Feeds

GitHub wipes hand across bloodied face, stumbles from brutal DDoS beating

Wouldn't have happened if you'd just used SVN, eh!

SANS - Survey on application security programs

Popular source-code warehouse GitHub was back online today after weathering a huge denial-of-service attack throughout the week.

The status page of the San Francisco-based outfit charts the progress of the assault and the attempts to end it. Problems with the web service first cropped up on Tuesday, 1 October, before the team realised they were facing a denial-of-service storm. This first wave was dealt with late on Wednesday only for a second phase of the attack to flare up again on Thursday.

Barry Shteiman, director of security strategy at data centre security firm Imperva, said a titsup GitHub would have had a knock-on effect on programmers at many organisations.

“GitHub’s business is to act as a code repository for companies big and small. This is unfortunately a brutal case of the impact of third party services on business security and availability," he said.

Ashley Stephenson, chief exec of security appliance firm Corero Network Security, added the multi-phase pattern of the attack against GitHub is typical of other denial-of-service attacks.

"From what GitHub have disclosed it looks like the DDoS [distributed denial of service] attacks targeted at their networks followed a very typical progression," Stephenson said. "It is not unusual for attackers to probe a site with different attack vectors to figure out what type of vulnerabilities exist. It is likely that as the attacker(s) saw that GitHub were able to stop one type of DDoS attack they modified the characteristics of the attack until the website and services were again impacted."

"A second wave of attacks, just a day later, is also a common sequence, more than likely coming from the same source, having already analysed how GitHub would likely react in trying to mitigate the attack, the second wave of DDoS attacks do appear to have been successful in taking down the site," he added.

Stephenson concluded: "We are seeing more often that DDoS attacks against web servers evolve over a period of 24-48 hours until they take down a site or their perpetrators give up and move on. GitHub have done the right thing in keeping their users informed of the status of the attacks."

GitHub is a frequent target of DDoS attacks. It suffered two major attacks in August and the same number in July alone. The possible motives much less the perpetrators behind the latest assault remain unclear.

DDoS attacks, in general, are often used by hackers to probe for vulnerabilities in a website or as a smokescreen to deflect attention from the main motives of an attack - which in the case of GitHub may involve tampering with projects' source code or similar malfeasance.

Sysadmins on the receiving end of DDoS attacks often need to tweak the settings of firewall equipment, intrusion prevention system and other security defences to compensate for the assaults. These changes can sometimes unwittingly open up further vulnerabilities. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Arts and crafts store Michaels says 3 million credit cards exposed in breach
Meanwhile, Target investigators prepare for long process in nabbing hackers
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.