NY times appears to have had a rough morning..
Tracy Snell
tjs at enteract.com
Sun Sep 13 16:17:09 UTC 1998
Actually they were hacked by a group calling themselves HFG. The correct
website was restored several times only to be overwritten by the hacked
version minutes later. The hacked page talked about cron jobs, I imagine
they hacked one in to keep putting the hacked web page up.
Looks like they finally gave up and took down the server to fix it.
> -----Original Message-----
> From: owner-nanog at merit.edu [mailto:owner-nanog at merit.edu]On Behalf Of
> Phil Howard
> Sent: Sunday, September 13, 1998 10:51 AM
> To: rirving at onecall.net
> Cc: nanog at merit.edu
> Subject: Re: NY times appears to have had a rough morning..
>
>
> Richard Irving wrote:
>
> > Hrmm.. This sunday am I logged into www.nytimes.com,
> > and got an unusual front page. Someone may want to take
> > a look......
>
> Looks like the classical underconfigured/overloaded server to me.
> They were
> probably running with not much spare capacity before, or didn't
> configure the
> correct number of listening processes (or enough RAM to handle them).
>
> Possibly a SYN attack. But on this date, more likely a demand "attack".
>
> This is not unusual when you consider the total capacity is ultimately
> determined by the suits.
>
> FYI, I had no trouble pulling it from icreport.loc.gov. I got it in the
> evening, which would have been the 2nd demand curve for the day.
> So server
> capacity there was enough to deliver it in that probably broader
> hump. But
> maybe the masses, who normally go checking news sites and
> wouldn't recognize
> a .gov site as even being an Internet thing, were clobbering places like
> www.nytimes.com. Even www.cnn.com seemed kinda slow to me.
>
> --
> Phil Howard | stop7it2 at anyplace.edu die7spam at spammer0.com
> stop0ads at spammer5.org
> phil | a2b8c2d0 at s1p8a2m2.edu stop9it3 at anyplace.com
> stop8303 at spam4mer.org
> at | no45ads1 at lame3ads.org eat2this at dumbads5.net
> stop6629 at anywhere.net
> ipal | end1ads8 at s2p4a6m3.edu ads8suck at anyplace.com
> stop0549 at no9place.com
> dot | blow3me9 at anyplace.com no29ads0 at anywhere.net
> stop1694 at no71ads2.net
> net | stop4688 at s5p9a1m1.net end0it82 at no2where.com
> end1it08 at no0place.edu
>
More information about the NANOG
mailing list