Smoke screen
Maybe its a smoke screen for the actual attack where this one can trigger a weakness than can allow the launcher access. Perhaps something to do with DOS prevention functionality.
CIA, PayPal under bizarre SSL assault
The Central Intelligence Agency, PayPal, and hundreds of other organizations are under an unexplained assault that's bombarding their websites with millions of compute-intensive requests. The "massive" flood of requests is made over the websites' SSL, or secure-sockets layer, port, causing them to consume more resources than …
This topic is closed for new posts.
They do it..
...because they can?
Sometimes there is no 'why'
If I were to guess
I'd say they're probing for something on the remote boxes, but it doesn't sound like an attack to me, it's probably a prelude to one though.
They could be sitting on some crypto exploit code and want to know who's vulnerable before they make their pay run.
Maybe DDOS the strong encryption servers so that fraudulent requests are handled by systems with the weak encryption that they have an exploit for?
Sorry, I'll put down the William Gibson book now ;)
A Bit of Garbage...
...perhaps they are poking around looking for holes in the webservers.
I have been experiencing slow logins to a couple of the sites on the list, and thought it might be a DDOS attack of some sort.
Beer slows down my responses also.
If known responses are encrypted...
I can assemble your private key... Just Saying.
This is much too sophisticated to be sophomoric. Not to mention the high value servers being targeted.
maybe
it is one of their own gone loopy after performing a self-psy-op.
my thoughts..
is that they hoped the attack would be more successful, I guess you don't know before hand how successful attacks will be, how many machines will remain in the botnet, the amount of requests that cause issues for the site.
Maybe they just figured that the SSL negotiation over and over would cause a DDOS if there was enough requests?
It seems strange to go for such high profile sites with an attack that hasn't proved successful or been tested elsewhere first, that is what is odd about this.
I think....
...someone had too many Cheetohs and feel asleep on the "Go, Bots" button. I'm just sayin'....
D'oh!
So THAT explains why I've been having so much trouble accessing the CIA's website recently!
why !?
drive them broke by making the servers use more power and more airconditioning !!!!
Evil
"Shadowserver has identified 315 websites that are the recipients of the SSL assault. In addition to cia.gov and paypal.com, other sites include yahoo.com, americanexpress.com, and sans.org."
Let me see: CIA, Paypal, yahoo (with their infernal webmail system).
They're targeting the most evil web sites of da Internet, maybe ?
Smokescreen(2)
Keep everyone busy chasing this while the real attack is quietly happening somewhere completely different.
Didn't anyone watch Die Hard?
This topic is closed for new posts.
Sign up, sign up for The Register's weekly IT security newsletter - click here
Popular Whitepapers
- The BI Inflexion Point
Information is a right, not a privilege - VPN security - if you want it, come and get it
Attention WiFi hotspotters: You want it - The Register Guide to iSCSI
A primer on Internet SCSI, a protocol to transport SCSI commands over IP - Secure Mobile Working
Beyond the Technology - The Impact of IT Security Attitudes
Putting the pieces in place for effective security delivery - The Register guide to unified communications
A primer on the implications of unified communications for enterprise IT
