Screenshots

INCIDENT 1: Screenshots came down from 10:00hr to 15:00hr June 22 as a result of Denial of Service (DoS) attempt via a zombie parked at IP address 202.186.86.222 (Kuala Lumpur), which was hosted in relation to a cross-border gaming site.

INCIDENT 2: Soon after, Screenshots became the target of Distributed Denial of Service (DDoS) attacks, making this blog inaccessible from 19:30hr June 22 to 00:30hr June 23. The main launchpads for the DDoS cyber attackers were traced to two zombies in Russia which were parked at IP addresses 89.169.181.137 (Yubileynyy, Moscow) and 89.163.36.11 (St Petersburg), respectively.

As expected of most DoS and DDoS attacks, the vulnerability of Internet architecture and web servers via port 80 -- the open port -- was exploited to the max.

Both DoS and DDoS attackers smack of the modus operandi of SMS Scammers who fake Mobile Originated (MO) requests to scam unassuming targets, albeit in a manner they used anonymous networks to create massive, simultaneous -- but unwarranted -- traffic to Screenshots server in order to paralyse and ultimately crash it, thus denying bona fide readers from reading this weblog.

ACTIONS TAKEN. When Incident 1 happened, Screenshots' web-admin was alerted and immediately activated virtual surveillance of the server activities, and visual inspection of the hardware at the data centre. The web admin laid out a bait -- by attributing it to a problematic network card as the red herring -- in anticipation of potential DoS and DDoS attacks that might follow soon.

When Incident 2 happened, the zombies were identified and the web admin repelled the attacks systematically at the firewall level.

There was no evidence of damaging server intrusion, and all databases of Screenshots remain intact.

MOTIVE. In the event that the two rounds of cyber attacks were triggered by content and issues recently published in Screenshots, timing is the essence.

In this case, one particular issue stood up like a sore-thumb: the detailed exposé of SMS Scams and the ineffectiveness of MCMC in mitigating the scandal and protecting the telco-related consumers, especially prepaid users who are denied their monthly itemised billings, and for years since 2004, MCMC condoned it.

WHAT'S NEXT. We expect the rogues to resort to mode evasive to sustain the DDoS attacks on Screenshots in the days to come.