<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
mso-fareast-language:EN-AU;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-GB" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US">+1 to that comment<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> AusNOG [mailto:ausnog-bounces@lists.ausnog.net]
<b>On Behalf Of </b>Kristoffer Sheather @ CloudCentral<br>
<b>Sent:</b> Wednesday, 10 August 2016 7:19 PM<br>
<b>To:</b> Simon Sharwood <simon@jargonmaster.com><br>
<b>Cc:</b> ausnog@lists.ausnog.net<br>
<b>Subject:</b> Re: [AusNOG] census issues tonight<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Let's just say its a very successfull 'attempt' at an attack! :)
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<hr size="2" width="100%" align="center">
</span></div>
<div>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">From</span></b><span style="font-size:10.0pt;font-family:"Tahoma",sans-serif">: "Simon Sharwood" <<a href="mailto:simon@jargonmaster.com">simon@jargonmaster.com</a>><br>
<b>Sent</b>: 10 August 2016 19:11<br>
<b>To</b>: "Alan Maher" <<a href="mailto:alanmaher@gmail.com">alanmaher@gmail.com</a>><br>
<b>Cc</b>: "<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>" <<a href="mailto:ausnog@lists.ausnog.net">ausnog@lists.ausnog.net</a>><br>
<b>Subject</b>: Re: [AusNOG] census issues tonight</span><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Don't bet on the PR blurb.
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">IBM isn't responding to anyone. the gummint won't say anything cogent. the talking points are clearly to say this is not an attack. If not, WTF is it?<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">S.<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">On Wed, Aug 10, 2016 at 7:04 PM, Alan Maher <<a href="mailto:alanmaher@gmail.com" target="_blank">alanmaher@gmail.com</a>> wrote:
<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p><span style="font-size:9.0pt;font-family:"Arial",sans-serif">I am familiar with this. IBM stands for "I've Been Moved". In fact, I have almost forgotten the number of IBM reunions that I have seen.<o:p></o:p></span></p>
<p><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Ultimately, the cause will be investigated, sanitised, and eventually released as a PR Blurb. This par for any Govt. around the globe.<o:p></o:p></span></p>
<p><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Why do I not seem surprised? Seen it all before, more than once.<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">On 10/08/2016 8:33 p.m., Simon Sharwood wrote:<o:p></o:p></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">FWIW I know several IBMers recently made redundant. They say that anyone on decent money and with a couple of decades experience has been let go to save on wages. The folks left
behind are bright, but inexperienced. Which may be why the mitigations discussed above weren't employed.
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">The thing that will be interesting in the washup is whether the ABS/McGibbon ever admit this was hostile action.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">McGibbon is currently saying DDOSes are not any form of attack, just a blocking action. I think a truckies blockade is a better example. Or perhaps a zombie truckie blockade.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">One last thing: ever security vendor capable of spelling DDOS is contacting media today saying they can explain this crisis away and keep you all out of the headlines. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">S.<o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">On Wed, Aug 10, 2016 at 4:49 PM, J Williams <<a href="mailto:jphwilliams@gmail.com" target="_blank">jphwilliams@gmail.com</a>> wrote:
<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">In hindsight, they could have blocked international access via their upstream providers. This would have avoided almost all issues whilst still reaching almost all of the audience.
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Regards,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Julian<o:p></o:p></span></p>
</div>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">On Wed, Aug 10, 2016 at 4:11 PM, Paul Wilkins <<a href="mailto:paulwilkins369@gmail.com" target="_blank">paulwilkins369@gmail.com</a>> wrote:
<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Well here's the thing. Supposedly the Census site had capacity to serve say 10M Australian clients.<br>
<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">So if your architecture has its ducks in a row, you have a dedicated resource pool(s) for Australian IPs. Now someone has to come up with a botnet with > 10M Australian based
IPs.<br>
<br>
Any overseas botnet will just disable access for the stragglers resource pool, either overseas or on VPNs.<br>
<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Get the architecture right, and the operations takes care of itself.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Kind regards<br>
<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif;color:#888888">Paul Wilkins</span><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><o:p></o:p></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">On 10 August 2016 at 16:03, Mark Delany <<a href="mailto:g2x@juliet.emu.st" target="_blank">g2x@juliet.emu.st</a>> wrote:
<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">> Mark,<br>
> If your point is that if an attacker can flood a server with traffic, the<br>
> DOS will succeed, then we agree.<br>
<br>
There are plenty of other resources to exhaust besides traffic<br>
capacity, but ok.<br>
<br>
> The point is to ensure that your attacker has an upper limit to resources<br>
> available to them on the server. This is much harder to achieve with HTTPS,<br>
> where you can't successfully create a session with a spoofed IP.<br>
<br>
True. But bots don't need to spoof IPs. Nor recipients of IMG<br>
tags. What makes you think the so-called DOS was based on spoofed IPs<br>
anyway? I don't think I made any mention of it.<br>
<br>
Point being, excepting the very largest destinations, it's not that<br>
hard to acquire more bot capacity than your target's server capacity. <o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><br>
<br>
Mark.<br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></span></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<o:p></o:p></span></p>
</blockquote>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><br>
_______________________________________________<br>
AusNOG mailing list<br>
<a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br>
<a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
<o:p></o:p></span></p>
</blockquote>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">--
<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Simon Sharwood | JargonMaster Corporate Communications |<br>
M +61 (0)414 37 37 26 |<br>
E <a href="mailto:simon@jargonmaster.com" target="_blank">simon@jargonmaster.com</a> | W
<a href="http://www.jargonmaster.com" target="_blank">www.jargonmaster.com</a><br>
24 North Street Marrickville NSW 2204 AUSTRALIA<br>
ABN: 14743763968<br>
Work blog: <a href="http://jargonmaster.wordpress.com" target="_blank">jargonmaster.wordpress.com</a><br>
Free/Busy details: <a href="http://www.jargonmaster.com/calendar/" target="_blank">
http://www.jargonmaster.com/calendar/</a><br>
I'm a member of <a href="http://DHBC.org.au" target="_blank">DHBC.org.au</a> and a vExpert
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><img border="0" width="200" height="131" style="width:2.0833in;height:1.368in" id="_x0000_i1026" src="https://communities.vmware.com/servlet/JiveServlet/download/26788-1-122263/vExpert-2014-Badge.png"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<o:p></o:p></span></p>
<pre><o:p> </o:p></pre>
<pre>_______________________________________________<o:p></o:p></pre>
<pre>AusNOG mailing list<o:p></o:p></pre>
<pre><a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><o:p></o:p></pre>
<pre><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><o:p></o:p></pre>
</blockquote>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><br>
<br>
<o:p></o:p></span></p>
<div class="MsoNormal" align="center" style="text-align:center"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<hr size="3" width="99%" noshade="" style="color:#909090" align="center">
</span></div>
</div>
</div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td style="padding:0cm 11.25pt 0cm 6.0pt">
<p class="MsoNormal"><a href="https://www.avast.com/antivirus" target="_blank"><span style="text-decoration:none"><img border="0" id="_x0000_i1028" src="http://static.avast.com/emails/avast-mail-stamp.png" alt="Avast logo"></span></a><o:p></o:p></p>
</td>
<td style="padding:.75pt .75pt .75pt .75pt">
<p><span style="font-family:"Calibri",sans-serif;color:#3D4D5A">This email has been checked for viruses by Avast antivirus software.
<br>
<a href="https://www.avast.com/antivirus" target="_blank">www.avast.com</a><o:p></o:p></span></p>
</td>
</tr>
</tbody>
</table>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"> <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">--
<o:p></o:p></span></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Simon Sharwood | JargonMaster Corporate Communications |<br>
M +61 (0)414 37 37 26 |<br>
E <a href="mailto:simon@jargonmaster.com" target="_blank">simon@jargonmaster.com</a> | W
<a href="http://www.jargonmaster.com" target="_blank">www.jargonmaster.com</a><br>
24 North Street Marrickville NSW 2204 AUSTRALIA<br>
ABN: 14743763968<br>
Work blog: <a href="http://jargonmaster.wordpress.com" target="_blank">jargonmaster.wordpress.com</a><br>
Free/Busy details: <a href="http://www.jargonmaster.com/calendar/" target="_blank">
http://www.jargonmaster.com/calendar/</a><br>
I'm a member of <a href="http://DHBC.org.au" target="_blank">DHBC.org.au</a> and a vExpert
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><img border="0" width="200" height="131" style="width:2.0833in;height:1.368in" id="_x0000_i1029" src="https://communities.vmware.com/servlet/JiveServlet/download/26788-1-122263/vExpert-2014-Badge.png"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">
<o:p></o:p></span></p>
<p><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Message protected by MailGuard: e-mail anti-virus, anti-spam and content filtering.<br>
<a href="http://www.mailguard.com.au/mg">http://www.mailguard.com.au/mg</a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif"><br>
<a href="https://console.mailguard.com.au/ras/1P15yB5QLv/550HfatvSxuQcg3gxSZ51b/0.222">Report this message as spam</a> <br>
<br>
<o:p></o:p></span></p>
</div>
</div>
</div>
</body>
</html>