how come there isn't already a census, technological debacle thread? | PUNT ROAD END | Richmond Tigers Forum
  • IMPORTANT // Please look after your loved ones, yourself and be kind to others. If you are feeling that the world is too hard to handle there is always help - I implore you not to hesitate in contacting one of these wonderful organisations Lifeline and Beyond Blue ... and I'm sure reaching out to our PRE community we will find a way to help. T.

how come there isn't already a census, technological debacle thread?

Yep, it's been a disaster. Website came back up at 4pm today but the ABS are gunna struggle to get 99% of the nation to complete it now.
 
Part of the politics thread I assume.

I'm not sure why they didn't geoblock from the start. Something like this is always going to become a target for script kiddies, rent-a-botnet. DDoS-as-a-Service types (the last two are in fact real)
 
absolute debacle

I know zero about computers, except how to write a word doc, surf the net, and put a bet on, but my friend who is a self-taught highly paid computer genius wrote this:

"A web based session queue consumes minimal compute resources, doesn't require personal information thus can go on public cloud where scaling is robust.
The back end at ABS doesn't get overloaded, because it would "pull" the requests in from the session pool at a rate it can handle.
It's not rocket science, but why didn't IBM think of this?."

Makes little sense to me, but knowing this fella, it sounds damning.

Then there is the privacy concerns, and then there logistical stupidity. Why now do one state or one region as a pilot?

Just seems like dumb piled on dumb. Bet they wish they stuck to the old forms now.
 
It wasn't a load related problem as much a DDoS from what I've read. The geoblocking failed which allowed the ddos to hit and hit hard. Bringing it down for so long was odd.
 
Baloo said:
It wasn't a load related problem as much a DDoS from what I've read. The geoblocking failed which allowed the ddos to hit and hit hard. Bringing it down for so long was odd.

IT security specialist on The Project today disputes that. He said they planned for internaitonal blocking but there was no blocking of Aust addresses and that the traffic they received trying to overload the website was within the limit that they should have been able to handle. It was just incompetence pure and simple.
 
IanG said:
IT security specialist on The Project today disputes that. He said they planned for internaitonal blocking but there was no blocking of Aust addresses and that the traffic they received trying to overload the website was within the limit that they should have been able to handle. It was just incompetence pure and simple.

The tech stuff I read seemed to put the blame on a failure of geo blocking. First 3 DDoS attempts they handled. Fourth got them.

Dunno
 
TigerForce said:
Technology will never beat manual. What a laughter this Census is.

About 95% of information based work that we used to do "manually" is now digitised and automated and this is increasing. Technology is not the problem here, implementation and execution is.
 
i don't understand half the stuff that's been written in this thread - wtf is DDos? dos with a stutter?

all i know is that my census went ok. my pen crashed early, but i had a back-up. easy
 
Having watched at close range as a large IT project ran off the rails recently (not guilty!), I did spare a thought for those in the hot seat. It's incredibly embarrassing for an application of this nature to fail. We'll probably never know the whole truth.

NB Was able to log on and complete the census just now.
 
larabee said:
i don't understand half the stuff that's been written in this thread - wtf is DDos? dos with a stutter?

all i know is that my census went ok. my pen crashed early, but i had a back-up. easy

DDoS - Distributed Denial of Service. Basically 100s if not 1000s of infected machines are remotely triggered to start bombarding a server, in this case the Census webite with so much traffic that it can't respond to any legit requests. Not really a hack, more a maliciously trouble maker than anything else though it can be used as a distraction to divert attention away from a attempted hack into a system.

But I reckon this was just bored geeks having some fun.
 
Baloo said:
DDoS - Distributed Denial of Service. Basically 100s if not 1000s of infected machines are remotely triggered to start bombarding a server, in this case the Census webite with so much traffic that it can't respond to any legit requests. Not really a hack, more a maliciously trouble maker than anything else though it can be used as a distraction to divert attention away from a attempted hack into a system.

But I reckon this was just bored geeks having some fun.
yep. A number of years ago i was involved with an organisation that engaged with hackers, in the IT security business. The overwhelming reason why they did it was because they could. It was about showing that they were better hackers than someone else.
Hacking has moved on a bit since then to be sometimes about politics and even industrial and cross country espionage but the idea that it was just for fun or ego is not fanciful at all.
 
antman said:
About 95% of information based work that we used to do "manually" is now digitised and automated and this is increasing. Technology is not the problem here, implementation and execution is.

Imagine when we don't use keys anymore and have to press a button to start every car. What happens if it doesn't start? ;D
 
TigerForce said:
Imagine when we don't use keys anymore and have to press a button to start every car. What happens if it doesn't start? ;D

Uber
 
Baloo said:
But I reckon this was just bored geeks having some fun.

Don't ever mess with 'Anonymous', now the Galactic Empire is going to know the names and addresses of thousands of Jediist in Australia!
 
TigerForce said:
Imagine when we don't use keys anymore and have to press a button to start every car. What happens if it doesn't start? ;D

Imagine when we don't use a crank lever to start cars, and have to use a key to start every car. What happens when it doesn't start? ;D
 
antman said:
Imagine when we don't use a crank lever to start cars, and have to use a key to start every car. What happens when it doesn't start? ;D

Does the button spark the plug like a key does? Dunno. :hihi
 
Anyway, back to the actual thing...

What I've been told about #censusfail
High level sources say...
By Patrick Gray Start the discussion 0 Comments
August 11, 2016 --
I have been able to cobble together the following by talking to my sources. Sorry this post is so brief, but I'm still trying to get this week's show out and I'm massively under the pump. So here it is: Set your faces to stunned.

IBM and the ABS were offered DDoS prevention services from their upstream provider, NextGen Networks, and said they didn't need it.
Their plan was to just ask NextGen to geoblock all traffic outside of Australia in the event of an attack.
This plan was activated when there was a small-scale attack against the census website.
Unfortunately another attack hit them from inside Australia. This was a straight up DNS reflection attack with a bit of ICMP thrown in for good measure. It filled up their firewall's state tables. Their solution was to reboot their firewall, which was operating in a pair.
They hadn't synced the ruleset when they rebooted the firewall so the secondary was essentially operating as a very expensive paperweight. This resulted in a short outage.
Some time later IBM's monitoring equipment spat out some alerts that were interpreted by the people receiving them as data exfiltration. Already jittery from the DDoS disaster and wonky firewalls, they became convinced they'd been owned and the DDoS attack was a distraction to draw their focus away from the exfil.
They pulled the pin and ASD was called in.
The IBM alerts were false positives incorrectly characterising offshore-bound system information/logs as exfil.
ASD still needs to roll incident response before they can send the website live again. Even though it was false positives that triggered the investigation, there still needs to be an investigation.
At least IBM got to bump their margins up a bit by not paying for the DDoS prevention though... amirite?!

http://risky.biz/censusfail