Denial of Service
March 29th, 2007UPDATE 2: In Summary – Bad Behavior
But first, I will say that I’m quite sure that this wasn’t done by the U.S. government. Why? Because a few U.S. military and government zombies were involved with the attack. If this was a U.S. government operation, I seriously doubt that they would use zombies from their own networks. I know, never underestimate the stupidity of the U.S. government, but even I don’t think they would be that stupid. Allow their machines to be compromised by a bot herder, probably a 14 year old Russian boy? Now that sounds more like it.
People with multiple propellers in their beanie caps have offered advice; everything from Apache modules to suggestions on re-writing the caching behavior of WordPress (HA!) to onion routed webservers in undisclosed locations. The best tip (in terms of ease of implementation, and chances of working), however, came from a Blue Host support tech. (Blue Host is the company that hosts Cryptogon.) I asked one of their guys to look at what happened and he suggested the Bad Behavior plugin.
I’d heard about BadBehavior, but I thought it was just for comment spam. Oh no, Grasshopper. That thing is a soup to nuts bullshit reduction system.
I like the sound of this:
Bad Behavior runs before your software on each request to your Web site, so if a spam bot does visit, it will receive nothing, and your software never runs. This reduces the amount of server CPU time, database activity and bandwidth spent on processing robots which are just harvesting your site and delivering junk.
And this:
“Online risks are becoming more complex and pervasive by the day,†says the home page of the Cyveillance web site.
Indeed, one of the risks is that your Web site might be targeted by Cyveillance.
The company says that it crawls the Internet looking for phishing scams, identity theft, illegal credit card numbers, trademark and copyright infringement, and more. It’s also been known to work on behalf of the government to spy on whistleblowers who expose waste, fraud and abuse. Some have even alleged that Cyveillance bots attempt to illegally hack into Web servers.
Cyveillance uses robots which crawl your Web site pretending to be a legitimate Web browser and completely ignoring your robots.txt file. Then it tries to figure out whether you’ve downloaded any illegal music, or said something bad about some company. It then sends you threatening letters ordering you to take your site down, even when you haven’t done anything wrong.
Bad Behavior doesn’t just block spammers. It’s meant to target any bot which overloads a Web site, attempts to hack in, delivers spam, acts in an unethical manner, etc.
By relying on analyzing the HTTP requests themselves, rather than simply the IP address, Bad Behavior has blocked Cyveillance almost from the very first release last year, regardless of what IP address range they move to in order to hide their connections. An audit of six months worth of logs shows that Bad Behavior was able to successfully identify and block Cyveillance bots even when they used previously unknown IP address ranges.
In other words, this is exactly what I need. I’ve installed Bad Behavior on Cryptogon and Farmlet…
I don’t know if this will work, but it sure seems like it will. Homeland Stupidity give this software away for free. I’m going to allocate a portion of Cryptogon’s March earnings to assist with further development of this software. Thanks Homeland Stupidity / Bad Behavior! And even more thanks to Cryptogon contributors!
– – – End Update – – –
UPDATE 1: It Stopped
It’s over. It stopped, for now. I don’t know why. Anyway, there you have it.
* Queue up the Twilight Zone theme music *
Maybe that was just the warm-up round. Now that the attacker knows how much my server will tolerate, he/she can more effectively target resources in the future? If you want to strip a bolt, it’s helpful to know how many threads it has before you start turning your wrench. Just a guess. I’m falling back on what I learned about offensive information warfare when I was in school long ago.
– – – End Update – – –
Cryptogon is experiencing a distributed denial of service attack. These aren’t junk Java spam crawlers. They’re IDing themselves as various operating systems and browsers. Each zombie runs a multithreaded get of / until BlueHost’s DOS protection system temporarily suspends my account to protect the server. The offending bots leave. Then others show up.
If you see a BlueHost page with a CPU warning, that is why.
I considered providing a list of IPs to launch strikebacks on, but I thought that fighting back might get ME in trouble. It’s also pointless. The attacker could have thousands of zombies under his/her command. The poor idiots who own the offending machines don’t even know that their systems are pWnEd by a bot herder.
I’m going to try to see what I can do about this.
Why not a plugin for WordPress? Load any single page five times in under a minute, for example, and that session is done. Is there some Apache level thing I could do with htaccess?
Anyway, sorry for the inconvenience.
Cryptogon Reader Contributes $20
March 28th, 2007Thanks MS!
Russian Intelligence Sees U.S. Military Buildup On Iran Border
March 28th, 2007Via: rian.ru:
Russian military intelligence services are reporting a flurry of activity by U.S. Armed Forces near Iran’s borders, a high-ranking security source said Tuesday.
“The latest military intelligence data point to heightened U.S. military preparations for both an air and ground operation against Iran,” the official said, adding that the Pentagon has probably not yet made a final decision as to when an attack will be launched.
He said the Pentagon is looking for a way to deliver a strike against Iran “that would enable the Americans to bring the country to its knees at minimal cost.”
He also said the U.S. Naval presence in the Persian Gulf has for the first time in the past four years reached the level that existed shortly before the invasion of Iraq in March 2003.
Col.-Gen. Leonid Ivashov, vice president of the Academy of Geopolitical Sciences, said last week that the Pentagon is planning to deliver a massive air strike on Iran’s military infrastructure in the near future.
A new U.S. carrier battle group has been dispatched to the Gulf.
The USS John C. Stennis, with a crew of 3,200 and around 80 fixed-wing aircraft, including F/A-18 Hornet and Superhornet fighter-bombers, eight support ships and four nuclear submarines are heading for the Gulf, where a similar group led by the USS Dwight D. Eisenhower has been deployed since December 2006.
The U.S. is also sending Patriot anti-missile systems to the region.
Oil Jitters
March 28th, 2007Via: Bloomberg:
Oil rose for a seventh day in New York, climbing close to $65 a barrel, on concern a dispute over Iran’s capture of British servicemen would escalate, disrupting supplies from the Middle East.
Oil surged $5 in seven minutes late yesterday on speculation the U.K. would mount a rescue attempt, and rose today by more than $2 a barrel. U.S. stockpiles of gasoline were already falling before the standoff between Britain and Iran, and analysts expect the Department of Energy to report today they fell again last week, the seventh straight decline.
“It shows how nervous and twitchy people are about the situation in Iran,” said Michael Davies, an analyst at the commodity broker Sucden (U.K.) Ltd. in London. “Military strikes are a possibility, although it’s a long way off, if tensions keep rising. You can guarantee more people will take outright bets on prices rising if this continues.”
Almost a quarter of the world’s oil flows through the Strait of Hormuz, a narrow waterway between Iran and Oman at the mouth of the Persian Gulf. Relations between Iran, which sits on the world’s second-largest proven reserves, and western governments are already frayed because of the country’s nuclear program.
China Shifts to Euros for Iran Oil
March 28th, 2007Via: Intel Daily:
China’s state-run Zhuhai Zhenrong Corp, the biggest buyer of Iranian crude worldwide, began paying for its oil in euros late last year as Tehran moves to diversify its foreign reserves away from U.S. dollars.
The Right to Raw Milk
March 27th, 2007Excellent raw milk article.
Via: Acres USA:
ACRES U.S.A. Fresh or raw milk producers are having problems just about everywhere, such as in Michigan, where they pulled over a guy and destroyed his product and raided his house and took the records — and similar things have happened in state after state. I’d like to have your take on all this, especially how it has impacted your operation recently.
MARK McAFEE. That’s a big discussion because there are massive interests — the pharmaceutical interests, doctors, the current medical practitioners’ associations, all the politics of creameries, the national branded organic dairies as well as national branded conventional dairies, the mega-dairies, the FDA, the USDA — that are completely in alignment against short-shelf-life, high-value-added products. They are interested in long-shelf-life, low-liability products, and they want to control that market segment entirely. Raw milk represents a kind of interloper to them — it’s something that keeps them from having complete control of the markets. It also has some incredible healing properties that would ultimately ruin the pharmaceutical industry as well as the current paradigm of sick health care versus preventive health care. People make lots of money on sick people — they don’t make a lot of money on people who prevent disease and illness.
Research Credit: Ran Prieur
34% of Homeowners Don’t Know What Type of Mortgage They Have
March 27th, 2007WOW!
Via: Yahoo:
In the survey conducted by Gfk Roper, homeowners with mortgages were asked what type of mortgage they had. A stunning 34 percent of the homeowners had no idea.
California’s Hidden Third World Slums
March 27th, 2007Via: Los Angeles Times:
Like most of their neighbors in the sprawling, ramshackle Oasis Mobile Home Park, the Aguilars have no heat, no hot water. On cold nights, the family of eight stays warm by bundling up in layers of sweaters and sleeps packed together in two tiny rooms.
Bathing is a luxury that requires using valuable propane to boil gallons of water. So the farmworker clan spends a lot of time dirty.
Jose Aguilar, a wiry 9-year-old, has found a way around the bath problem. He just waits until dinner. “My mom makes frijoles,” he said, “then I take a bath in that water.”
Jose and his family live in a world few ever see, a vast poverty born in hundreds of trailer parks strung like a shabby necklace across the eastern Coachella Valley.
Out here — just a few miles from world-class golf resorts, private hunting clubs and polo fields — half-naked children toddle barefoot through mud and filth while packs of feral dogs prowl piles of garbage nearby.
Thick smoke from mountains of burning trash drifts through broken windows. People — sometimes 30 or more — are crammed into trailers with no heat, no air-conditioning, undrinkable water, flickering power and plumbing that breaks down for weeks or months at a time.
“I was speechless,” said Haider Quintero, a Colombian training for the priesthood who recently visited the parks as part of his studies. “I never expected to see this in America.”
Riverside County officials say there are between 100 and 200 illegal trailer parks in the valley, but the Coachella Valley Housing Coalition says the number could be as high as 500.
California Rural Legal Assistance says as few as 20 parks are legal, and they are often as dilapidated as the illegal ones. When county inspectors locate a park without permits, they prefer to let owners bring the place into compliance through loan and grant programs rather than evict the tenants.
Some of the largest and poorest parks are on the Torres Martinez Indian Reservation where they are not subject to local zoning laws and the county can’t monitor safety, hygiene and building standards. The reservation is also home to the worst illegal dumps of any tribe in California, Arizona or Nevada, according to the Environmental Protection Agency. The federal agency has closed 10 of the 20 most toxic dumps and cited four of the largest trailer parks for health violations.
Despite the conditions, park owners say they are providing a vital service in an area where housing prices have soared.
“Before the parks, they were living in their cars, in the desert and bathing in the canals. Five guys would pay 50 bucks a month to share a camper shell,” said Scott Lawson, a tribal member and co-owner of the Oasis park on the reservation. “Nobody cared when they lived like that, only when they moved into trailers. You can’t expect the poorest to live like the wealthiest. They feel comfortable here; it’s like being back in Mexico. They tell me that.”
Lawson’s 300-trailer park has been cited by the EPA for clean-water violations and was recently ordered to stop pumping raw sewage into the nearby Salton Sea.
“We had some citations about water but it’s because we didn’t know how to test it,” he said. “I’m not ashamed of my place. There are a lot worse places than mine.”
Exactly how many people live in the trailer parks is unknown, but social workers estimate tens of thousands. The biggest park, Desert Mobile Home Park, or “Duroville,” has more than 4,000 residents and can be seen off California 195 near Thermal. Others are on private property and virtually invisible to passing motorists.
The tenants are almost entirely Latino farm or construction workers. Many are in the United States legally, but plenty are not. Their average income, according to county officials, is about $10,000 a year. Many parents rent out their children’s rooms for extra money, leaving kids to sleep on floors or in sheds. Many families keep warm by burning grape stakes, which fill their trailers with toxic fumes.
Trying to Take “No Impact Man” Seriously
March 27th, 2007I read, The Year Without Toilet Paper, a New York Times piece about the “No Impact Man” media circus, and I sunk down into my chair and held my head in my hands. Are people just cracking up? Is it an inability to look the situation we’re facing in the eyes? Is it an effort to paint people who think about the environment as dimwits and hopelessly out of touch?
“No Impact Man” seems like a sort of limited hangout for limousine liberals who are going with the clean, green meme at the moment. There are designer clothes and vaguely hip, wealthy people who live in a fashionable part of Manhattan. At any moment you think it’s going to turn into an ad for a new iPod, or maybe Paris Hilton will show up in a greasel Hummer. They’re not doing anything even remotely substantive, but they’re going about it in a slick manner. There’s a blog, a book and a movie… And, as mentioned, the ridiculous New York Times has initiated coverage. In short, “No Impact Man” seems like a green version of Jackass.
But is that all?
I’m really trying to see a positive side to this. Let’s face it: Most people won’t consider a reality based approach to sustainability. It’s just too damn hard; dealing with dirt and weeds and shit, etc. My guess is that backbreaking labor is only an abstract idea to the HDTV crowd.
Maybe the gestures demonstrated by “No Impact Man” can serve as a germ that will grow into something more substantive than a blog, a book and a movie. And coverage from the New York Times…
In theory, cities should be able to innovate quite a lot in this area. As obscene consumers of energy and resources, cities have lots of opportunities for improvement. I would think that even incremental changes could produce significant results. In any city, you will have some number of people who get it, even if they represent only a fraction of a percent of the population. These people have many face to face opportunities to win the hearts and minds of the zombie consumer/polluter class, which is virtually everyone, rich and poor alike.
Another aspect of cities that’s interesting is money. Most of the money is in cities, even if it’s concentrated in very few hands. Therefore, if city dwellers decided that they wanted to implement clean technologies, they might be in a better position to do that than rural, back to the land types like Becky and me.
So, I don’t know. On the one hand, “No Impact Man” seems like a silly joke, hardly worth serious consideration, given the dire situation we’re all facing. On the other hand, if it convinces even a small number of people to modify their zombie consumer/polluter ways, what the hell, more power to these people!
Cursing the darkness is of limited use, and while lighting a single candle in a vast, blacked out wasteland isn’t good for much, at least it starts to give you an idea of how vast the blacked out wasteland is. Manhattan is one of the weirdest places on the planet. (Tokyo is probably weirder, although I’ve never been there.) You can exist, in that thing, totally abstracted from the underlying reality of the natural life support systems of the planet. (The thing I noticed most about Manhattan, besides the smell in the subway stations, and chained and padlocked potted plants, was that, anywhere or time of the day, there seemed to be no escape from the unnatural sounds of the city.) I can see how Colin and Michelle might think that they were taking radical action by not getting their food and coffee delivered to their apartment and buying organic vegetables.
If Colin and Michelle are serious, they will start looking at the decades old square foot gardening strategies and composting toilets as nitrogen sources for groundlevel and rooftop gardens. Who knows? In time you might see “Green Buildings” where residents outfit entire buildings with wind and solar systems. The immediate priority should be solar hot water systems, the best bang-for-the-buck in terms of solar energy conversion. Hot water is the single biggest use of energy in domestic environments. Solar hot water systems are relatively cheap, simple and yield very tangible results.
You can talk carbon, rooftop gardens and solar hot water all day, but without a major consciousness upgrade—a philosophical pole shift, or whatever you want to call it—governments will increasingly be pouring old fascism into new, green bottles. People have to want this, and they have to build it themselves.
In cities, though, very few people want this. Why are they in cities to begin with? Lots of people say they like cities because of the “culture.” In reality, it’s about the money, honey. (Not necessarily the Money Honey.) There’s a perception that great opportunities to make money exist in cities. It’s a trap, of course, because the cost of living in those places is extreme to the point of being absurd. The reality of cities is mostly about chasing money in an effort to pay rent and keep the heater turned on in the winter. Is a substantive, bottom up, green epiphany possible under these circumstances? I doubt it, but for people who won’t (or can’t) abandon the sinking ship, bailing water furiously with Dixie cups provides a sense of purpose and, perhaps, a satisfying distraction from the grim political, economic and social aspects of the situation.
Human Sheep Chimeras
March 25th, 2007Via: Daily Mail:
Scientists have created the world’s first human-sheep chimera – which has the body of a sheep and half-human organs.
The sheep have 15 per cent human cells and 85 per cent animal cells – and their evolution brings the prospect of animal organs being transplanted into humans one step closer.
Professor Esmail Zanjani, of the University of Nevada, has spent seven years and £5million perfecting the technique, which involves injecting adult human cells into a sheep’s foetus.
He has already created a sheep liver which has a large proportion of human cells and eventually hopes to precisely match a sheep to a transplant patient, using their own stem cells to create their own flock of sheep.
The process would involve extracting stem cells from the donor’s bone marrow and injecting them into the peritoneum of a sheep’s foetus. When the lamb is born, two months later, it would have a liver, heart, lungs and brain that are partly human and available for transplant.
