At about 5:00 PM MT on Friday, December 9, 2016, the server hosting simplifya.com was brutally attacked by unknown assailants in Amsterdam and France. WTF, man. We were able to identify the attack and respond within an hour, but our website and app were unavailable for approximately six hours.
Thankfully, the impact was small. We only had three clients at the time and none were in the system that evening. There’s no way of knowing how many legitimate prospects or partners might have tried to visit our website during that window, but nobody reported the outage to us. If any of the assailants are reading this, thank you for launching the attack after business hours and giving us the weekend to recover!
DDoS Ping Flood
In techno-speak, this attack is called a DDoS (pronounced dee-doss) Ping Flood.
- DDoS is short for Distributed Denial of Service. It was distributed in the sense that the attack was coordinated from several different locations – 10 computers in Amsterdam and France. The result of the attack is called “denial of service” because people trying to view our website or use our app during that time frame would have been denied service. In a browser, it looks like a timeout.
- A ping is a request for information. As a system admin, for example, I might ping a server to see what its IP address is. A ping flood is just what it sounds like, an overwhelming number of pings. The victim – our server – responds to the requests because that’s what it’s supposed to do, but there are so many requests that all available bandwidth is consumed. The server is literally too busy handling pings and can no longer respond to other legitimate requests.
DDoS Mitigation
I have emails showing that I asked the dev team for DDoS mitigation on November 15 and reiterating the need for it on December 5, just four days before the attack. Can you hear The Twilight Zone music playing? I don’t claim to be able to see the future – by coincidence, I just happened to read an article about how these attacks were on the rise and zipped an email off to the dev team!
We weren’t able to prioritize the work so we weren’t prepared for the attack. It was a good and relatively pain-free lesson. Since then, we’ve taken several steps to mitigate the risk.
- Our website and app are now on different servers. If one gets attacked, it will not impact the other.
- We no longer allow traffic from the IP addresses identified and will be subscribing to a list of other suspicious addresses that should be blocked.
- We’ve made some changes in our firewall, router, and servers to prevent such attacks from compromising service.
- We’ve implemented alerts that will immediately notify us of suspicious activity.
PS – Contrary to popular opinion, the attack did not come from Russia. It was natural to react that way as many recent attacks have been traced to IP addresses in Russia, but this attack was traced to Amsterdam and France.
PPS – Someone suggested it might have been our friend at Adherence. I guess I can’t prove that he didn’t hire some hackers in Amsterdam and France?!