DDOS attack - how to manage it?

[bettingmalta]

Hello guys, I would like to share with you the DDOS attack approach style...
Just received this email below:

FORWARD THIS MAIL TO WHOEVER IS IMPORTANT IN YOUR COMPANY AND CAN MAKE DECISION!

We are Armada Collective.

All your servers will be DDoS-ed starting Monday (Jul 4 2016) if you don't pay 5 Bitcoins @ 14T7TxDxhhpYtgNgrK1hpe4UsfULZDhFoC

When we say all, we mean all - users will not be able to access sites host with you at all.

Right now we will start 15 minutes attack on your site's IP xxx.xx.xxx.xx. It will not be hard, we will not crash it at the moment to try to minimize eventual damage, which we want to avoid at this moment. It's just to prove that this is not a hoax. Check your logs!

If you don't pay by Monday, attack will start, price to stop will increase by 5 BTC for every day of attack.

If you report this to media and try to get some free publicity by using our name, instead of paying, attack will start permanently and will last for a long time.

This is not a joke.

Our attacks are extremely powerful - sometimes over 1 Tbps per second. So, no cheap protection will help.

Prevent it all with just 5 BTC @ 14T7TxDxhhpYtgNgrK1hpe4UsfULZDhFoC

Do not reply, we will probably not read. Pay and we will know its you. AND YOU WILL NEVER AGAIN HEAR FROM US!

Bitcoin is anonymous, nobody will ever know you cooperated.



I would like to receive your suggestions on how to manage this kind of bad activities done by these f@@@@@ bastards!!

Did anymore deal with ?

Thanks for your help.

[Progger]

Pay nothing.

U can use Cloudflare,and put the mode " under attack " on...

If you're under attack and have this feature enabled during the attack, visitors will receive an interstitial page for about five seconds while we analyze the traffic to make sure it is a legitimate human visitor.

Clodflare block the most "bad" traffic....

and btw... bitnoin is not anonymous!!!



Regards

[universal4]

Sad part is a certain amount of ddos attack originates from cloudflare for which they do NOTHING about.

There are many ways to deal with such attacks, but it also depends on the host you are with and how much help they will be. It also depends on the type of attack which is taking place, whether it is an http attack, dns, udp, port flood etc....

Rick
Universal4

[Syndicate]

So what happened? Did you manage to avert these scum?

[olson1981]

Just googled them and this was one of the top links:

https://blog.cloudflare.com/empty-dd...da-collective/

[Progger]

5 BTC are 3181 Dollar.

"Unfortunately, in spite of the lack of actual DDoS follow through, it appears that many victims are paying the extortion fee. A security analyst from the Bitcoin analysis firm Chainalysis studied payments sent to the Armada Collective's Bitcoin addresses and concluded that more than USD$100,000 has been sent to the attackers by victims."

[gamerbud]

I was lagging and got message from ISP provider that my IP is used in DDoS attack, they asked me turn UPnP connections off and put firewalls block all up going connections, this seemed work for me, botnet cant order my IP to send packages to other server. Great Tips !

[universal4]

You have not stated whether this took place on your server or your home connection.

No matter which type of connection it is, if your ip is being used in any kind of attacks (outgoing) then you are compromised in some way.

If it is your home connection, you likely have a trojan or something that has taken a bit of control of your system.

this seemed work for me, botnet cant order my IP to send packages to other server.

Based upon this statement, we will assume it is your server.

Firewalling outgoing connections does NOT take care of the compromise, it may reduce or even stop the outgoing attacks, BUT I would be very concerned about how a botnet is using your ip.

Is it a shared ip? If a unique ip you may have a wordpress or other cms plugin that is compromised or your server may be compromised in some way. If it is a shared ip, any site on the shared ip could be compromised.

No matter which it is, I would think it would be prudent to figure it out, change all passwords, make backups of everything quickly, (do not over-write old backups since new backups could be backing up the compromise) and if it is your home system I would be very careful about doing ANY banking or any financial stuff until you determine what it is and take care of it.

this seemed work for me, botnet cant order my IP to send packages to other server.

If a botnet is ordering your server to do ANYTHING it is most likely COMPROMISED!

Some may not agree, but in my opinion, the advice given by the isp fell short of explaining the dangers of not investigating and FIXING the issue instead of the lame advice to temporarily mitigate the effect.

It very well could be that a UPnP vulnerability was used, but if so they may have also most like pushed code onto your server to take advantage of your resources, ip and bandwith when they sent the attack out.

Closing the port might reduce anyone else being able to take advantage of the same vulnerability, but something was telling your server to launch against others and I would want to know more about what took place.

Rick
Universal4

The advice from your isp is like saying, "It's ok if you have a virus or trojan and there is no need to get rid of the trojan, just stop it from what it is doing today and you can worry about further damage to you and your business later."

[sweetbet]

5 BTC are 3181 Dollar.

"Unfortunately, in spite of the lack of actual DDoS follow through, it appears that many victims are paying the extortion fee. A security analyst from the Bitcoin analysis firm Chainalysis studied payments sent to the Armada Collective's Bitcoin addresses and concluded that more than USD$100,000 has been sent to the attackers by victims."

I was wondering how much money they made with their threats.

[celena]

Incredible but true, do not give nothing.

[bettingmalta]

we are monitoring but no signal till now....

[xecutable]

You wont see a thing. Google is your friend.

"To date, we've not seen a single attack launched against a threatened organization. This is in spite of nearly all of the threatened organizations we're aware of not paying the extortion fee. We've compared notes with fellow DDoS mitigation vendors and none of them have seen any attacks launched since March against organizations that have received Armada Collective threats."