DDoS Attacks Take Down What.cd, BTN and PTP BitTorrent Trackers

[nsane.forums]

Three of the largest private BitTorrent trackers have been offline over the past weekend due to prolonged DDoS attacks. The source of the connection flood remains unknown for now, but for What.cd it was serious enough to null-route the sites IP-address. Due to the ongoing attacks, tens of thousands of avid BitTorrent users are waiting impatiently for a sign of life from their favorite trackers.

BitTorrent trackers are no strangers to Distributed Denial of Service (DDoS) attacks. Pretty much all sites of a respectable size are targeted on occasion by unknown sources.

Most of these attack wear off after a few hours, but this weekend three of the largest BitTorrent trackers on the Internet have had to deal with a more serious flood of unwanted connections, which renders the sites in question unavailable.

The music tracker What.cd, TV-tracker Broadcasthe.net (BTN) and the movie tracker PassthePopcorn.me (PTP) are the main targets, and all three have been down for several days.

While the trackers can only be joined through an invite system, the trackers all have tens of thousands of active users who are now waiting impatiently for the sites to return. TorrentFreak talked to several staff members to find out more, but thus far the source of the ongoing attacks remains unknown.

The consequences, however, are serious and What.cd has decided to null-route the sites IP-address for the time being, to keep the bandwidth bills under control.

We have been under a significant and sustained DDoS attack for the last few days, and requested our upstream null-route us to avoid wasting bandwidth, What.cds Narcolepsy informed TorrentFreak.

No person or group has claimed responsibility for the attacks as of yet, he adds.

Over at PTP they havent got a clue whos behind the DDoS attack either. [We] havent received any threats or anything, TorrentFreak was told by a staff member.

The ongoing attacks are reminiscent of a series of DDoS threats carried out last year by a person named Zeiko. The three above-mentioned trackers were also targeted then.

At the time the attacks are thought to have started because Zeiko was denied an invite to one of the trackers involved. A few days later these attacks spread to public BitTorrent sites as well, with Zeiko declaring war on all things piracy.

Its obvious that the source of the current DDoS attacks has a grudge against the three private BitTorrent trackers. Whether this is motivated out of anti-piracy beliefs, competing interests, or another annoyance remains unclear for now.

BTN down, back soon?

Source: TorrentFreak

View: Original Article

[jalaffa]

This dude "could" be responsible for the attacks.

https://twitter.com/Sil3ntlyKilling

Edited January 7, 2014 by jalaffa

[knowledge-Spammer]

This dude "could" be responsible for the attacks.

https://twitter.com/Sil3ntlyKilling

he played a part

[jalaffa]

<&lenrek> but we'll be doing some more stuff today

Success. Still struggling though.

[Picollo]

others sites are being DDOsed, Blackcatsgames, TV-Vault.me, Waffles and many others. let's wait and see if they come out from this without any problems.

[Hottwire]

Update from What.cd

As with all websites on the internet, we deal with denial of service attacks from time to time. This one has been rather nasty and resulted in some serious downtime for the site. We thank you for your patience as we work to battle this attack - our developers have been working non-stop.

In the war against DDoS, capacity is king - the way to outlast an attack is to have more resources available. We have deployed the services of CloudFlare, who provide far more bandwidth and filtering power than we could on our own. This will help protect the main site somewhat against further downtime, but is far from fool-proof. Unfortunately, it cannot protect our IRC network at all, which is also under considerable attack at this time. We are working to mitigate this attack as well.

You should expect some downtime on the site in the next few days while we clean up some residual damage and do some server house-keeping, as well as fend off further attacks to the best of our ability. We will try to keep both our Twitter and the topic of #what.cd-help up to date regarding the status.

UPDATE 02 (01-07-2014 @ 23:00 PM): IRC is up and accessible on irc.what-network.net, so please use that address if you wish to connect to What's IRC network in the immediate future. Many users are configured for irc.what.cd (which isn't working at the moment), so be sure to update your server details if that's the case. Thanks!

UPDATE 03 (01-08-2014 @ 15:00 PM): IRC has been nulled in response to another attack. The IRC network is down for the time being.

UPDATE 04 (01-08-2014 @ 16:22 PM): We're working on getting the tracker going, but we need to get some info from our host first. Hang in there!

[jalaffa]

Down again - and that supposedly man behind it twitter account disabled.

Edit: up

And that joke has a new twitter account: https://twitter.com/Sil3nthill

[Yorel]

Down again - and that supposedly man behind it twitter account disabled.

Edit: up

And that joke has a new twitter account: https://twitter.com/Sil3nthill

That account has been suspended. Let's see how long he lasts in opening another one...

[jalaffa]

This might explain some

from predakanga at BTN:

Not really, it's most likely something not as sinister as you'd expect though - the timing is just because a new kind of exploit was discovered at the start of the year, known as an "NTP reflection attack" - because it's a fairly devastating attack and it's so fresh that hosts/vendors haven't had a chance to devise protections against it yet, it's been used for a number of extremely large scale attacks, including against Steam, Origin, etc.