Feedly gets hit by DDoS attack, refuses to give in to blackmail

http://grahamcluley.com/2014/06/feedly-blackmail-ddos/

by chmars • 12 years ago

219 134 12 years ago

ksec3• 12 years ago

Do people really get punished for it? I mean the actual ones behind those bot, not the innocent ones that had their computer hacked without knowing.

If yes, how long does it normally take to get them? If At all? Weeks? Months? Years?

These days DDoS seems far too easy, far too common.

bliker• 12 years ago

I quite liked this article about the issue. http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gb...

The shocking thing about these DDoS-for-hire services is that — as I’ve reported in several previous stories — a majority of them are run by young kids who apparently can think of no better way to prove how cool and “leet” they are than by wantonly knocking Web sites offline and by launching hugely disruptive assaults. Case in point: My site appears to have been attacked this week by a 15-year-old boy from Illinois who calls himself “Mr. Booter Master” online.

ksec3• 12 years ago

From Wiki "For the time being there are no good technical means to counteract misuse of NTP servers"

Sigh

slashdotaccount• 12 years ago

There will always be people who want to get some easy money and have the brains for that. Instead of playing the cat and mouse game we better take care that our networks are protected from, at least, small to mid-range DDoS attacks. The alternative is potential oppression from the governments - "you fear the bad guys, OK, then we will take some more freedoms from you and improve our surveillance to catch them".

davidw3• 12 years ago

There's no reason you can't punish criminals like this and still have a free, democratic, and open society.

modernerd• 12 years ago

Yes, people get jailed for DDoS attacks, at least in the UK. For example, two attackers were jailed for 5 years in 2013 for an extortion attempt and DDoS attack against an online casino: http://www.cnmeonline.com/news/ddos-playground-bully-blackma...

jacquesm3• 12 years ago

Jailtime for extorting a casino sounds like a good deal.

watty• 12 years ago

Pairing blackmail + DDoS is a guaranteed way to get the big guns to investigate.

mhurron• 12 years ago

Yes, but for the blackmail part, not the DDoS and then only if the perpetrators are in a country that cares to work with the laws of the victims country.

malka• 12 years ago

If all the ddos goes through a botnet, and the blackmail is done using Bitcoin, it could be really harsh for the authorities to find who is behind the attack.

alandarev• 12 years ago

Heavily depends on company's presence in media and how much pressure the owner puts into it. The reports I submitted with evidence of DDOS and traces to the blackmail'er through IC3 form[1], none were replied.

On another side, as bliker mentioned, those are usually kids. Replying to them that you have submitted an official IC3 report usually stops them, and some were even asking to cancel the report.

[1] https://www.ic3.gov/complaint/default.aspx

claudius2• 12 years ago

Why do you think someone is innocent if they let some third party use their computer without permission? For essentially all malware that makes your computer part of a larger botnet, you have to be extremely careless to let it get on your device, not dissimilar to leaving your car unlocked when it is subsequently stolen and used in a crime (or just misused by playing kids). The latter is illegal[0], why should the former be ok?

[0] http://www.gesetze-im-internet.de/stvo_2013/__14.html

gedrap2• 12 years ago

From our perspective - yes, that's pretty silly. But we are different, we are extremely far from the majority.

For many many people, computer is just a box for writing stuff in MS Word and watching porn.

paulhauggis• 12 years ago

"not dissimilar to leaving your car unlocked when it is subsequently stolen and used in a crime"

In the US at least, this is not a crime. If someone leaves their car unlocked by accident, why should they get punished if someone steals it and uses it for a crime?

Victim blaming is not the answer, it's just silly.

mwill• 12 years ago

I was just wondering why I couldn't hop on Feedly.

I feel sort of bad that this is what makes me finally self host my RSS reader, since it's totally out of their control, but I've been planning on jumping ship for a while, it's just been low priority for me. Goread has been tempting me though, so I guess I'll check it out.

madeofpalk• 12 years ago

If you were a former Google Reader user, you might like Feedbin. I've been with them for the last year or however long and have been fairly happy.

thisishugo• 12 years ago

I'll second support for Feedbin. The interface is clean and uncomplicated, it's so cheap that it really isn't worth my time to self-host, and it works with my RSS apps of choice.

dyslexicmonkey• 12 years ago

How does this solve the problem of another DDoS against some other RSS reader? Are you going to suggest that if Feedbin gets attacked next, to hop to the next product?

publicfig• 12 years ago

I've been using Digg Reader for a while and I'm actually kind of shocked that most people haven't moved to that. It has its bugs (sometimes showing incorrect numbers, the mobile app locks up sometimes), but it's honestly the best alternative that I've found so far.

Maybe it has to do with its free-ness, as people worry about them shutting doors like Google Reader, but if you're looking for a free solution then I'd definitely recommend it.

li-ch• 12 years ago

If more users use Feedbin, then it will also be DDoSed and blackmailed. I think self hosting is the only solution here.

rifleman• 12 years ago

Any suggestions on the best RSS reader to self-host?

Spittie• 12 years ago

I like TT-RSS, mostly because it's easy to install, doesn't require a beefy machine, and support themes and plugins.

For example, I use it with the feedly theme (https://github.com/levito/tt-rss-feedly-theme) and af_feedmod to get a full text feed for various sites (https://github.com/m42e/ttrss_plugin-af_feedmod).

Concours• 12 years ago

If you don't mind paying for rss, https://www.feedsapi.org is a decentralized option, you can use it to turn evernote or instapaper into an rss reader on the fly.

gtufano• 12 years ago

I'm happy with Fever° (http://www.feedafever.com), that I host on an atom server on OVH with no performance problems.

asaddhamani• 12 years ago

Since it hasn't been mentioned yet, I'd like to suggest NewsBlur[1].

[1]https://github.com/samuelclay/NewsBlur

fooqux• 12 years ago

I'm in the same boat. Was thinking of leaving for awhile, feel kind of bad this is what pushed me off the edge.

For me, I stopped and thought about how I access my RSS feeds. I used to be a pure desktop RSS reader, and then I started using both my phone and my desktop, and since Google Reader shut down I've mostly just been using Feedly on my phone. Since I only check my feeds on one device now, I don't need to worry about syncing across platforms, which is the primary purpose of Feedly in my opinion.

If that sounds like you, and you're on Android, check out gReader. While it can integrate with Feedly and a few other services, it can also just act like a "dumb" RSS reader and just download the feed content to your phone instead of relying on a sync service. So far I'm enjoying the experience.

benrapscallion• 12 years ago

try newsblur!

dewey• 12 years ago

The original posting on their blog: http://blog.feedly.com/2014/06/11/denial-of-service-attack/

We are working in parallel with other victims of the same group and with law enforcement.

Last.fm is also experiencing "network difficulties" for a few days now, I'm curious if they are also on the same group.

[0] http://status.last.fm/

jackgavigan• 12 years ago

I wonder why they're not using Cloudflare.

hueving• 12 years ago

Cloud flare is a protection racket. Some people don't use them on principle. They are the vendor selling chastity belts to stop rape. It is in their best economic interest that these attacks continue.

It's sad that to run a service now the expectation is to shovel money to another service to absorb UDP packets.

vdaniuk• 12 years ago

It is a protection racket ONLY if they are aiding or doing the attacks. I don't see how protecting a company from DDoS attacks is a protection racket by itself, care to elaborate?

mantrax5• 12 years ago

Wow. FYI racket is defined as offering to solve a problem that does not exist, or that would not exist if the offerer wouldn't force it upon you.

Unless you're claiming the blackmail group is made up of Cloudflare employees, you should choose your words more wisely.

vollmond2• 12 years ago

That's like saying bodyguards are a protection racket because muggers and assassins exist. Yes, it sucks to have to pay for defense, but that doesn't mean the problem is your defense vendor's fault, or that said vendor has done anything wrong at all.

xeroxmalf2• 12 years ago

CloudFlare offers a free tier as well that provides protection.

planckscnst• 12 years ago

Unless you are intending to accuse Cloudflare of aiding illegal activity in order to sell services, you may want to change your statement, as this could be considered libel.

gkya3• 12 years ago

I have upvoted the comment to protest HN people downvoting comments that they disagree. The comment is by no means spam, off-topic, etc.; the only problem is that it lacks one-or-two links to some backing information.

joeblau• 12 years ago

I was just thinking the same thing. I have a website that I run and I was DDoSed one week and got over 1 million page requests but Cloudflare deflected most of the traffic. My New Relic logs were crazy because it showed that traffic was WAY up; I immediately knew what happened though.

MikusR• 12 years ago

Seems that they are in a process in starting using it.

tdicola• 12 years ago

I don't know anything about Cloudflare, but isn't using a CDN with dynamic web-apps difficult? Sure you can host static content like javascript, CSS, images, etc. but caching stuff like what feeds, articles, etc. you've read can't be easy or efficient for a CDN.

gleenn• 12 years ago

They provide more than just a CDN. They manage your DNS so there are many more things they can do to deflect attacks.

zuck92• 12 years ago

It's now showing CloudFlare Error 522 (Connection timed out)

Not sure if they integrated CloudFlare now or it was present before.

gcarre• 12 years ago

they seem to be using Cloudflare now: https://www.dropbox.com/s/6sx8li6d0eioxwt/Screenshot%202014-...

phatboyslim• 12 years ago

If you read the comments on the Feedly blog, they are using Cloudflare.

at-fates-hands• 12 years ago

Not sure what plan they're on or what kind of revenue they generate, but even the $200/month business plan is a life saver considering some of the features:

- Advanced DDoS protection (layers 3,4 and 7)

- 100% uptime guaranteed

- BGP Origins protection

- Web Application Firewall

coldcode• 12 years ago

I guess the demise of XP is still a long ways off. If there were no XP users remaining, could there still be enough hackable computers to create a large enough botnet?

danielweber6• 12 years ago

Is that really a correlation? Have we seen a decrease in zombie counts as XP machines attrition out?

xeroxmalf2• 12 years ago

Considering a lot of intrusions happen via the web browser / plugins installed in the web browser (flash/java come to mind right off the bat), I don't think XP being retired has anything to do with future botnet sizes.

aikah• 12 years ago

it's a coktail,you cant only blame flash or java,the browser and the os running these stuff shares some responsibility.

zuck92• 12 years ago

Even if everything was up to date, you still can't make sure that you don't get infected. The common hobby for kids these days: finding and writing exploits

frankus• 12 years ago

A lot of these types of attack use amplification attacks (https://www.us-cert.gov/ncas/alerts/TA13-088A), often a carelessly-configured time server or name server, where only a small number of hosts are needed to wreak havoc.

septerr• 12 years ago

When they said in their post that they were working to neutralize the attack, I started wondering how they are doing that. If anyone else is curious, this article - http://www.infosecisland.com/blogview/22518-How-to-Protect-a... - briefly describes how DDoS are neutralized.

Sharphunter• 12 years ago

One of the problems is that the Android app is draining the battery whilst it can't connect to the Feedly servers.

frou_dh• 12 years ago

How's this blackmail? What secret are they threatening to reveal?

lebarton• 12 years ago

They are probably saying "Give me money or I am going to continue DDoSing your site."

dan1234• 12 years ago

It's not blackmail, just plain old extortion.

rickyc091• 12 years ago

Yep, from their blog.

"2:04am PST – Criminals are attacking feedly with a distributed denial of service attack (DDoS). The attacker is trying to extort us money to make it stop. We refused to give in and are working with our network providers to mitigate the attack as best as we can."

http://blog.feedly.com/2014/06/11/denial-of-service-attack/?...

jasallen• 12 years ago

A quick google shows 'blackmail' definition can either be restrictive to secrets as you say or can encompass 'extortion' depending on the definition you use.

dailen• 12 years ago

Best thing they can do is offer a bounty :-D that seems to be extraordinarily effective

aliasnexus0• 12 years ago

I've been using Fever since Google Reader shutdown: http://feedafever.com/

I have put together install instructions here: http://thornelabs.net/2014/05/10/install-fever-rss-reader-on...

stevejyim• 12 years ago

yes.

NicoJuicy• 12 years ago

I posted it on HN a month ago, but it wasn't popular then: http://selfoss.aditu.de/ (yes, it's opensource)

n1ghtmare_• 12 years ago

What kind of low life do you have to be to do this kind of crap ? Is this what "hackers" do these days ?

gkya3• 12 years ago

I wonder why nearly every self-hosted alternative RSS-reader here is a web-app; isn't using a desktop-application desirable? Like Firefox, Thunderbird, Liferea[1], Akregator[2], and probably lots of OS X applications?

[1] http://lzone.de/liferea/

[2] http://www.kde.org/applications/internet/akregator/

kingnight• 12 years ago

So much of what you're reading in RSS-reader is web content, naturally you'd want to click through things in your existing browsing experience. At least that's how I view it. I'd like to use a desktop-app but find myself never opening running it and instead jumping to feedly/google-reader etc.

I'd really like to have a desktop-app w/o web service that sync'ed to my phone which I also like to read rss on.

alxndr2• 12 years ago

Multiple devices is the main reason I rely on a web service.

gkya3• 12 years ago

My solution was (and still is) using Pocket[1] to read. I absolutely hate reading on laptop/desktop. I instead check out the feeds every so often using a desktop reader (elfeed nowadays, but seeking for sth. else as I'm no longer using Emacs), and save those I want to read to Pocket. This way I do not need an app that syncs my feeds on each device I have, but rather only Pocket on each of them.

[1] http://getpocket.com/

spyder• 12 years ago

It can provide "your existing browsing experience" without being a web app: by running as a browser extension locally.

__mp3• 12 years ago

Because people want to sync their feeds and their current reading state across multiple devices (desktop, laptop, tablet, phone...). I also read my feeds somewhat sporadically: Since RSS usually only contains the last ~10 entries I would need to open my feed reader at least once a week to avoid missing an article.

I don't think I'm an RSS power user since I mostly use it for comics (~30), some techblogs and a couple of tumblr feeds.

I'm currently using bazqux[1] since it is fast and has a no-frills interface.

[1] https://bazqux.com

kwestro• 12 years ago

It looks like they got hit by a second one today.

Feedly gets hit by DDoS attack, refuses to give in to blackmail

Related Stories