BOTS go to Gre'thor

[cleverwise]

Hello Community,

BotF was hit again with a major bot attack. I actually happened to see it in underway in real time. However...

Their efforts were not ready for my counter measures. I have since hardered the server even more and tweaked the database to use BTREE in key spots.

In addition I altered the removal of guest sessions to one minute from ten minutes. Thus you may notice faster drops in the guest sessions. For active human guest users this is no issue as a new session id is simply issued. For logged in users this matters not at all.

Anyway the attack fell off a cliff and the server went from 100% CPU to 0 to 15% as it danced around. So take that BOTS!

If they become a problem after this I will deploy a nuclear option that is in my back pocket.

So #(@*! BOTS do we go nuclear?!!!!!!!!!!!

BRING IT ON!

[thunderchero]

nice job, send them all to Gre'thor. they have no honor.

I also noticed a little slow down, it took 5 sec before page would load before I went to bed last night, and unwanted "guests" were up to 10,000. But at that time CPU usage was only 40%.

I have also noticed a higher presence on armada side here lately.

[cleverwise]

I do need to watch the armada board. So far the issues for the server have been with BOTF.

Of course now here they come. Gre'thor get ready.

[cleverwise]

Well nuclear option deployed.

The server should now handle massive spikes with a minimum 10x performance but that is the ultra low end. It is probably more like 30 to 60x. The new caching system can easily handle 100,000 session requests per second on the low end and up to 1,800,000 per second on the high end. Granted that is just session data.

Over all the system should now scale 10x to 50x.

So there is that.

[Flocke]

Crazy fight you have there with all these bots! And a big thanks for your quick emergency handling!

At that scale Id say it clearly becomes a massive attack and not just advertisement spam. So lets hope this "nuclear option" now fixes all the forum down times and put an end to what troubles we had by the many bots.

What about the armada forums? Did you upgrade them as well? Is there any further tweaks you have in thought?
This "nuclear option" sounded like it comes with a compromise. Does the caching affect regular forum user experience?

[cleverwise]

Crazy fight you have there with all these bots! And a big thanks for your quick emergency handling!

At that scale Id say it clearly becomes a massive attack and not just advertisement spam. So lets hope this "nuclear option" now fixes all the forum down times and put an end to what troubles we had by the many bots.

Yes they are massive denial of service type of attacks and really they are distributed so DDOS. There is really no way to block IPs because it is not like one or two or ten IPs is sending hundreds or thousands of requests. No it is more like 30,000 different IPs sending one or two. So again it makes filtering much harder because it is fairly easy to block an IP that is making dozens or hundreds of a requests a second or minute.

These bot networks and honestly many are probably compromised infected human devices like smartphones, routers (a classic - no consumer grade is secure unless you run DD-WRT or the like - go read white papers), "smart" TVs, etc. Most people don't think about or even attempt security much get it right. Anyway most of these bot networks are malicious all around trying to hacking into systems, overwhelm systems, and spread malware or adware.

So yes these networks are a major Internet issue.

What about the armada forums? Did you upgrade them as well? Is there any further tweaks you have in thought?

Yes the Armada forum is using the same upgraded technology stack. Also yes there are additional tweaks but I just deployed a rather large shield.

This "nuclear option" sounded like it comes with a compromise. Does the caching affect regular forum user experience?

Yes it does... complexity. Yes it will effect regular forum usage by keeping bots at bay... at least that is the idea. As for logging in and using the forum there is no change. It is all behind the scenes server tech. Users will not see any difference.

[Flocke]

Yeah, all this smart tech people buy barely is secured and also soon looses updates for all kind of security breaches. In addition companies try to protocol all little telemetry they can. And people happily accept any contract notes when for the moment they have some fancy new device and don't need to care on the many complex details that come with it.

If the Silicon Valley was placed in Germany, I bet we had many more regulations on all kind of technical aspects. But here as well, people love to buy new fancy tech stuff. And where we have no industry, there is little regulations.

Thanks again for clarification!

[cleverwise]

Yeah, all this smart tech people buy barely is secured and also soon looses updates for all kind of security breaches. In addition companies try to protocol all little telemetry they can. And people happily accept any contract notes when for the moment they have some fancy new device and don't need to care on the many complex details that come with it.

We have discussed this several times but so true. Unfortunately very few companies have IPSEC. They also release very few updates for most devices and even when they do updating is a huge hassle for many devices. Companies worldwide generally don't want support questions so they usually just turn everything on and make connections as easy as possible. But that comes with huge security holes.

The average user doesn't know or even care if told about any of this techno babble... at least until they get hacked. People download apps on the their phones and never read the permissions giving access to their pictures, call logs, files, SMS, etc.

Heck most governments and companies can not get their employees and users to stop clicking on random links which is just basic IPSEC.

In fairness not all the bots are end user devices but many are, still you have insecure websites, servers, business nodes, and malicious doers own equipment. So I am not here saying it is all on average persons. Still a huge bulk are end users via TVs, routers, smartphones, IP cameras, etc, etc, etc.

If the Silicon Valley was placed in Germany, I bet we had many more regulations on all kind of technical aspects. But here as well, people love to buy new fancy tech stuff. And where we have no industry, there is little regulations.

That maybe but companies worldwide and governments worldwide are data hungry including in Germany. It might be a little less but it would not stop a lot of it. The bottom line is people want power the world over and information is power. Human nature is human nature no matter where you pin an industry or people on a map.