The Central Intelligence Agency, PayPal, and hundreds of other organizations are under an unexplained assault that's bombarding their websites with millions of compute-intensive requests. The "massive" flood of requests is made over the websites' SSL, or secure-sockets layer, port, causing them to consume more resources than …
They do it..
...because they can?
Sometimes there is no 'why'
If I were to guess
I'd say they're probing for something on the remote boxes, but it doesn't sound like an attack to me, it's probably a prelude to one though.
They could be sitting on some crypto exploit code and want to know who's vulnerable before they make their pay run.
Maybe DDOS the strong encryption servers so that fraudulent requests are handled by systems with the weak encryption that they have an exploit for?
Sorry, I'll put down the William Gibson book now ;)
A Bit of Garbage...
...perhaps they are poking around looking for holes in the webservers.
I have been experiencing slow logins to a couple of the sites on the list, and thought it might be a DDOS attack of some sort.
Beer slows down my responses also.
If known responses are encrypted...
I can assemble your private key... Just Saying.
This is much too sophisticated to be sophomoric. Not to mention the high value servers being targeted.
Maybe its a smoke screen for the actual attack where this one can trigger a weakness than can allow the launcher access. Perhaps something to do with DOS prevention functionality.
it is one of their own gone loopy after performing a self-psy-op.
is that they hoped the attack would be more successful, I guess you don't know before hand how successful attacks will be, how many machines will remain in the botnet, the amount of requests that cause issues for the site.
Maybe they just figured that the SSL negotiation over and over would cause a DDOS if there was enough requests?
It seems strange to go for such high profile sites with an attack that hasn't proved successful or been tested elsewhere first, that is what is odd about this.
Now know how to get your private key...
...someone had too many Cheetohs and feel asleep on the "Go, Bots" button. I'm just sayin'....
So THAT explains why I've been having so much trouble accessing the CIA's website recently!
drive them broke by making the servers use more power and more airconditioning !!!!
"Shadowserver has identified 315 websites that are the recipients of the SSL assault. In addition to cia.gov and paypal.com, other sites include yahoo.com, americanexpress.com, and sans.org."
Let me see: CIA, Paypal, yahoo (with their infernal webmail system).
They're targeting the most evil web sites of da Internet, maybe ?
Keep everyone busy chasing this while the real attack is quietly happening somewhere completely different.
Didn't anyone watch Die Hard?
- Product round-up Ten excellent FREE PC apps to brighten your Windows
- Analysis Pity the poor Windows developer: The tools for desktop development are in disarray
- Chromecast video on UK, Euro TVs hertz so badly it makes us judder – but Google 'won't fix'
- Analysis BlackBerry's turnaround relies on a secret weapon: Its own network
- Hire and hold IT staff in 2015: The Reg's how-to guide