Feeds

GitHub wipes hand across bloodied face, stumbles from brutal DDoS beating

Wouldn't have happened if you'd just used SVN, eh!

Beginner's guide to SSL certificates

Popular source-code warehouse GitHub was back online today after weathering a huge denial-of-service attack throughout the week.

The status page of the San Francisco-based outfit charts the progress of the assault and the attempts to end it. Problems with the web service first cropped up on Tuesday, 1 October, before the team realised they were facing a denial-of-service storm. This first wave was dealt with late on Wednesday only for a second phase of the attack to flare up again on Thursday.

Barry Shteiman, director of security strategy at data centre security firm Imperva, said a titsup GitHub would have had a knock-on effect on programmers at many organisations.

“GitHub’s business is to act as a code repository for companies big and small. This is unfortunately a brutal case of the impact of third party services on business security and availability," he said.

Ashley Stephenson, chief exec of security appliance firm Corero Network Security, added the multi-phase pattern of the attack against GitHub is typical of other denial-of-service attacks.

"From what GitHub have disclosed it looks like the DDoS [distributed denial of service] attacks targeted at their networks followed a very typical progression," Stephenson said. "It is not unusual for attackers to probe a site with different attack vectors to figure out what type of vulnerabilities exist. It is likely that as the attacker(s) saw that GitHub were able to stop one type of DDoS attack they modified the characteristics of the attack until the website and services were again impacted."

"A second wave of attacks, just a day later, is also a common sequence, more than likely coming from the same source, having already analysed how GitHub would likely react in trying to mitigate the attack, the second wave of DDoS attacks do appear to have been successful in taking down the site," he added.

Stephenson concluded: "We are seeing more often that DDoS attacks against web servers evolve over a period of 24-48 hours until they take down a site or their perpetrators give up and move on. GitHub have done the right thing in keeping their users informed of the status of the attacks."

GitHub is a frequent target of DDoS attacks. It suffered two major attacks in August and the same number in July alone. The possible motives much less the perpetrators behind the latest assault remain unclear.

DDoS attacks, in general, are often used by hackers to probe for vulnerabilities in a website or as a smokescreen to deflect attention from the main motives of an attack - which in the case of GitHub may involve tampering with projects' source code or similar malfeasance.

Sysadmins on the receiving end of DDoS attacks often need to tweak the settings of firewall equipment, intrusion prevention system and other security defences to compensate for the assaults. These changes can sometimes unwittingly open up further vulnerabilities. ®

Beginner's guide to SSL certificates

More from The Register

next story
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Shellshock over SMTP attacks mean you can now ignore your email
'But boss, the Internet Storm Centre says it's dangerous for me to reply to you'
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
How to simplify SSL certificate management
Simple steps to take control of SSL certificates across the enterprise, and recommendations centralizing certificate management throughout their lifecycle.