lebanese-forces.com: The Attack Was Not From Hezbollah!

victor | 13 May, 2008 07:33

Two days ago, on Sunday night, Roland, a friend of mine, called me and said that the lebanese-forces.com website was under a heavy denial of service attack and that they were receiving emails from Hezbollah advertising the attack and asking them to shut down the website. My natural reply to his request was to meet so that I can help in any way possible. One hour later, we met at my place and the process of restoring the website started. It turned out that Hezbollah was not the party attacking the website. How was this deduced?
The server was still accessible via all other services (RDP, FTP, SMTP, etc.). The attack only covered an exceeded load of HTTP requests in addition to SMTP spamming. After exploring the source of attack, fake IPs were being used to generate thousands of requests on port 80 (the port that HTTP uses to serve website requests). The cure was simply to ban these IPs. The process took around 30 minutes and the server was back online working normally as the attack continued using various other IPs.

Why am I writing this here?
While I am personally supportive in the case of any abuse in Internet resources, I would also like us all to relax a little bit before deciding on attack sources. Let us say that Hezbollah really wanted to attack the website, will Hezbollah send an email to them telling them that they will be attacked? If I am attacking someone, will I send him a proof of my identity first? Of course not.

Furthermore, the tools used in such simple attacks are widely distributed across the Internet and anyone, literally anyone from a 10-year old child to an 80-year old bored person, can get similar tools, install them on his/her PC and start the attack at any given moment.

On the other hand, such a claim at such a sensitive situation in Lebanon will only lead to spreading hatred among citizens. This article is written to simply clarify the case and to ask whoever is related to this incident to relax and help make things better instead of worse.

Related Articles:

Comments

Hacking hacking, everywhere

Wadih Ghsoubi | 22/11/2008, 03:47

My websites, ndustudents.com, goaub.com, and zakeh.com and others (all on 1 server) were all hacked 1 week ago by a Saudi "boy". The hacking took place early in the morning, and the websites stayed inaccessible for 5hours.

After restoring them back, I've noticed that the hacker used "C99Shell" which is described as a Trojan virus by many anti-viruses.

I have no idea how the virus was uploaded to the server.

The hacker had access to all my files, thank God he didn't delete any files. He just changed the indexes.

Greetings from Wadih

Loved the reasoning

Elie youssef el helou | 04/10/2008, 20:44

I second you Toufic..

victor is our bruce!!!

toufic michel najem | 12/09/2008, 23:14

just wanted to say that you're the bruce schneier of lebanon and maybe the arab world too keep it on!!!