Oh, the irony

October 17, 2003 11:26 AM

Last night Hosting Matters (and their related resellers) was taken down by a DoS attack attributed to Al-Qaeda. This attack not only disabled the intended target but took down some 3000 sites for a significant period of time. Is this an example of cyber-terrorism or some kid with a script?
posted by cedar (48 comments total)

Umm, for it to be terrorism, shouldn't someone actually be, you know, terrified?

This is just a petty attack by some script-kiddies on a "target" of no importance whatsoever.
posted by kickingtheground at 11:32 AM on October 17, 2003

This is a little lean on the link aspect, no?

People, there is no rush to post stuff to the front page. If you don't have a good link, please don't post at all.
posted by signal at 11:38 AM on October 17, 2003

"This is just a petty attack by some script-kiddies on a 'target' of no importance whatsoever"

I agree that the targeted site isn't a big deal, but it took down a fairly large network in the process. The collateral damage to the other 2999 sites shouldn't be overlooked. I have no idea (aside from a few blogs) what these other sites consist of, but I imagine a few folks lost an evenings revenue somewhere along the line.

Probably not enough to inspire terror, but certainly not insignificant.
posted by cedar at 11:38 AM on October 17, 2003

attributed to Al-Qaeda

attributed by who? On what evidence?
posted by ook at 11:51 AM on October 17, 2003

You'd think their little green tinfoil hats would protect them from the al Qaeda menace.
posted by subgenius at 11:54 AM on October 17, 2003

Invariably, those of us who show the most bravado are the ones who are most scared.
posted by jpoulos at 11:58 AM on October 17, 2003

Ook, that is an excellent question. I work for Hosting Matters. It has not been attributed to anyone by us. Our statement on the attack is posted here. The text relevant to this conversation:

"Note that because the investigation into the current attack is ongoing, we cannot release any details as to the substance of the attacks, the target site, or the origination point(s)."

Any statements about who may have been behind the attack are the opinion of those making them. We have not attributed it to anyone at this time.
posted by Xkot at 11:59 AM on October 17, 2003

Supporters of a number of Al Qaida-affiliated forums registered to Saudis and running in Malaysia basically declared an online Jihad against Haganah after 8 such sites lost their third party DNS service a couple of weeks ago (the DNS provider decided they didn't want to provide services to such folks).

The post, on its face, does not claim LGF was attacked by al Qaeda.

Reading between the lines, I'd guess that some folks lobbied service providers for online boards deemed supportive of al-Qaeda. Service providers apparently withdrew services, and denizens of those boards apparently looked for revenge.

I'm going to further guess that Osama didn't green-light the op.
posted by sacre_bleu at 12:00 PM on October 17, 2003

Al-Qaeda? Who let people with boxcutters into the server room?
posted by stonerose at 12:00 PM on October 17, 2003

You'd think their little green tinfoil hats would protect them from the al Qaeda menace.

:)

i'm sure this'll give charles what's-his-face loads more self-righteous/-deluding indignation to beat off furiously to. this time it's personal! they brought to fight to his doorstep! alert the militia! snort.
posted by donkeyschlong at 12:02 PM on October 17, 2003

Two gems from the LGF thread:

1: #139 gijoe 10/17/2003 11:12AM PST
yeah like arabs know how to use a computer...

2:#124 aaron 10/17/2003 08:12AM PST
... Knocking off our web site is easier than, say, knocking me off, what with that loaded gun that's here beside my keyboard...

Stellar.
posted by signal at 12:08 PM on October 17, 2003

LGF: TO: aaron
RE: Are You Saying...

That this was a Denial of Service attack against HostingMatters by an Islamist group(s)?

Chuck


http://littlegreenfo...
Yes Chuck, that is exactly what I am saying....Knocking off our web site is easier than, say, knocking me off, what with that loaded gun that's here beside my keyboard...


Me: Invariably, those of us who show the most bravado are the ones who are most scared.

I rest my case.
posted by jpoulos at 12:09 PM on October 17, 2003

Jinx.
posted by signal at 12:11 PM on October 17, 2003

i'm not really sure that this is the place to go after Charles or anyone at lgf. i'd have to say that when people have an opinion different from yours, calling them people wearing "little green tinfoil hats" because you don't agree is tantamount to the bull that the dems and republicans throw at each other, saying that one is aways the furthest left- or right-wing if they're on opposing sides.

Personally, I don't think that this "attack" was at LGF, though there are quite a few other sites on HostingMatters that might have been. We'll all find out eventually what the deal is. Needless to say, this is probably not a FPP, unless we really started to see hosting providers of politically motivated websites get DOSed.
posted by djspicerack at 12:11 PM on October 17, 2003

Maybe it was retalliation because of some anti-US websites which were shut down but I'm just as inclined to believe that the LGF crew was trying to generate some negative publicity for anybody who's off-white. In the mean time they're saying he needs money and is starting a subscription option. I'm more inclined to believe that it'll just end up being script kiddies but as long as they can post their conspiracy theories I might as well post mine.
posted by substrate at 12:12 PM on October 17, 2003

Al Qaeda: We'll show those infidels! We'll take their BLOGS DOWN! AHAHAHA!

Really now -- a hard allegation without any supporting links...
posted by Ogre Lawless at 12:12 PM on October 17, 2003

Hey, folks, they've already linked this MeFi post in that thread. Do we really want to start another pissing match with the LGF crowd?
posted by Wulfgar! at 12:13 PM on October 17, 2003

*buys signal a Coke*
posted by jpoulos at 12:13 PM on October 17, 2003

Uh-oh... that was a pretty lame post. My apologies.

The information that led to my post was based on the words of the owner of Internet Haganah stating that he was the target. Aside from saying this on his own site (once again, blowed up) he stated it in the LGF comment thread originally linked.

"Hosting Matters has removed our site (haganah.us) to some undisclosed location. haganah.org.il is at another ISP. the 'mirror' of the main counter-terrorism blog is not in real good shape, missing about two months of content, but life goes on."
-------
Are You Saying... That this was a Denial of Service attack against HostingMatters by an Islamist group(s)?

"Yes Chuck, that is exactly what I am saying. Haganah is something of a known quantity in places like Saudi Arabia and Egypt and Syria. These guys take their web sites very seriously, since the sites are an important part of their communications infrastructure. This situation has been developing over the last few weeks."

I never meant to give the impression that LGF had been attacked and my only source is the words of the owner of the Internet Haganah site.
posted by cedar at 12:14 PM on October 17, 2003

O-dub was affected by it too. Maybe all those Britney pics got him on the wrong side of the enemy™.
posted by Ufez Jones at 12:21 PM on October 17, 2003

calling them people wearing "little green tinfoil hats" because you don't agree is tantamount to the bull that the dems and republicans throw at each other ...

Can we call them names because LGF is a breeding ground of violent anti-Muslim prejudice?
posted by rcade at 12:21 PM on October 17, 2003

cedar,

I will say - that if it ever did come out that Hosting Matters felt that Internet Haganah was a specific target of a DOSing, that might be a good story. Though that has yet to be confirmed.

Hopefully, media on the Web won't start picking this up as a mainstream story without confirming anything.
posted by djspicerack at 12:24 PM on October 17, 2003

Just so's you know ... MetaTalk
posted by Wulfgar! at 12:24 PM on October 17, 2003

The owner of LGF never said that he was the target, in fact he said the opposite. I did like the tinfoil-hat joke though, there are definitely some loons commenting at that website.
posted by cell divide at 12:25 PM on October 17, 2003

Al-Qaeda is BANNED and DELETED!
posted by trondant at 12:26 PM on October 17, 2003

trondant - {clink} good one.

Ufez Jones - just clicked through from Oliver Willis' site to Dean's World - the 9th comment down seems to be from "Annette" from Hosting Matters. She says "we suspect is the actual target of the attack (commenting on/reporting on Middle East issues) is going to have to be moved to an alternate network to relieve our main network from this sort of activity." Which is where the idea of it being Internet Haganah came from.
posted by djspicerack at 12:32 PM on October 17, 2003

djspicerack: I didn't call them "people wearing 'little green tinfoil hats' because [I] don't agree" with their opinions. That would be rude. Rather, I implied they were paranoid wingnuts if they actually believe that al Qaeda attacked their interweb server.

Apples and oranges.
posted by subgenius at 12:34 PM on October 17, 2003

Subgenius - point taken - I think the only valid argument here is someone attacked their host, but it seems they may have been after a particular client that wasn't LGF. We will probably not find out who was behind the DOSing, so I understand where you're coming from and agree.
posted by djspicerack at 12:38 PM on October 17, 2003

I'll wait and see what HostingMatters says to determine who was the target and who did it.
posted by mathowie at 12:51 PM on October 17, 2003

'nuff said. "Annette" at Hosting Matters has come out and posted that Hosting Matters would not be getting into political debates, nor would they be releasing the origination points of the DOS attacks.
posted by djspicerack at 1:34 PM on October 17, 2003

"Reading between the lines, I'd guess that some folks lobbied service providers for online boards deemed supportive of al-Qaeda."

We're not talking the squishy-sounding "deemed supportive of Al Qaeda" sympathizer websites here, we're talking the actual "official" websites of groups on the State Dept. terrorist watchlist. Internet Haganah's homemade database (link goes to Google cache) of such hard-core sites runs into the hundreds. Some of the sites were soliciting online donations to terrorist groups. And many of them were hosted on American and British ISP's--at least, until Haganah spent time tracking down who owned and hosted the sites and contacted the ISP's (and, if warranted, the FBI) about them, since they're generally in violation of the ISP's terms of service, not to mention several federal laws. Haganah's HOWTO on documenting and shutting down terrorist sites (Google cache again) has also been invaluable to many people who may stumble across such sites accidentally.

Example of the blog's content and focus: On this one page (Google cache yet again), Haganah has...

1) a blurb from NBC News about Ansar al Islam in the US, and follows it up with links to the group's website, hosted in Myannmar/Burma, and their WHOIS and abuse info.
2) the domain info. for a Hamas website, which features promotional pictures and e-postcards of suicide bombers (!). Hamas is an illegal (in the US) terrorist group, and yet their hosting company is in Dallas, Texas. Haganah posts the WHOIS info. on the site and contacts the abuse e-mail for the ISP. Haganah highlighted the site in September and it's apparently still up and running, so unless they switched ISP's, it seems that their efforts are not always successful.
3) a mention that people at as-sahwah.com--home of such stimulating bulletin board threads as "Why I support Sheikh Usama bin Laden"--are apparently making death threats against Internet Haganah and its webmaster specifically. Their ISP info (hosted in London) and terms of use are posted to the blog and added to the database.
4) a post from Israeli news about an IDF commander's advice for Americans in Iraq vis-a-vis Bradleys and tanks.

You get the picture. It's a pretty amazing undertaking for one blogger: Internet Haganah is mainly the work of one geek-with-a-mission named Aaron. It would indeed be ironic, and a bit of a back-handed compliment, if it really were a terrorist group that DOS'ed Hosting Matters to go after the site. And while Aaron may hold opinions similiar to many of the participants on LGF, the two sites are AFAIK totally unrelated and unaffiliated, except for sharing the same company as their hosting provider.
posted by Asparagirl at 1:38 PM on October 17, 2003

DOS attacks are standard at all ISPs today, with and without provocation or specific targets. Often, they are the result of over-enthusastic network probes rather than intentional, malicious attempts to put out the pilot light on an ISP.

Because they use hijacked servers, real DOS attacks tend to come from countries where the locals don't have sufficient mastery of the languages typically used in FAQs, how-tos, and technical manuals (English, French, German, Japanese, etc.), meaning their servers are poorly protected because those responsible for them also do not have sufficient technical knowledge that they would get by being able to read the documentation. It's a chain of events which results in, eventually, everyone at some time getting DOS attacks from everywhere. Which means a DOS attack could easily come from Malaysia, Indonesia, or anywhere else with a huge Muslim population (not to mention that "Muslim" nations are numerous and populous, which further increases the chance that Muslims could appear to be responsible).

So maybe some Muslims did go after this one guy. But maybe not.
posted by Mo Nickels at 2:01 PM on October 17, 2003

Doing a little more digging, it seems that Al Qaeda websites (no, not sympathizers, but the real deal) have made statements against Aaron and Haganah in the past, and he's been keeping in touch with the ADL out of safety concerns. Other sites that have called for attacks on "Al Haganah" can be found in Aaron's comment here in a different LGF thread.

As for the "show the money" proof that it was Haganah in particular that was attacked from among the 3000 sites, Annette from Hosting Matters says in the LGF thread in the comment right before Aaron's, with regards to her earlier post: "By the time the network came back up, everyone was already well aware of the site that was the target, so that's hardly telling people something they don't know..." Still doesn't prove that it was a terrorist group that did the DOS'ing, but given the history here, who else are people gonna suspect?
posted by Asparagirl at 2:56 PM on October 17, 2003

FYI: Hostingmatters' statement about the DoS is here. I was one of the 3,000 or so affected, and frankly I could care less if it was al-Qaeda or little Jimmy Lipschitz... it was only four hours. That's not any form of 'terror,' just an annoying, childish attempt to squelch free speech.
posted by moonbird at 3:16 PM on October 17, 2003

"That's not any form of 'terror,' just an annoying, childish attempt to squelch free speech."

Well, but if the free speech in question was an effective anti-terror site, then this was a form of terror in that it was anti-anti-terror (er, the double negative thing canceling out, and all), and that it hindered anti-terrorism activities.

Not to mention that maybe ISP's will think twice about hosting sites like Haganah if they might attract terrorist attention to the tune of massive outages and angry customers. That could be a more permanent way to hinder free speech than any one four-hour attack...
posted by Asparagirl at 3:30 PM on October 17, 2003

hmmm...was this really an act of al-Qaeda or the sinister machinations of... Bill Clinton?
posted by mcsweetie at 5:06 PM on October 17, 2003

hmmm...was this really an act of al-Qaeda or the sinister machinations of... Bill Clinton?

There's a difference?
posted by kickingtheground at 5:19 PM on October 17, 2003

Um, down with LGF

That's all I have to say.
posted by delmoi at 7:13 PM on October 17, 2003

besides linking to lgf (considering the level of playground antics here), no need to apologize cedar. great post, thanks!
posted by poopy at 7:51 PM on October 17, 2003

al-Qaeda ate my homework.
posted by nyxxxx at 8:10 PM on October 17, 2003

Rackspace, which hosts my website and those of several friends who belong to our co-op, is the victim of DDoS attacks all the goddamn time.

I blame al Qaeda.

It's ironic that we've been thinking of going back to Hosting Matters recently for that very reason.
posted by stavrosthewonderchicken at 8:24 PM on October 17, 2003

Wait...so it's okay for Annette to be making statements even thought hostingmatter's already released an official statement....

i bet someone's job security just went down the toliet....
posted by Stynxno at 8:31 PM on October 17, 2003

Annette's the owner, so I think her job is safe. :-)
posted by Asparagirl at 10:14 PM on October 17, 2003

Annette's the owner, so I think her job is safe. :-)

details......


;-P
posted by Stynxno at 5:36 AM on October 18, 2003

Just tried to visit lgf, instapundit, vodkapundit, and I can't get to anything. perhaps this is happening again.
posted by djspicerack at 10:58 AM on October 21, 2003

It is. Yesterday too, intermittently.
posted by Asparagirl at 11:22 AM on October 21, 2003

Hosting Matters has posted information on their forums, here.

Interesting. Seems like it is also a routing issue for the carriers that deliver their traffic. Thanks for the heads up, Asparagirl.
posted by djspicerack at 11:51 AM on October 21, 2003

One of the jihadi sites associated with Al Qaeda has admitted responsibility for the Hosting Matters attacks, which were indeed aimed at Internet Haganah. The motive was, as everyone presumed, payback for Haganah's work in getting terrorist groups' websites kicked off of ISP's and DNS providers. Those websites were important propaganda, fundraising, and collaborative sites for the terrorists, and Haganah was very successful in exposing them and getting the ISP's to stop hosting them. An excerpt from one report posted on as-sahwah.com:

Jew-boy's Site Goes Dooooooown!!!!!!!
Al-Qa'eedah supporters have alledgedly struck a deadly bow to the heart of the zionist site Internet Haganah...

Supporters of a number of Al Qaida-affiliated forums registered to Saudis and running in Malaysia basically declared an online Jihad against Haganah after 8 such sites lost their third party DNS service a couple of weeks ago (the DNS provider decided they didn't want to provide services to such folks). The result was that the sites dropped offline, and four of them remain offline...

Let's hope that he stays offline for a very long time, and that all of the Jihad sites taken down due to his interference are soon up and running again insha'Allah.

And to those who made a stand, may it count as hasanat for you on Yawm-ul-Qiyyamah.

posted by Asparagirl at 4:43 PM on October 21, 2003