NY times appears to have had a rough morning..
Hrmm.. This sunday am I logged into www.nytimes.com, and got an unusual front page. Someone may want to take a look...... Richard :(
Richard Irving wrote:
Hrmm.. This sunday am I logged into www.nytimes.com, and got an unusual front page. Someone may want to take a look......
Looks like the classical underconfigured/overloaded server to me. They were probably running with not much spare capacity before, or didn't configure the correct number of listening processes (or enough RAM to handle them). Possibly a SYN attack. But on this date, more likely a demand "attack". This is not unusual when you consider the total capacity is ultimately determined by the suits. FYI, I had no trouble pulling it from icreport.loc.gov. I got it in the evening, which would have been the 2nd demand curve for the day. So server capacity there was enough to deliver it in that probably broader hump. But maybe the masses, who normally go checking news sites and wouldn't recognize a .gov site as even being an Internet thing, were clobbering places like www.nytimes.com. Even www.cnn.com seemed kinda slow to me. -- Phil Howard | stop7it2@anyplace.edu die7spam@spammer0.com stop0ads@spammer5.org phil | a2b8c2d0@s1p8a2m2.edu stop9it3@anyplace.com stop8303@spam4mer.org at | no45ads1@lame3ads.org eat2this@dumbads5.net stop6629@anywhere.net ipal | end1ads8@s2p4a6m3.edu ads8suck@anyplace.com stop0549@no9place.com dot | blow3me9@anyplace.com no29ads0@anywhere.net stop1694@no71ads2.net net | stop4688@s5p9a1m1.net end0it82@no2where.com end1it08@no0place.edu
Actually they were hacked by a group calling themselves HFG. The correct website was restored several times only to be overwritten by the hacked version minutes later. The hacked page talked about cron jobs, I imagine they hacked one in to keep putting the hacked web page up. Looks like they finally gave up and took down the server to fix it.
-----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu]On Behalf Of Phil Howard Sent: Sunday, September 13, 1998 10:51 AM To: rirving@onecall.net Cc: nanog@merit.edu Subject: Re: NY times appears to have had a rough morning..
Richard Irving wrote:
Hrmm.. This sunday am I logged into www.nytimes.com, and got an unusual front page. Someone may want to take a look......
Looks like the classical underconfigured/overloaded server to me. They were probably running with not much spare capacity before, or didn't configure the correct number of listening processes (or enough RAM to handle them).
Possibly a SYN attack. But on this date, more likely a demand "attack".
This is not unusual when you consider the total capacity is ultimately determined by the suits.
FYI, I had no trouble pulling it from icreport.loc.gov. I got it in the evening, which would have been the 2nd demand curve for the day. So server capacity there was enough to deliver it in that probably broader hump. But maybe the masses, who normally go checking news sites and wouldn't recognize a .gov site as even being an Internet thing, were clobbering places like www.nytimes.com. Even www.cnn.com seemed kinda slow to me.
-- Phil Howard | stop7it2@anyplace.edu die7spam@spammer0.com stop0ads@spammer5.org phil | a2b8c2d0@s1p8a2m2.edu stop9it3@anyplace.com stop8303@spam4mer.org at | no45ads1@lame3ads.org eat2this@dumbads5.net stop6629@anywhere.net ipal | end1ads8@s2p4a6m3.edu ads8suck@anyplace.com stop0549@no9place.com dot | blow3me9@anyplace.com no29ads0@anywhere.net stop1694@no71ads2.net net | stop4688@s5p9a1m1.net end0it82@no2where.com end1it08@no0place.edu
What I think you missed is that shortly after I received this post (and looked at the NYTimes web site) they corrected the problem which caused the original post. www.nytimes.com got hacked. If you missed it, and feel the urge to check it out, I made a mirror of it at http://www.megacity.org/hacked_nytimes/ ... I don't plan to keep it more than a few days I suspect (I'm not one of those hacked-website collectors like some places *grin*), but I kept it for posterity of those who might want to check it out. D At 10:50 AM 9/13/98 -0500, Phil Howard wrote:
Richard Irving wrote:
Hrmm.. This sunday am I logged into www.nytimes.com, and got an unusual front page. Someone may want to take a look......
Looks like the classical underconfigured/overloaded server to me. They were probably running with not much spare capacity before, or didn't configure the correct number of listening processes (or enough RAM to handle them).
Possibly a SYN attack. But on this date, more likely a demand "attack".
This is not unusual when you consider the total capacity is ultimately determined by the suits.
FYI, I had no trouble pulling it from icreport.loc.gov. I got it in the evening, which would have been the 2nd demand curve for the day. So server capacity there was enough to deliver it in that probably broader hump. But maybe the masses, who normally go checking news sites and wouldn't recognize a .gov site as even being an Internet thing, were clobbering places like www.nytimes.com. Even www.cnn.com seemed kinda slow to me.
-- Phil Howard | stop7it2@anyplace.edu die7spam@spammer0.com stop0ads@spammer5.org phil | a2b8c2d0@s1p8a2m2.edu stop9it3@anyplace.com stop8303@spam4mer.org at | no45ads1@lame3ads.org eat2this@dumbads5.net stop6629@anywhere.net ipal | end1ads8@s2p4a6m3.edu ads8suck@anyplace.com stop0549@no9place.com dot | blow3me9@anyplace.com no29ads0@anywhere.net stop1694@no71ads2.net net | stop4688@s5p9a1m1.net end0it82@no2where.com end1it08@no0place.edu
On Sun, 13 Sep 1998, Derek Balling wrote: For HFG always check document source for previous hacked sites and their "hidden" agenda. Also it gives a clue that they are not 15 year old high school kids as their CAPs and number/character alterations attempt to deceive. -Hank
What I think you missed is that shortly after I received this post (and looked at the NYTimes web site) they corrected the problem which caused the original post.
www.nytimes.com got hacked. If you missed it, and feel the urge to check it out, I made a mirror of it at http://www.megacity.org/hacked_nytimes/ ... I don't plan to keep it more than a few days I suspect (I'm not one of those hacked-website collectors like some places *grin*), but I kept it for posterity of those who might want to check it out.
D
At 10:50 AM 9/13/98 -0500, Phil Howard wrote:
Richard Irving wrote:
Hrmm.. This sunday am I logged into www.nytimes.com, and got an unusual front page. Someone may want to take a look......
Looks like the classicalunderconfigured/overloaded server to me. They were probably running with not much spare capacity before, or didn't configure the correct number of listening processes (or enough RAM to handle them).
Possibly a SYN attack. But on this date, more likely a demand "attack".
This is not unusual when you consider the total capacity is ultimately determined by the suits.
FYI, I had no trouble pulling it from icreport.loc.gov. I got it in the evening, which would have been the 2nd demand curve for the day. So server capacity there was enough to deliver it in that probably broader hump. But maybe the masses, who normally go checking news sites and wouldn't recognize a .gov site as even being an Internet thing, were clobbering places like www.nytimes.com. Even www.cnn.com seemed kinda slow to me.
-- Phil Howard | stop7it2@anyplace.edu die7spam@spammer0.com stop0ads@spammer5.org phil | a2b8c2d0@s1p8a2m2.edu stop9it3@anyplace.com stop8303@spam4mer.org at | no45ads1@lame3ads.org eat2this@dumbads5.net stop6629@anywhere.net ipal | end1ads8@s2p4a6m3.edu ads8suck@anyplace.com stop0549@no9place.com dot | blow3me9@anyplace.com no29ads0@anywhere.net stop1694@no71ads2.net net |stop4688@s5p9a1m1.net end0it82@no2where.com end1it08@no0place.edu
Hank Nussbacher
participants (5)
-
Derek Balling -
Hank Nussbacher -
Phil Howard -
Richard Irving -
Tracy Snell