JohnG 41 Posted July 6, 2009 I am with Greg and Col and a friend in antivirus who also doesn't find it credible. I can't find anything like this anywhere on google. what is the motive? just too many holes. And RG confused with a casino site? come on! Share this post Link to post Share on other sites
JohnG 41 Posted July 6, 2009 53 members in the RG Playpen! <--- RG LOL JohnG, TwoTone, trex650, trailboss, P4GTR, Samurai, greg_r, pollux1, NoobyPanFan, BILL44, repwatch, Hung Well, BROM, tonryart, silverspeed, Kollektor, Andei3000, mat944, tavros, slask111, Birdman, Cortebert, zzipy, jp0013, trojanmike, neatness88, w0lf, TitoSosa, Brandeego, pterminator, Mack, Top Gun aka Maverick, anmorath, gazumi, theflyingdutchman, stratcat, sc2178, fraser, Notloc08, dlkoiter, sfa437, ehfour, meatwad, tomhorn, ciego, szvwj, Mitton Mar, pr0digy30, geo1nah2a, davesco, smohr33, mrbigandwonderful, collector26, elisiX, spamh8r, Zed Share this post Link to post Share on other sites
greg_r 84 Posted July 6, 2009 I edited an earlier post to mention something interesting - I'll repeat it in more detail here. The friend I spoke to about this, as I mentioned, used to work for Juniper (they, along with Cisco, are the big guys in the internet hardware business). He's familiar with the company/datacentre who are hosting RG as he's provided support for their Juniper routers. Interesting that they should be buying Cisco hardware - generally Cisco customers stick with cisco and Juniper customers stick with Juniper - the gear works together fine, but it means they have only one support call to make when something goes titsup. Maybe they switched to Cisco in the interim (he left Juniper a few years back). Who knows? Don't you just luuuuuuuuuuuuve mysteries and conspiracy theories? Edit: Just an amendment to an incorrect assumption I had made earlier. Whilst EuroVPS specialise in Virtual Private Servers (i.e. several servers sharing a single machine) it turns out that they do indeed offer dedicated servers too. No clue whether RG is using one, however - no way to tell. Anyhow, it doesn't make much difference as the rest of the infrastructure remains the same - it still wouldn't be on the end of a private pipe. Apparently EuroVPS're using the Telia backbone. Share this post Link to post Share on other sites
JohnG 41 Posted July 6, 2009 Don't you just luuuuuuuuuuuuve mysteries and conspiracy theories? YES!!! Share this post Link to post Share on other sites
greg_r 84 Posted July 6, 2009 I never would have guessed Share this post Link to post Share on other sites
AllergyDoc 40 Posted July 6, 2009 Just posted on RWG.cc - I have been holding my tongue on commenting on this, but if there is a DDos attack involved the RG Admins aren't going to say much about what happened or how they fixed it because they don't want to tip off the perpetrators about what to try next. I will give some general answers to your points though to help everyone understand how these things 'could' be happening, because a lot of people are making incorrect assumptions about DDoS attacks. 1) No it's not, I had an online casino client that was hit with one that was attempting to flood the site with over 1GB of traffic. Very few NOC's can handle that and we were fortunate that we had bandwidth with several ISP's to help fend it off. We had several attacks which escalated over a two month period of time, the last of which went on for two straight weeks. They finally gave up as our site couldn't be taken down with a DDos attack of that size due to the security we had in place and the insane amount of bandwidth we bought. We got lucky as we put everything in place about a month before we got hit, after one of our competitors got hit. They were completely offline for three days and spent millions to get it to stop. A site like RG probably only needs 5-10 MB of bandwidth to keep it online. That size pipe is amazingly easy to flood. One person could do it from their home PC if they wanted to. It wouldn't have lasted this long of course, as RG's ISP could easily dispatch an attack from one IP address. Fact of the matter is that any DDos attack can be fended off if you have enough cash to do so. My guess is that RG isn't in that kind of financial position so some time has been spent to evaluate other less costly options than can work for the Admins who have to pay the bills. 2) Huge botnets are common, and are cheap to administer and run. A script kiddie can put together a small one in a few hours that can do serious damage. Certainly you can hire them out, but many are used by their own creators for evil purposes. 3) As I said earlier it depends on how big the attack is. They may have enough gear to slow down or fend off the attack, but if more bandwidth is flooding the NOC than they have connectivity for, it doesn't matter how much gear they have. Also, they could intentionally be keeping the site offline for a period of time in an effort to get the botnet operator to get bored and move along. When bringing sites back up after these things you run the risk of having the attack start up again and crashing you yet again if you aren't careful. My guess is the Admins are spending a lot of time looking at possible solutions vs costs to deploy them as I'm sure they are on tight budgets to keep the site alive. 4) Any appliance you can put in place to mitigate these things has to go out on the edge to be effective. If RG is paying for it directly, I would be surprised. To have any shot at stopping anything more than 'amateurs' fooling around, you can't put these security appliances on your own network because your bandwidth pipe will fill up before it has a chance to do anything. It has to be at the ISP so your pipe stays clean and the traffic gets bounced at the edge. They are far more likely going to be paying an additional fee for security services. 5) Again, not big bucks to do this. Once the attacker has the botnet set up, they can release it on anything. Assuming the DDos attack is the real cause, my theory is this, RG was attacked due to the casino. The casino was taken down a few days before the site went down completely is why I believe this. If it was an intentional hit it was done because of the casino, and probably the misguided belief that it was a cash casino, not geekbucks. Even though botnets are not expensive to use (or deploy) the operators of them want to use them to make a profit. That's why spam is sent using them, and why you see things like online casinos and othe financial sites getting hit. The operators are looking for cash/banking info, or to extort money from the site owners as ransom to make it stop. The only other explaination is an amateur let a botnet get away from them, but given the length of time RG has been offline I'd have to believe this was a professional job. I also doubt any hardware failures, corrupt DB's etc. It's too easy in this day and age to replace that stuff and get back online, even if you lose data in the process. Share this post Link to post Share on other sites
JohnG 41 Posted July 6, 2009 Don't worry, as read obsessively about DOS attacks, all this will begin to make sense. We all had to start out like you, its okay. Share this post Link to post Share on other sites
repfish 0 Posted July 6, 2009 Just posted on RWG.cc - I have been holding my tongue on commenting on this, but if there is a DDos attack involved the RG Admins aren't going to say much about what happened or how they fixed it because they don't want to tip off the perpetrators about what to try next. I will give some general answers to your points though to help everyone understand how these things 'could' be happening, because a lot of people are making incorrect assumptions about DDoS attacks. 1) No it's not, I had an online casino client that was hit with one that was attempting to flood the site with over 1GB of traffic. Very few NOC's can handle that and we were fortunate that we had bandwidth with several ISP's to help fend it off. We had several attacks which escalated over a two month period of time, the last of which went on for two straight weeks. They finally gave up as our site couldn't be taken down with a DDos attack of that size due to the security we had in place and the insane amount of bandwidth we bought. We got lucky as we put everything in place about a month before we got hit, after one of our competitors got hit. They were completely offline for three days and spent millions to get it to stop. A site like RG probably only needs 5-10 MB of bandwidth to keep it online. That size pipe is amazingly easy to flood. One person could do it from their home PC if they wanted to. It wouldn't have lasted this long of course, as RG's ISP could easily dispatch an attack from one IP address. Fact of the matter is that any DDos attack can be fended off if you have enough cash to do so. My guess is that RG isn't in that kind of financial position so some time has been spent to evaluate other less costly options than can work for the Admins who have to pay the bills. 2) Huge botnets are common, and are cheap to administer and run. A script kiddie can put together a small one in a few hours that can do serious damage. Certainly you can hire them out, but many are used by their own creators for evil purposes. 3) As I said earlier it depends on how big the attack is. They may have enough gear to slow down or fend off the attack, but if more bandwidth is flooding the NOC than they have connectivity for, it doesn't matter how much gear they have. Also, they could intentionally be keeping the site offline for a period of time in an effort to get the botnet operator to get bored and move along. When bringing sites back up after these things you run the risk of having the attack start up again and crashing you yet again if you aren't careful. My guess is the Admins are spending a lot of time looking at possible solutions vs costs to deploy them as I'm sure they are on tight budgets to keep the site alive. 4) Any appliance you can put in place to mitigate these things has to go out on the edge to be effective. If RG is paying for it directly, I would be surprised. To have any shot at stopping anything more than 'amateurs' fooling around, you can't put these security appliances on your own network because your bandwidth pipe will fill up before it has a chance to do anything. It has to be at the ISP so your pipe stays clean and the traffic gets bounced at the edge. They are far more likely going to be paying an additional fee for security services. 5) Again, not big bucks to do this. Once the attacker has the botnet set up, they can release it on anything. Assuming the DDos attack is the real cause, my theory is this, RG was attacked due to the casino. The casino was taken down a few days before the site went down completely is why I believe this. If it was an intentional hit it was done because of the casino, and probably the misguided belief that it was a cash casino, not geekbucks. Even though botnets are not expensive to use (or deploy) the operators of them want to use them to make a profit. That's why spam is sent using them, and why you see things like online casinos and othe financial sites getting hit. The operators are looking for cash/banking info, or to extort money from the site owners as ransom to make it stop. The only other explaination is an amateur let a botnet get away from them, but given the length of time RG has been offline I'd have to believe this was a professional job. I also doubt any hardware failures, corrupt DB's etc. It's too easy in this day and age to replace that stuff and get back online, even if you lose data in the process. WTF?? Does this mean it has a cracking lume job?? Share this post Link to post Share on other sites
JohnG 41 Posted July 6, 2009 I am not sure what it means, but whatever it is, it can't be good! Share this post Link to post Share on other sites
sconehead 5 Posted July 6, 2009 I think Anubis farted and it melted the hard drives...so there... Share this post Link to post Share on other sites
JohnG 41 Posted July 6, 2009 I think there is something really weird going on and once the server is back up the whole thing will be hushed up... Whatever the truth is, it is too explosive to risk letting the general public know about it. We will see a dis-information campaign, the likes of which we have never seen before! Share this post Link to post Share on other sites
prestigewatchco 2 Posted July 6, 2009 Or on the other hand they may just tell the inquisitive people to piss off and mind their own business. Which is a better plan in my opinion than trying to explain to people who don't want to know the truth anyway unless it involves someones misfortune Share this post Link to post Share on other sites
JohnG 41 Posted July 6, 2009 Yeah, I don't want the truth to get in the way of a good conspiracy theory! Whatever it is though, ain't no DOS attack. Share this post Link to post Share on other sites
sconehead 5 Posted July 6, 2009 That isn't who I think it is...is it? Share this post Link to post Share on other sites
JohnG 41 Posted July 6, 2009 OMG, we start talking about RegGeek and Josh shows up, lurking in the thread!!!..... Coincidence? Share this post Link to post Share on other sites
sconehead 5 Posted July 6, 2009 OMG, we start talking about RegGeek and Josh shows up, lurking in the thread!!!..... Coincidence? John, stop being a waterbuffalo pussy, he might have something to contribute to the thread...behave... Share this post Link to post Share on other sites
AustinTech 0 Posted July 6, 2009 OMG, we start talking about RegGeek and Josh shows up, lurking in the thread!!!..... Coincidence? He's still here!!! Share this post Link to post Share on other sites
JohnG 41 Posted July 6, 2009 OMG, we start talking about RegGeek and Josh shows up, lurking in the thread!!!..... Coincidence? He's still here!!! Let's ask him what the fuck happened to the SA Blacksteel! Share this post Link to post Share on other sites
prestigewatchco 2 Posted July 6, 2009 Or it maybe someone has cloned him can happen so I understand! Share this post Link to post Share on other sites
JohnG 41 Posted July 6, 2009 Or it maybe someone has cloned him can happen so I understand! I heard that too! It would have to be perfect though... Share this post Link to post Share on other sites
hk45ca 0 Posted July 6, 2009 Or it maybe someone has cloned him can happen so I understand! I heard that too! It would have to be perfect though... and very expensive. Share this post Link to post Share on other sites
sconehead 5 Posted July 6, 2009 A takeover bid perhaps? Share this post Link to post Share on other sites
hk45ca 0 Posted July 6, 2009 cool!! a proxy fight!!!!!!!! Share this post Link to post Share on other sites
JohnG 41 Posted July 6, 2009 Oh man, Josh is still watching.... Josh, when are we going to get a batons dial SA? And a thicker Pro-II bracelet? Share this post Link to post Share on other sites
sconehead 5 Posted July 6, 2009 Think he's got to the shared server post yet? Share this post Link to post Share on other sites
