E
Baloo said:It wasn't a load related problem as much a DDoS from what I've read. The geoblocking failed which allowed the ddos to hit and hit hard. Bringing it down for so long was odd.
IanG said:IT security specialist on The Project today disputes that. He said they planned for internaitonal blocking but there was no blocking of Aust addresses and that the traffic they received trying to overload the website was within the limit that they should have been able to handle. It was just incompetence pure and simple.
TigerForce said:Technology will never beat manual. What a laughter this Census is.
larabee said:i don't understand half the stuff that's been written in this thread - wtf is DDos? dos with a stutter?
all i know is that my census went ok. my pen crashed early, but i had a back-up. easy
yep. A number of years ago i was involved with an organisation that engaged with hackers, in the IT security business. The overwhelming reason why they did it was because they could. It was about showing that they were better hackers than someone else.Baloo said:DDoS - Distributed Denial of Service. Basically 100s if not 1000s of infected machines are remotely triggered to start bombarding a server, in this case the Census webite with so much traffic that it can't respond to any legit requests. Not really a hack, more a maliciously trouble maker than anything else though it can be used as a distraction to divert attention away from a attempted hack into a system.
But I reckon this was just bored geeks having some fun.
antman said:About 95% of information based work that we used to do "manually" is now digitised and automated and this is increasing. Technology is not the problem here, implementation and execution is.
TigerForce said:Imagine when we don't use keys anymore and have to press a button to start every car. What happens if it doesn't start? ;D
Baloo said:But I reckon this was just bored geeks having some fun.
TigerForce said:Imagine when we don't use keys anymore and have to press a button to start every car. What happens if it doesn't start? ;D
antman said:Imagine when we don't use a crank lever to start cars, and have to use a key to start every car. What happens when it doesn't start? ;D
What I've been told about #censusfail
High level sources say...
By Patrick Gray Start the discussion 0 Comments
August 11, 2016 --
I have been able to cobble together the following by talking to my sources. Sorry this post is so brief, but I'm still trying to get this week's show out and I'm massively under the pump. So here it is: Set your faces to stunned.
IBM and the ABS were offered DDoS prevention services from their upstream provider, NextGen Networks, and said they didn't need it.
Their plan was to just ask NextGen to geoblock all traffic outside of Australia in the event of an attack.
This plan was activated when there was a small-scale attack against the census website.
Unfortunately another attack hit them from inside Australia. This was a straight up DNS reflection attack with a bit of ICMP thrown in for good measure. It filled up their firewall's state tables. Their solution was to reboot their firewall, which was operating in a pair.
They hadn't synced the ruleset when they rebooted the firewall so the secondary was essentially operating as a very expensive paperweight. This resulted in a short outage.
Some time later IBM's monitoring equipment spat out some alerts that were interpreted by the people receiving them as data exfiltration. Already jittery from the DDoS disaster and wonky firewalls, they became convinced they'd been owned and the DDoS attack was a distraction to draw their focus away from the exfil.
They pulled the pin and ASD was called in.
The IBM alerts were false positives incorrectly characterising offshore-bound system information/logs as exfil.
ASD still needs to roll incident response before they can send the website live again. Even though it was false positives that triggered the investigation, there still needs to be an investigation.
At least IBM got to bump their margins up a bit by not paying for the DDoS prevention though... amirite?!