generals Go Cyber?
SEPTEMBER 19, 2008
By AUNG ZAW

Burma's military junta has so successfully suppressed the media that Internet sites based outside the country are one of the few remaining sources of reliable news for Burmese people. Now it appears not even those sites are safe. Shortly before yesterday's anniversary of the 1988 pro-democracy uprising and last year's Buddhist-monk-led Saffron Revolution, the Web sites of my newspaper, The Irrawaddy, and other Burmese news portals came under cyber attack. I am not alone in believing that the junta is behind the attack, just as it was behind the shutdown of Internet access in Burma during last year's uprising.

On Tuesday, we received reports from our stringers and regular readers that Internet connections in Burma were running slowly. The number of these reports suggested a concerted effort to prevent information from going in or out of the country in the run-up to yesterday's important anniversary. The next day, our colleagues and subscribers in the United States, Japan and Malaysia notified our Thailand-based office that they were unable to access our Web site, www.irrawaddy.org.

A few hours later, inet, the largest Internet host server in Thailand and the primary host of our site, confirmed our site had been under a "distributed denial of service" attack since 5 p.m. that day. Someone had managed to freeze our site by bombarding us with so much traffic that our server couldn't cope. Inet finally decided to shut down our server.

The attackers also targeted our "mirror site," which handles overflow traffic whenever our primary host is unavailable. Singlehop, the server for our mirror site, told us the attack was forcing it to shut down our site, too. The company told us the attack had been "very sophisticated." The attacks on both our primary and our mirror sites are continuing.

Nor are we alone. Fellow exile news agencies Democratic Voice of Burma and New Era were also disabled in similar attacks. We have been forced to publish our daily news via a temporary blog we've created, theirrawaddy.blogspot.com.

The attack on our Web sites is persistent and believed to be manually launched from various locations, which according to our Web hosts means it's the work of a large group of hackers. Cyber criminals, widely dispersed around the globe, can be bought for as little as $500 a day. We've been able to trace one source of the current attack to a computer connecting to the Internet in the Netherlands. Burma may have local cyber criminals too. In recent years the regime has sent students -- mostly from the army -- to Russia for study that many believe includes training in cyber warfare.

As for the motive, that's not a mystery either. Exiled media groups like the journalists at The Irrawaddy, bloggers, reporters inside Burma and citizen journalists played major roles last September in highlighting the brutal suppression of the monks and their supporters in the streets of Rangoon. Live images, eyewitness reports, updates and photographs landed on our desks every few seconds.

Through us and others like us, the outside world was able to witness the terror of the Burmese regime on television and on the Internet. And so the military regime struck back. On Sept. 27 last year, all connections to the Internet inside Burma were closed down for four days as the authorities tried to conceal their crimes.

This latest act of apparent sabotage comes in a broader climate of Internet and media repression. In Burma, some Internet cafes require users to provide identification before logging on so the government can track Internet usage. In other cafes, informers observe students playing video games and Buddhist monks complain they are treated like criminals if they ask to use the Internet.

Meantime, reporters, editors and publishers based in Rangoon are under increasing pressure. Earlier this month, police apprehended a group of reporters and charged them with working for The Irrawaddy, though they were not. Our stringers say they are nervous, though fortunately they remain undetected. My friend, a foreign journalist who recently left Burma, said that the mood was very tense. "It is hard for our Burmese colleagues to report," she said. "But they are very brave."

In this increasing climate of fear where Internet users are frequently suspected of working for exiled media, people in Burma are naturally afraid to communicate. The Internet is one of the few remaining opportunities they have to do so, especially with the outside world.

Over the past 20 years, the battle between Burma's regime and pro-democratic forces has shifted from the streets to the jungle and now to the computer. The generals will not give in; rather, they will equip themselves and become more sophisticated. The attack on our site appears to be a sign of this trend.

However, the junta is mistaken if it thinks we will give up. We at The Irrawaddy have to build stronger firewalls and more effective systems to prevent future attacks. Ultimately, the flow of information is unstoppable.

The Burmese regime's cyber criminals cannot penetrate the strongest firewall of all -- the spirit of desire for change.

Mr. Aung Zaw is founder and editor of The Irrawaddy magazine.

online.wsj.com

Rattanaburi

By the bullet or the ballot they say. It's time that the generals and their families experience fear I say. They and their families shouldn't feel safe anywhere outside of their homes. That government is like the North Korean government; it will never give their people freedom. Violence looks like the only option for freedom there. Whoe would want to be a slave forever?

__________________
Less people on the planet is the solution to all problems.

Mid

a call that is getting noticeably louder ..........

Mid

Burma junta launches 'crippling' cyber attack
By Ed Cropley in Bangkok
September 19, 2008

snip

The DVB attacks, which also started on Wednesday, appeared to come from sites in Russia and China, Toe Zaw Latt said, corroborating reports of the junta getting internet training from Beijing and Moscow, its main diplomatic backers.

The internet inside Burma had also been running even slower than its normal snail's pace this week and internet cafes had come under unusually tight surveillance, the Irrawaddy said, suggesting junta unease at the protest anniversary.

Security was also tight on the streets of Rangoon, with some vehicle checkpoints, one diplomat said.

The protests started in August 2007 with small demonstrations against declining living standards, but soon sucked in the revered Buddhist monkhood and snowballed into the biggest challenge to military rule since a 1988 uprising.

Most the organisers of the initial marches, members of the "88 Generation Students" who survived the brutally crushed 1988 revolt, were arrested a year ago and have been behind bars ever since.

As such, any repeat outbreak of dissent looks extremely unlikely. Other underground democracy activists were keeping their powder dry for a general election slated for 2010 and could not afford to get arrested, Toe Zaw Latt said.

"They have to keep their strength for bigger events," he said.

news.com.au


Russia and China .............

.

Mid

The Irrawaddy Hopes to Defeat the Hackers Soon
By SAW YAN NAING
Friday, September 19, 2008

The online news service of The Irrawaddy remained paralyzed by a cyber attack on Friday, although technicians expressed optimism that it would be back in operation by Monday.

Three other Burmese exile news operations that also fell victim to the attack restored their services on Friday, leading to hope that The Irrawaddy Web site would also soon be again accessible.

The attack knocked out The Irrawaddy service on Tuesday and also struck the Oslo-based Democratic Voice of Burma and the New Era Journal, based in Bangkok. All were intermittently put out of action.

The three opposition news services, operated by Burmese exiles, were hit by a “distributed denial-of-service”, or DDoS.

A DDoS attack creates a “traffic jam” at the entry to a Web site as masses of fake, robot “visitors” try to access it.

INET, the second largest host server in Thailand, confirmed that The Irrawaddy Web site, www.irrawaddy.org, had been disabled by a DDoS attack since September 17, the day before the 20th anniversary of the mass anti-government demonstrations in Rangoon on September 18.

The CAT Telecom Public Co. Ltd and some ISPs blocked The Irrawaddy Web site as a “danger zone.”

One consultant, who requested anonymity, said: “Usually, it only impacts the targeted Web site, but it is possible that Internet infrastructure will be affected on a wider scale when many Web sites are under attack at the same time on the same national network.”

The Irrawaddy’s “mirror site,” The Irrawaddy News Magazine [Covering Burma and Southeast Asia], was also disabled by DDoS.

Rangoon visitors to The Irrawaddy Web site reported on Friday that they could access it by setting new proxy servers.

A DDoS attack is orchestrated by an aggressor hiring a hacker who claims the power to control thousands of PCs around the world with the ability of using them to attack a Web site. Fees for the services of the hacker vary according to the size and duration of the attack, but usually start at around US $500, according to one technician.

Win Thu, The Irrawaddy’s office manager, who also oversees its technical team, said the attack that struck the company’s Web site appeared to have been targeted by such a hacker. The nature of DDoS made it likely that the attack would be limited in duration, he said.

Aye Chan Naing, DVB’s chief editor, said his organization received several phone calls and anonymous e-mails two months ago, claiming cyber attackers were Burmese technicians who had trained in Russia.

“The Burmese authorities want to block the flow of information to the outside world,” he said. “But I don’t think they can do it for a long time.”

Exiled media groups, bloggers, reporters inside Burma and citizen journalists played major roles in the reporting on the Buddhist monk-led uprising in September 2007, highlighting the brutal suppression of the monks and their supporters in the streets of Rangoon.

Recently, the regime has tightened its watch over Internet cafes in Rangoon. In some Internet cafes, users have to show their ID, while informers observe students playing video games. Buddhist monks complain that they are treated like criminals if they are seen using the Internet.

irrawaddymedia.com

Mid

Web Sites Back Online, but Fears of Further Attacks Remain
By MIN LWIN
Monday, September 22, 2008

The online version of The Irrawaddy and other Web sites run by Burmese exiles are back in operation after being hit last Tuesday by “distributed denial-of-service,” or DDoS, attacks that jammed the sites with fake traffic.

Attacks on the Irrawaddy Web site stopped on Friday evening, according to office manager Win Thu, who supervised efforts to restore service. A mirror site, The Irrawaddy News Magazine [Covering Burma and Southeast Asia], has been available since Saturday evening, and the main site, The Irrawaddy News Magazine [Covering Burma and Southeast Asia], went back online on Monday. He added that additional mirror sites would be created as a measure to deal with any future attacks.

“I am not sure if another attack will hit our site or not,” he said. “If the Burmese military government has well-trained computer technicians, the exiled media may be targeted again, because it doesn’t cost very much to carry out such attacks.”

At least two other exiled media Web sites were affected by last week’s attacks. The Oslo-based Democratic Voice of Burma and Khit Pyaing (The New Era Journal), based in Bangkok, have both been restored to full service.

This is the second time that The Irrawaddy’s Web site has been hit by a cyber attack since it was established in 2000.

The first time occurred almost exactly one year ago, when a Trojan virus infected the site at the height of monk-led protests against military rule in Burma in September 2007. The Irrawaddy Web site reported extensively on the demonstrations and posted numerous images and videos provided by so-called “citizen journalists” inside the country.

Like last year’s attack, the latest attempt to shut down exiled media Web sites was accompanied by a slowdown of Internet service inside Burma.

According to Internet café owners and users in Rangoon, Internet speeds have slowed down considerably since last week, making it impossible to upload large files such as photos or videos. There were also reports of connections stopping and restarting every ten minutes or so on Friday and Saturday.

Sources in Rangoon have also reported increased surveillance of Internet cafes. The owner of one Internet café in downtown Rangoon said that local authorities and police intelligence officers had issued orders to provide Internet users’ ID information.

“The authorities ordered us to register user ID numbers, addresses and phone numbers,” he said.

Internet cafes are also required to send each user’s Web history to the state-run Internet service provider (ISP) Myanmar Info-tech every two weeks. They are also instructed to automatically capture screenshots showing users’ online activities every five minutes.

Despite the tightening of restrictions on access to the Internet, the Burmese regime has recently moved to expand Internet service in the country.

Hanthawaddy National Gateway, Burma’s newest ISP, was launched in July and is expected to become the largest in the country, according to a senior member of the Myanmar Computer Professionals Association.

The new ISP will provide access to subscribers in every state and division except Rangoon Division, but at present is only available to military officials, he added.

Hanthawaddy National Gateway received technical assistance from Alcatel Shanghai Bell Company, which is represented in Burma by Tay Za, one of the country’s wealthiest businessmen and a close associate of senior leaders of the ruling junta.

The source said that Hanthawaddy National Gateway is to be linked to the Yadanabon teleport in Mandalay and also to a regional ISP in Hong Kong.

Burma currently has three ISPs—the state-run Myanmar Posts and Telecommunications (MPT), which operates Myanmar Info-tech; the semi-government-owned Myanmar Teleport (formerly Bagan Net); and Hanthawaddy National Gateway.

irrawaddy.org

Mid