Started by Mark bc7291552be7a58f... ·
So, just a PSA. If your node is acting strange, there's a somewhat ambitious attack going on at the moment. Seem to be targeting public backbone nodes announcing their interfaces.
I have over 800 inbound "client" connections on one node right now. ~550 of them are some script kiddie's idea of a great afternoon.
Well, free load testing for the new stamp enforcement.
Still posting this over nomadnet, though, lol.
Also, I wanted to note, that whatever the motivations for this is, don't get annoyed into an early "let's just activate full stamp enforcement on everything right at this very moment" mode.
This will pass, sooner or later, and taking things easy and observing everything in a calm and measured manner is much more valuable.
There's ~530 connections to my node right now, that are definitely purely bogus/attack. Practically all of them are coming from rented infrastructure ASNs and IP ranges. They were all launched more or less in very tight coordination, and still trying to pump "announces" as I write this.
Right now, they're wasting their efforts, caus they're all getting filtered, lol.
But what I'm trying to point out here is, that unless this is using a fleet of compromised hosts, someone is actually paying for this. There's likely to be a few of the "dumpsters" in there that are just normal nodes participating in amplification, since they have ingress control disabled or set to strange values, but 500 nodes don't just appear out of nowhere within minutes of each other and start dumping announces as fast as their rented little arses can carry them.
So, I'm gonna let them pay for as long as they find it interesting, and use it as an opportunity to observe, collect data and tune things. Stuff like this will get really "funny" once stamp requirements kick in.
Stamps are coming boys, its now or never...
Mark wrote:
[...]
they could have also gotten the servers that meta is renting out to do this, apparently muse is horribly insecure and will give you access to the actual server it's running on if you're smart with it
Lol, at this point I'm willing to consider that a perfectly reasonable explanation.
