Update: Now the Lamont campaign's blog has linked to a cache (which means an older copy) of the Lieberman website. So apparently the Lieberman campaign can put statements up on their supposedly hacked site, but didn't link to the cache of their site. And the Lieberman camp still hasn't accepted the Lamont campaign's offer to help them with their technical glitch. This stinks.
More on this: It looks like this could be simple incompetence on the Lieberman campaign's part. They aren't apparently running a load-balancer or a firewall. In case you're wondering, Dan Geary is the web genius at Dewey Square who is in charge of hosting Joe2006.com. I've written about Dewey Square before. Now aside from corporate lobbying and campaign work, they are Beltway screw-up artists extraordinaire, apparently. Someone from Dewey Square confirmed to me that Geary doesn't work for them and never has. My apologies.
Even more: Paul Kiel's coverage gets even worse. Just pathetic.
Here's an email from a technical contact. If you are a reporter working on this story, read this or consult the technical reporter at your paper. Bottom line, it shouldn't have taken the Lieberman camp more than an hour to fix this.
1. Unless and until Lieberman's hosting provider releases his logfiles (gateway router, www server, mail server, DNS server) for forensic review, all of this is speculation.2. Using the following information:
a. the site has been down for 18 hours
b. email to (and from?) Joe2006.com addresses has been affected
c. Joe2006.com and mail.joe2006.com resolve to IP 69.56.129.130
d. the reverse lookup on that IP is 82.81.3845.static.theplanet.com
e. joe2006.com now forwards to http://server1.myhostcamp.com/
suspended.page/3. It's highly unlikely this is a true DoS of DDoS attack. This is because we can ping all the IPs noted above and we can see the page at http://server1.myhostcamp.com/suspended. page. If this was a real DoS or DDoS attack, we'd not be able to see any of this and their servers would not be answering their ping at an average of 50ms (millisecond) per packet. True attacks bring down servers, routers and networks. From all available outside evidence this does not appear to be the case.
4. Here what might have happened:
a. Web traffic spikes as national focus on the campaign grows
b. Based on (2b) above, if the webserver is throttled by traffic (due to actual traffic or poor response tuning or an attack or a combination of the three), this would also affect mail delivery to joe2006.com. It could also affect outbound mail if users on that domain use that address for SMTP service.
c. The server is most likely a shared one, since the name, server1.myhostcamp.com, implies lots of other hosts live on it.5. Regardless of the explanation (3 or 4), here is what you do when that happens:
a. You grab your local backup (you do have a local backup of your files (both scripts and database snapshots, right?).
b. You find a host that specialized in high bandwidth hosting and you get an account going ASAP. There are plenty of ISPs that would take your money to expedite this.
c. You move your files up, test that everything is working
d. You redirect your DNS so that Joe2006.com points to you new
server; this change doesn't take very long to propagate because you make sure that the DNS update uses a very low TTL (time to live).
e. If needed, you separate your mailserver mail.joe2006.com from
your webserver joe2006.com/www.joe2006.com so as to keep your mail up and going.
Steps a-e can be accomplished, especially with the kind of site Joe had up and running before this incident (nothing particularly
complex), in less than an hour or so by a competent sysadmin.
|
|
|
Permalink :: 44 Comments :: Post a Comment
|
In order to post a comment, you must be logged in. If you have a member account, please log in to comment.
If not, you can make an account right here. It's quick and free.