[Operators] DDoS attacks against jabber.org

Mathias Ertl mati at fsinf.at
Fri Feb 7 16:01:09 UTC 2014


Hi,

On Fri, Feb 07, 2014 at 07:59:47AM -0700, Peter Saint-Andre wrote:
> On 2/7/14, 3:10 AM, Edwin Mons wrote:
> >On 07/02/14 11:08, Andreas Kuckartz wrote:
> >>Are there any indications regarding the motives of the attackers?
> >>
> >
> >Other than that they seem to target specific MUCs, we can only speculate.
> 
> I have a hunch, which the other jabber.org admins don't necessarily
> agree with, that this is related to conflict in Syria. Most of the
> rooms that various attackers are interested in have names related to
> Syria (e.g., English or Arabic versions of Aleppo, Homs, etc.). This
> would be consistent with other activities I've seen (various people
> claiming that they used to be admins in these rooms and now need to
> be given admin rights, etc.).

Uh-oh. We have seen those same MUCs over and over again on jabber.at. We
block the accounts, destroy the MUCs, block the IPs used for registration
and they keep popping up from time to time. I have even written a script
that periodically destroys MUCs on a blacklist and blocks all
admin-accounts from those MUCs.

We did try to communicate with the (very very few) people in those MUCs.
But that's usually just a dead end, I never quite could tell if those were
Bots or people with just very bad language skills and a faible for
ASCII-Art roses.

We haven't seen any DDOS-Attacks that we could relate to this so far.

greetings, Mati

> 
> But, of course, I might be mistaken.
> 
> Peter
> 
> -- 
> Peter Saint-Andre
> https://stpeter.im/

-- 
I only read plain text mail! I prefer pgp|gpg signed & encrypted mails!
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://mail.jabber.org/pipermail/operators/attachments/20140207/9243a8f4/attachment.pgp>


More information about the Operators mailing list