Internet Archive is suffering from a DDoS attack
twitter.com
twitter.com
Naturally their own donate page is offline right now, but you can donate yourself via check or wait for the site to come back.
Internet Archive 300 Funston Avenue San Francisco, CA 94118
TIN: 94-3242767
https://archive.org/donate/ http://archive.is/UBX0Z#selection-2697.1-2701.24
Maintaining an open and freedom-loving service in the face of abuses is incredibly hard. It's an incredible disgrace how badly these attackers have misunderstood their targeting.
[1] https://twitter.com/AttackNodes/status/743170229426094080
If Archive.org deletes it, it will simply be uploaded elsewhere. You cannot prevent uploads internet-wide. It's simply not possible.
And why are you even trying to remove it at all? Why are you not investing effort into educating people on why it is propaganda, and why it is false? Your real problem isn't that the materials exist, it's that people believe them!
With these two problems combined, it's not that hard to understand that by removing the materials, you lose your chance at actual damage control. You just push it deeper into the darker corners of the internet, where you have no ability to educate users at all, and where you completely lose control over it.
Why have people still not learned this?
There is a certain group of things that should be hard to share (not to mention illegal, but execution videos and calls to kill infidels are already illegal to share), and archive makes it easier to share.
You can and should educate people, of course, but you should make the propaganda (again, all the war videos, all the execution videos, all the cut heads and shot disbelievers) harder to get.
The widely shared IS propaganda has been cited as a factor why ISIS is so popular lately. Why so many people are radicalising. The lenient approach archive.org is having to this is helping them and they have big role in destabilizing the current world, if only indirectly.
Yes they are deleting some of the videos but don't delete copies that are uploaded seconds later with the same names. YouTube and others are much more proactive with deleting jihadi propaganda. Archive.org is jihadi youtube.
I don't like it personally. But yeah DDoS is not the solution I guess
If ISIS recruiting materials shouldn't be hosted, then neither should military recruiting materials from any other nation or political group.
Of course, the real solution here is to not try to police political speech on the internet and let people decide what they believe for themselves. If people are deciding to join ISIS, our job is to communicate why we think ISIS is wrong, not to subject the internet to moral censorship.
You are completely missing the point, and just repeating what you said before.
EDIT:
> The widely shared IS propaganda has been cited as a factor why ISIS is so popular lately. Why so many people are radicalising. The lenient approach archive.org is having to this is helping them and they have big role in destabilizing the current world, if only indirectly.
This is horseshit. As I've already said, the problem isn't that the propaganda exists. It's that people unquestioningly believe it.
I'm sure that it "has been cited as a factor", because that's a far easier way to look like you're dealing with the problem, than to actually try and solve it. That doesn't make it correct in the slightest.
Source and in what jurisdiction(s)?
Well that does align with ISIL modus operandi.
[1]: http://archiveteam.org/index.php?title=INTERNETARCHIVE.BAK
I wish I had the money to host some tens of terabytes for this effort, it's a great idea.
Definitely something to think about down the road, but in the meantime there are plenty of public datasets to back up.
That means building DDoS protection into the nature of the web and all hosting by default (AWS and GCS I'm looking at you), and that means actively prosecuting DDoS attackers.
That also means, if you're a cloud DDoS provider, not helping to protect the sites where these attacks are marketed.
It's not easy to go after them, but neither is it easy to go after CP peddlers, and yet we still go after them and arrests are made. It's one part of a many-faceted strategy that will be needed to get some control over a problem that is clearly getting worse.
No, you'd have to build it into the nature of the internet, specifically into all the users of insecure machines and all the builders of core routers. One good thing that could be done is to have an organized response to any DDOS and to make it so easy to trigger this response that victims will lose very little in terms of downtime.
Commercial responses to DDOS (CloudFlare for instance) are useful, but only as a stop-gap measure, essentially the fact that there is a business opportunity here documents a huge flaw in the way the internet currently works.
Remember that hosting providers are as much (or even more) on the receiving end of these (for instance: when a customer of a hosting provider gets DDOS'd all the other customers will suffer too), and signaling they are part of the problem is akin to victim blaming.
It is victim blaming when people tell you it's your fault you're getting DDoSed because you can't afford several thousand dollar DDoS mitigation, it is victim blaming when someone's server simply gets null routed because they're being attacked, and it is victim blaming is when AWS hands Greatfire a crazy bandwidth bill because China attacked them.
Their site has some details: https://www.ovh.co.uk/anti-ddos/analysis.xml
Even if it didn't, they're at least trying. That's a much better policy than burying your head in the sand and pretending this doesn't exist like AWS and GCS do. Seriously, try to figure out what their policies are on DDoS, they don't even mention it anywhere.
Their active ignorance on this issue combined with their astronomical egress prices make them dangerous to use for public facing web sites of any serious caliber, as I've stressed multiple times on HN. I'd consider using them for behind-the-scenes stuff, but for front-facing sites? What's going to happen to your site when you get a 100GBit attack? Are you going to get charged for the bandwidth? Is your site going to get null routed? Zero information provided. Good luck.
It's also not something you can disable; it's mandatory, so as to not impact other customers. I (my employer) use AWS pretty heavily, and we've never noticed our ability to access our resources being impaired by a DDOS on other nodes, so... is it not rather obvious that AWS (and in general, the set of "cloud providers without constant outages on their status pages") have basically the same setup - network is rationed, a given resource will only be allowed so much of the pipe, and your service is unavailable until and unless you have the capacity to handle it. It's not as if it could be any other way.
The other danger seems to be in unexpected bills. Does this happen to people? Are there companies going bankrupt because they didn't notice a DDOS for a couple weeks? I've had AWS support reach out to me several times - without ever having had a paid support subscription - when my costs have gone up, just in the course of adding new functionality and expanding capacity. It's not like you set up one instance and can start egressing petabytes.
AWS does monitor their infrastructure. All accounts have limits from the get-go; you can't run up a bankruptcy-inducing bill without your phone ringing. And in all cases, your exposure below that level is rather directly under your control.
If I happen to have a use case that involves a bunch of random hosts sending me a lot of data, I expect to be able to pay the bill for the bandwidth and the capacity I provisioned to handle it. Or, if I didn't, I max out the bandwidth reserved for my resources and I don't end up seeing all the traffic. I don't see why it'd be helpful (or even meaningful) to differentiate between DDOS vs. legitimate traffic. Wouldn't a published policy on any cost or functionality difference when a DDOS is occurring provide a malicious actor with information they would need to avoid triggering that clause, so as to maximize the damage they're able to cause to your business?
I guess I'll likely change my tune if and when I'm targeted and have to deal with a DDOS (and this sentence is why i went to the throwaway, which is a shame; I'd be happy to put my name to the actual content of this post. But fate is not to be tempted.). In the meantime, though, I'm skeptical of the need, and even the desirability, of service-provider policies that have anything to do classifying the "nature" of traffic flows. It just seems completely out-of-scope for them, and in-scope for myself as the person doing the provisioning.
ISIS uses archive.org almost exclusively for sharing their propaganda videos (all the executions, war videos, etc.). It's not the web archive they are using for this, it's the video archives.
I am not sure why are they doing that; probably because the barrier for using it is low and they don't delete the ISIS propaganda so much as other websites (like youtube).
Other website jihadists love to use is justpaste.it for text
But attacking the IA is so wrong on so many ways it's appalling.
With companies like Sucuri and CloudFlare providing it at $20 per month, seems a non-brainer.
The importance of the Internet Archive is such that we can not allow it to ever go down.
thanks,
Every traffic passes through so many hops, routers and networks that adding a secure, well tested and privacy-paranoid provider, like CloudFlare will not affect the privacy or integrity of your connection.
Yes, they have to SSL terminate your connection, but does so every proxy that they decide to use (nginx, elb, whatever). Plus, the security that a company like CloudFlare has to protect that data is a lot higher and more strict than the majority of sites out there (including the Internet Archive).
It is also frustrating that people would downvote me above for suggesting to use them, when in fact it is the only way to handle a large scale DDoS uness you have an insane pipe with hundreds of G of uplink.
There's a huge difference between having access to the plaintext of encrypted connections and merely seeing connection metadata, as would be the case with "traditional" DDoS mitigation services that do not act as a proxy. Reverse proxies are certainly not the only way to handle large-scale DDoS attacks, though I would agree that, leaving aside the privacy concerns, those services are hardly competitive in comparison to CloudFlare, especially on price and UX.
I suppose the lesson here is "never underestimate the stupidity and destructive power of wannabe vigilantes."
A lot of people mistakenly think that CloudFlare provides "real" DDoS mitigation, but that's just not true. In fact, I'd wager that CloudFlare has mostly outlived its utility nowadays, and is primarily a risk rather than an asset - for it to work, you must compromise your users' privacy, unlike competing mitigation services.
"Saving bandwidth" is hardly a valid argument anymore either. How much is your users' privacy worth to you? Traffic pretty much costs between $0.50 and $5.00 per TB nowadays -- would you essentially break TLS for everybody to save a few bucks a month?
As for Sucuri - only their Business plan covers Layer 3/4 attacks, and it's not entirely clear to me what they mean with "site". Is it a single subdomain?
If you want actual, real DDoS mitigation, then just pay a real mitigation provider like Voxility, X4B, Level3 (formerly Black Lotus), and so on. There are quite a few.
EDIT: Yep, Sucuri classes a "site" as a "unique FQDN", more or less. It's not clear what the bandwidth/traffic limitations are. It also seems to me like it only does HTTP-based traffic, much like CloudFlare.
I am genuinely interested since I was thinking on signing up for their service, but I would love to research some alternatives first.
* If you're looking for DDoS mitigation, use basically any of the providers that offer it on a network level - it's really not necessary to have access to HTTP traffic to mitigate attacks. Also, don't run Apache - it's notoriously vulnerable to various low-bandwidth attacks.
A non-exhaustive list of "real" mitigation providers (note that I am not making any particular recommendations):
- Voxility
- X4B.net
- Akamai (formerly Prolexic)
- Level3 (formerly Black Lotus)
- Psychz Networks
- CNServers
- Sharktech
- OVH (not as a separate service, but their entire network is covered)
Another option, if you're running at a larger scale, is to purchase mitigation appliances and just set up your own mitigation infrastructure. This will not be cheap and require some serious connectivity, but beyond a certain point it'll be more cost-effective.
* If you're looking for a WAF, run one on your own backend server(s) and/or loadbalancer(s). There's no benefit to doing this remotely, really. Even something relatively simple like ModSecurity will cover a wide array of problems.
* If you're looking to save bandwidth: don't bother. Traffic costs virtually nothing nowadays, and saving a few dollars by having another provider cache your assets hardly outweighs having the privacy (and potentially security) of all your users compromised. If you find traffic to be expensive, you should probably look for a different provider - some providers (like AWS) notoriously overcharge for it.
* If you're looking for better performance: CloudFlare doesn't really provide that to begin with. There's an extra hop for non-static assets, and depending on the location of your server and users, it can actually slow things down. If your performance is really critical to the millisecond - and chances are, it isn't - look into hosting providers that offer anycast.
* If you're looking for DNS hosting: plenty of options. Many providers offer it for free if you host with them, Hurricane Electric offers it for free regardless of where you are hosted (http://dns.he.net/), and if you need an SLA, there's Rage4 and Route 53. Pretty much every DNS hosting provider uses anycast.
* If you're looking for magic SSL/TLS: Use Caddy (https://caddyserver.com/), which is a HTTPd that will automatically set up and renew certificates for you through Let's Encrypt, as well as greatly simplifying TLS configuration. It's essentially zero-effort.
Trying to outsource this to a third party (like CloudFlare's "Universal SSL/TLS" does) defeats the point - it means that the third party can see all of your traffic, all the while providing a false sense of security to your users; they see the padlock, but their traffic is not secured end-to-end.
In short: the only correct place to terminate TLS is on your own servers.
* If you're looking for something else that CloudFlare offers: Feel free to describe it, and I'll suggest an alternative.
Most of these providers you listed have many issues, more expensive and do a terrible job protecting web sites.
For websites, like the Internet Archive, you do not need a layer 3/4 mitigation only provider. CloudFlare, Incapsula, Sucuri and others do that very well (I know from experience by working with them).
I'll look into them.
Well, I am still looking around so no fixed ideas yet whether to use or not use whatever CF offers, but since in my experience CF is the one that stands up the most in whatever stuff I read, I thought it would be very nice to have alternatives for research.
Incapsula & Sucuri
All others are old school services, highly expensive and more focused at Infrastructure DDoS protection, not website DDoS protection.
Does this justify their actions? I don't know and probably not. But it totally changes your perception about why they are attacking Internet Archive.
For example -
This could be a cover for an operation that Internet Archive is not aware of, that is possibly tied to the Internet Archive truck theft (and recovery) that happened a few months back.
The truck's contents (drives, network gear, h/w's firmware, etc) was the way to get a payload into the internal network. And the DDoS attack is now covering whatever is really happening with lots of noise.
This is pure speculation on my part, but is much more reasonable than the pretense that someone would be stupid enough to DDoS the Way Back Machine because a few sites it auto-archived had some links to terrorists. In combination with someone also being stupid enough to steal a flaming truck (https://blog.archive.org/2016/04/20/truck-and-back-again-the...).