Search OutlookPower's 9,088 Outlook and all-things-email article archive 
Home
EasyPrint
News details Click here for the RSS feed's XML code. This is not a browser URL.
Articles-only Click here for the RSS feed's XML code. This is not a browser URL.
Twitter Feed Click here for the Twitter feed.
FROM THE EDITOR-IN-CHIEF
Incident report: denial of service attack against ConnectedPhotographer.com
By David Gewirtz

You may have noticed that Connected Photographer has been offline for the past few days. It's back, and what happened makes for quite a story.

About two months ago, I noticed increased traffic on our Web sites -- and the traffic was causing a load on the servers that didn't seem to be right. In particular, I noticed that our email-to-a-friend page was getting accessed repeatedly, at a rate disproportionate to what regular traffic would generate. I reasoned that a spammer was using the page to send junk mail out through our email-to-a-friend interface, and promptly turned that page off.

"A million individual computers hit our servers in the space of a day."

Traffic was one or two accesses a minute from different IP addresses, all over the world. I traced IP addresses to Russia, Brazil, UK, Turkey, Korea, Ukraine, Australia, Canada. There were also a bunch of IPs that wouldn't give up their real locations.

Current incident
Beginning Tuesday night, performance of our Web servers began to degrade. It took me until Thursday morning to determine that the performance degradation was due to an increase in traffic to a particular set of Web pages. This was, in part, because the server was performing so slowly that accessing any information took a very long time.

Eventually, I was able to determine that the email-to-a-friend page (which no longer existed) was being requested for our Connected Photographer Web site. Each request caused a server error, slowing the system down. Unfortunately, there was no way to stop the server errors, since the code that generated them was compiled into the server's kernel.

Yes, I have access to the kernel code and have added features in the past, but I didn't want to muck with code at such a low level while trying to sustain our level of quality service. It would have just taken too much time.

Through the use of a software firewall, I was able to determine that requests to the email-to-a-friend URL were comining into the server at the rate of thousands of requests per second. I configured the software firewall to ban requests to this particular page, and then ban the IP addresses that originated the request.

However, within about ten minutes, the software firewall ceased to function. It had banned more than 10,000 individual IP addresses, (about 1,000 per minute), exceeded its available memory, and pushed the server to 100% utilization.

I tried re-routing and even turning off the DNS pointing to the server. The requests still kept coming in. My guess is that the URL they were requesting was cached, and so the spamming system knew the IP address, ignoring the DNS completely.


1  ·  2  ·  Next »
Other articles you might like
Home > Online Safety (55 articles)
   Exploring the dark side of social networks
   Watch your back: avoid becoming a victim of holiday scams
   Security alert: don't install Flash or Acrobat from Web sites
Home > Extras > Editorials (26 articles)
   Say goodbye to the Uh-Ohs. Long live the Tens.
   Analysis: Microsoft's plan to open the PST format
   How to ask for help (if you ever expect to get any)
Get Weekly Email Updates
Subscribe to our regular weekly email newsletter. It's packed with tips, reviews, deep analysis, and the latest news.
 
Recent OutlookPower Articles
More about disappearing text
Removing an Office installation that doesn't want to go away
Using Office on more than one computer
How to fall back in love with your email
Where'd my To-Do Bar go?
Running auto-respond rules when Outlook is closed
Running rules when Outlook is closed
OutlookPower News Center
Typemock Launches Test Lint - for Unit Tests in Visual Studio 2010
AvePoint's DocAve Replicator SharePoint 2010 Beta
Microsoft's IE9 Browser: FAQ
Is Microsoft About to Declare Patent War on Linux?
Anti-virus suites still can't block Google China attack
Microsoft pushing Silverlight 4 for Windows Phone development
Zeus malware now has Windows-like piracy protection
>> Read all the news
More from the ZATZ journals
Computing Unplugged: The iPad defenders have spoken
David Gewirtz Online: CNN commentary and analysis
DominoPower: Application development, William Shatner, and the origin of the universe
-- Advertisement --

EASY DEDICATED AND VIRTUAL DEDICATED SERVERS FOR AS LOW AS $67.99 PER MONTH
Customize and configure your own dedicated server. Simply choose one of our popular plans or select your own Linux or Windows server and plan options.

NO LONG WAITS. Server provisioned within hours.

Tap here now and be up and running with your own server tonight.

-- Advertisement --

Personalized Emails Are Opened More
Create and send personalized, individually addressed copies of the same email to as many people as you want...using our easy Wizard Interface inside Outlook.

EmailMerge will help you make more sales. Send Personalized Business Emails, Holiday Greeting and Invites. EmailMerge will help you reach your customers, family, and friends in more personal and effective way. Supports Outlooks Contacts, Excel and Access files, delayed batch sending, multiple accounts and more within its easy to use Wizard interface.

Tap here to download a fully-functional 30-day trial.

ZATZ Home  ·  News  ·  Back Issues  ·  Credits/Trademarks ·  Link To Us
The Power Magazine for Microsoft Outlook and Exchange Users at OutlookPower.com
Copyright © 1998-2010, ZATZ Publishing. All rights reserved worldwide.
Outlook is a trademark of Microsoft Corporation.
Editor's Login