SA-MP under DDoS attacks
Over the last 2 weeks, SA-MP has been subjected to some fairly large DDoS attacks against our services. It all started on the 19th of September when a user by the name of Xalphox was banned from our forums for (guess what?) threatening to DDoS people. He demanded that he was unbanned from the forums. Of course, we can't really let a script kiddo have his way. Sorry buddy.
The next weekend, he managed to stir up one of his bigger script kiddo buddies, who goes by the name Ryan Cleary. Unfortunately, this wasn't the first time we have had to deal with Ryan. He has, in fact, been terrorising members of our community for several months. And not just SA-MP it seems:
http://www.associatedcontent.com/article....ck.html
http://mikeabundo.com/tag/ryan-cleary/
http://mikeabundo.com/2008/08/23/ryan-cleary-ddos-extortionist/
After some investigation and help from anonymous sources, it seems Ryan has access to large array of web sites effected by the Remote File Incursion php exploit. He is able to have these sites execute the php code of his choice; which often includes sending lots of large UDP and TCP packets to his targets. This gives him access to bandwidth in the order of several gigabits a second. In DDoS'ing terms, this makes him a "big fish."
Here is an example of one of the scripts he used to attack SA-MP: http://www.pastebin.cz/9531 The web sites effected by the RFI vulnerability access this page which was posted by him to pastebin.cz, then execute the code it contains. In this case, it was an 8.3 hour DDoS attack.
It seems Ryan also has access to a mail() command on these servers, as he decided to send me 500,000 e-mails. That was fun cleaning up.
Fortunately, I was able to bounce many of the e-mails back to the origin servers. So hopefully the admins of these systems figure out they've been compromised.
Both Ryan and Xalphox are believed to reside in the UK. At least, that's where the IPs point us. Since denial of service attacks are a crime and cause monetary loss for Internet providers and web site hosts, we intend to take some action and report these two. Any additional information that can be provided to us is appreciated.
At Kye's blog.
http://kyecoder.blogspot.com/
Dis is seris shit
