January 12, 2010
On 9th January 2010, The Online Citizen, one of the two major
socio-political blogs in Singapore was incapacitated by what is
known as a DDOS (Denial of Service) attack which is an attempt to
make a computer resource unavailable to its intended users to
prevent an internal site or service from functioning efficiently or
at all, temporarily or indefinitely.
The site is only accessible intermittently for the last two days
and has been down for the past few hours. According to the last
posting on TOC’s Facebook, the attack is still going
on.
A day later, the Temasek Review came under a similar DDOS attack
too, but fortunately with our new anti-DDOS firewall blocking the
attacks, our site is able to stay up though the loading may be
slow. A week ago, TR will be completely inaccessible like TOC
now.
(Some readers are unable to access TR not because of the
attack, but due to DNS propagation issues which we have already
resolved.)
The Temasek Review has come under such attacks on several
occasions in the last few months beginning in September last year.
The first attack on our site completely overwhelmed us and it was
down for more than 24 hours, sparking a controversy in
cyberspace.
This is probably the first time that any socio-political blog in
Singapore has come under such an attack and it is
therefore understandable that some netizens were skeptical
about our claims.
One prominent gamer in Singapore’s blogosphere and a former
guest columnist of Temasek Review, “Darkness” went around disputing
our claims and accused us of “faking” an attack to publicize our
site.
(Is there any blogger out there who can grow his/her blog’s
readership by having it accessible only half the time?)
We challenged “Darkness” to substantiate his allegations which
he was unable to do so and he was subsequently evicted from the
“Brotherhood”, a guild of gamers whose “Council of the wise”
apologized for his indiscretion on our site. (read the comment
here)
Since the first attack, we have been attacked on an increasing
frequency, initially on a monthly basis followed by bi-weekly,
weekly and now once in a few days.
Due to the complexities involved, it is not possible for us to
explain clearly each time our site becomes inaccessible because it
may not be caused directly by the attack.
Sometimes, it is not a DDOS attack, but a sync attack,
a smurf attack or a massive “content grabbing” like what SPH
did to us which has the potential to slow our
site down if we do not have a firewall to block off its
requests.
In the past, everytime we come under an attack, we will have to
move our server or change a IP address to strengthen our security
system which explains why some readers may see our page
as “upgrading in process” at times which our detractors used to
“prove” that we did not suffer a DDOS attack. These were
evasive measures necessary to safeguard our original site’s data
and hardware from further damages.
Since then, with the help of our present host, we have migrated
our site onto a clustered cloud server environment with load
balancing and network level firewall which promises better
availability, stability and defensibility against most attacks.
Who is responsible?
Both TR and TOC have a combined readership which is high enough
to challenge the mainstream media and it doesn’t take a
“forecaster” to warrant a guess who the culprits are.
Initially we thought the attacker(s) may be some bored youths or
a netizen who had an axe to grind with us. However, the attacks are
so well-coordinated and relentless that it is likely to be started
by a group of hackers with the implicit support of an organization
which has the resources to fund them.
The attacks follow a classic pattern:
1. They come suddenly without any warning with IPs flooding in
from all over the world at the same time which overloads the server
and brings it crashing down in no time.
2. It usually lasts more than 48 hours. The longest duration of
attack we suffered was 4 days. The site was not down for so long
because we had a dedicated IT team to trouble-shoot and find ways
to keep the site accessible to some readers.
3. They were not isolated attacks and will come again, again and
again.
Why is this happening?
The short-term aim of these attacks is to prevent readers from
accessing our site to decrease our growing readership and to
prevent damaging articles from reaching out to a larger
audience.
The long-term goal would be to discourage us from continuing to
work on TR and give up completely which we did consider as unlike
TOC, we do not have somebody to manage TR full-time. All of us
have full-time jobs outside and we cannot afford to spend too much
time bogged down by these perplexing problems with the site.
A secondary goal will be to deplete our resources so that we are
unable to devote our time, energy and finances to expand the site
which they (the attackers) have succeeded in a way.
We have spent nearly SGD$10,000 upgrading our server, bandwidth
and firewall which leaves us with little money for other more
pressing tasks ahead.
We had initially wanted to register a company early this year
and employ permanent staff to man TR, but now we have to postpone
our plans indefinitely till we make our IT system more secure,
especially with the next general election around the corner.
There is no point spending money to improve the quality of the
editorial content when the site is crippled frequently by these
irritating and disabling attacks.
What can we do?
No site in the world is completely safe and impenetrable. Even
mighty sites like Yahoo and Ebay were attacked and brought down and
most recently, China’s gigantic IT portal Baidu.
We can only keep beefing up our security system to make it as
secure as possible. Right now, our site is hosted on a cluster of
three dedicated servers in different parts of the world all
protected by an anti-DDOS firewall on a high-level security
network.
The attacker(s) will have to overwhelm our firewall and take
down three servers together at one go before our site crashes and
even then we have prepared a few backups in store. Only a
professional hacker will be able to breach our security wall.
Right now, there is an attack going on, but you are still able
to read this article because only one server is being flooded, the
other two are holding up.
Due to our unfortunate “experience” in dealing with these
attacks which have made us literally “vomitted blood” many
times, we are more than willing to provide some technical advice
and assistance to TOC.
They have three options currently:
1. Move to a dedicated server and increase their bandwidth and
RAM to accommodate more communication requests.
2. Strengthen their firewall or install one if they don’t have
it.
3. Purchase a dummy server and mirror their main site to divert
the attacks so that at least half their readers will be able to
access the site.
Whoever these attackers are, they are unlikely to stop at only
one attack. With Temasek Review becoming more and more difficult to
attack nowadays, they may change their target to TOC which will
have to bear the brunt of it.
Despite some petty differences between us, we, more than anybody
else, will want to keep TOC up simply because we share the same
goal of providing an alternative voice to Singaporeans.
Furthermore, with TOC down, the authorities will have one less
target to monitor and will now place all their attention
on TR which will put us in a precarious situation.
