Pro-Iran crew turns DDoS into shakedown as Ubuntu.com stays down

I bet a fair number of websites would collapse under the curiosity load if it were published in major news outlets they they were down. When was the last time you went to nissan.com? But you'd probably go check if you heard it was down.

Lambdanaut• 3 months ago

Does anyone know why Ubuntu would be targeted by pro-Iranian activists? I'm perplexed by the connection.

at-fates-hands• 3 months ago

Canonical is a UK company, so its a symbolic attack against a Western agent. Ubuntu is used by a lot of tech companies so they knew this attack would get a lot of visibility in the tech community. I'm assuming they think this will garner support from the tech community as well.

shaftoe• 3 months ago

Exactly as described in "how to win friends and influence people". Break their stuff and extort money.

Gualdrapo• 3 months ago

Still it feels quite odd that from all western tech companies (and several more influential than Canonical) they chose precisely one that is highly involved with open source

thewebguyd• 3 months ago

I'm assuming they think this will garner support from the tech community as well.

I don't understand their thinking if this is the case. DDoSing widely used project is going to turn people against you, not generate support.

everdrive• 3 months ago

Almost certainly a target of opportunity. The UK has really made a point of staying out of this fight, but is also seen as a close ally of the US. Perhaps the calculus is:

- Iran was able to attack Ubuntu.com

- Iran sees it in its interests to stress the UK / US relationship (albeit in a small way)

geerlingguy• 3 months ago

Why would Ubuntu problems cause stress in the US/UK relationship?

ifwinterco2• 3 months ago

UK has been trying to thread the needle of staying out of what is obviously a complete cluster** of a war while also not annoying the US too much, but US bombers are taking off from air force bases in the UK to bomb Iran all the time.

Because of that and the general ingrained hostility of the permanent UK security state to Iran, they view us as a legitimate target albeit not a particularly important one because we’re just not that powerful anymore

b00ty4breakfast• 3 months ago

It's a well(ish) known org with well known product, and they seem to have been vulnerable. If they had attacked a deli in Newark, would we be having this conversation?

culi8• 3 months ago

Canonical literally has a DOD team. They are a military contractor

theultdev• 3 months ago

Terrorists will generally target anything of opportunity.

It was also perplexing when Iran was shooting missiles at their allies, until you realize they aren't rational humans.

AlecSchueler2• 3 months ago

they aren't rational humans.

Would you be able to point to any rational humans?

swat535• 3 months ago

Which allies are you talking about? Gulf nations with US bases actively being used to kill their children?

CamperBob2• 3 months ago

I'm not sure dismissing the people who invented the term "checkmate" as a bunch of irrational terrorists really works. They stared down Saddam Hussein, so how hard can it be to stare down Donald Trump?

Bombing Iran is like nuking an asteroid. Now, instead of one giant asteroid on a collision course with Earth, there are a half-dozen medium-sized radioactive asteroids on a collision course with Earth.

skeledrew• 3 months ago

until you realize they aren't rational humans

How did you get to that realization?

mrala• 3 months ago

It was also perplexing when Iran was shooting missiles at their allies, until you realize they aren't rational humans.

Ah yes, the classic “my enemies are ontologically evil” gambit.

_DeadFred_4• 3 months ago

Iran is targeting random ships crewed by third world/unaligned national crews in the straight. Iran's goal is do whatever it takes to put pressure. They are willingly threatening the food supply of large unaligned parts of the world because it gives them leverage/puts on pressure.

Iran's proxies murdered random grandmothers on Oct 7th and uploaded the video to the internet to get a message across in order to promote their agenda. Why would a random tech company be odd from people funding the murderer of grandmas and their entire families in their homes execution style?

The UK called in the ambassador from Iran this week because they were calling for Iranian expats in the UK to give up their lives for Iran (followed the next day by attacks on jews in the UK).

culi8• 3 months ago

Canonical partners with organizations like the U.S. Air Force (USAF) and Platform One to provide secure software and AI/ML capabilities. They have an entire DOD team.

leereeves4• 3 months ago

I can't find much info about that (especially with their website down). Is Canonical's work with the DOD more like Raytheon or Pizza Hut?

Raytheon: providing products specifically for the DOD

Pizza Hut: selling their usual product to the DOD

DetroitThrow• 3 months ago

They work with US military.

input_sh• 3 months ago

An actual answer because all you've received so far is complete nonsense: because they want press attention as they're using these attacks to advertise their DDoS-as-a-Service tool. Literally every single statement they release (on Telegram) includes text saying that their attacks are "100% powered by $websiteEndingWithDotSu".

They also attacked the likes of Vrbo, Expedia and eBay, but they get more press by targeting Mastodon, Bluesky, Ubuntu and the likes, so they go after those now. People are desperately trying to somehow tie those victims to some ideological nonsense, but it's just advertising.

lostmsu• 3 months ago

It might be "just advertising", but this also moves them from "I am pretending to retaliate" to "fuck everyone", and eventually will lead to formal recognition of Russia as terrorist state with targets painted at their backs.

There's also Anonymous that for the time being forgot about Russia.

ranger_danger• 3 months ago

313 Team claims their attack is vengeance for killing Khamenei.

54lasgf• 3 months ago

This is really a weird target, as the article notes. Bluesky and Mastodon (?!) also had alleged attacks.

The companies that fund Trump's ballroom might like these targets.

gpm• 3 months ago

Bluesky and mastodon both strike me as easy targets, they expose protocol level integration points that are probably reasonably expensive to serve and reasonably difficult to detect malicious actors on and/or throttle without significantly degrading the service.

I could see low budget attackers deciding that they were the most (not very much) bang for the (also not very much) buck that they could get...

Ubuntu.com doesn't fit that narrative though. I would have thought canonical would have the servers and skill to weather quite a large attack (on the other hand it did go down...)

CivBase• 3 months ago

Why the group is targeting London-based Canonical remains unclear and no reason was given via its Telegram channel. It is presumably because Ubuntu is one of the most popular Linux distros.

Okay... so? I do not understand the connection between Linux and the US/Israel. You'd think Iran would be very pro-Linux since Windows is a very obvious liability for them.

Is there any reason to believe this attack even has anything to do with Iran? They could simply want money and they just happen to also be pro-Iran.

tempaccount5050• 3 months ago

Maybe they're still mad about systemd.

loloquwowndueo• 3 months ago

Systemd was NOT Canonical’s “fault”. They pushed upstart until Debian chose systemd, at that point it made no sense to resist assimilation like all other distros.

alephnerd3• 3 months ago

I do not understand the connection between Linux and the US/Israel. You'd think Iran would be very pro-Linux since Windows is a very obvious liability for them

Canonical is a British company and the employees are westerners. That makes them targets in the eyes of Iran.

People are forgetting that the Iranian government detests Israel and the entirety of the West. The core principal of the revolution is reversing westoxification (Gharbzadegi) and returning to the norms of the Imam Husayn (Velayat-e Faghih). That's the whole crux of the Islamic Revolution and why the Islamic Revolutionary Guard Corp (IRGC) exists.

Open source and anti-war westerners are viewed opportunistically but with disdain.

aksss• 3 months ago

Classic Scorpion and the Frog tale, or the older Farmer and the Snake. https://read.gov/aesop/094.html

culi8• 3 months ago

It's not Linux, it's Ubuntu. Which is developed by Canonical. Which is a military contractor that has a permanent DoD team and works with the USAF. Which is bombing their country.

jcgrillo2• 3 months ago

just now:

  $ snap refresh
  error: unable to contact snap store

wing-_-nuts• 3 months ago

Tangent, but I hate snap with the fury of a thousand suns. That single handedly pushed me to pop, then mint.

jcgrillo2• 3 months ago

Yeah it isn't great. I have stuck with Ubuntu because I have some peculiar hardware which is well supported. I have learned to live with it.

newsoftheday• 3 months ago

Same, I use Kubuntu but yeah, I do keep snap disabled. Tried it several years ago, can't stand it. I do like Canonical and Ubuntu for servers and of course, Kubuntu for all our home machines, wife loves it too.

overtone1000• 3 months ago

313 Team runs arch btw

kps• 3 months ago

I'd have guessed Mint.

a96• 3 months ago

So they essentially shot themselves in the foot.

(That may have been the joke.)

ChrisArchitect• 3 months ago

Canonical/Ubuntu have been under DDoS for more than 15h

https://news.ycombinator.com/item?id=47972213

nubinetwork• 3 months ago

That says resolved, but I had a hell of a time trying to run apt update still...

pjjpo• 3 months ago

Interesting - this was randomly in my feed but indeed today, I upgraded my server and didn't know at the time why all the apt requests were so slow. That being said, it sped up to full over time - I wonder if this is actually an effect of the DDoS or they added some infra to throttle at first and eventually determine if an IP is making valid requests.

remram• 3 months ago

I had no issue with regular distro update channels (those have mirrors all over) but couldn't get updates from PPAs (i.e. third-party). Feels backwards a bit.

Animats• 3 months ago

Ubuntu.com seems to be fine right now. A bit slow, maybe. Ubuntu 26.04.LTS is out.

Havoc• 3 months ago

Sounds like they're picking on easy targets rather than relevant ones. Lame.

cineticdaffodil• 3 months ago

Its so weird to have this stone age regime have such modern attack vectors, i guess the survival hunger games of rhe sanctions tought them this lesson.

TheChaplain• 3 months ago

Considering the name of the crew, the title would be better off with "Pro-Iran regime". It is a small but important difference.

Pro-Iran crew turns DDoS into shakedown as Ubuntu.com stays down

Related Stories