tags: cofacts, meeting note GA: UA-98468513-3 —

20240520 會議記錄

:::info

CCPRIP

Removed cases last week - https://github.com/cofacts/takedowns/blob/master/2024/0520-transcript-spam.md

https://g0v.hackmd.io/um7DyY_ESbu2LL78kLw3pg?view

本週沒有進度

Recorded to: https://hackmd.io/i0GcWSSVQNeDQ_OBebyk6Q?both#20240519-DDoS-attack

5/9、5/12 Received same emails twice from the same address

這次被攻擊的網頁，前幾天我們有收到來信檢舉二次詐騙剛才一查 email 發現，根本就是詐騙集團寄來的信。 [name=mrorz]

結果我幾天前有回那個 zhenghe18168 Cofacts 這裡的處理方式等於是把 honeypot 跟他們說了 ._. [name=mrorz]

Time

17:08 health check report: all services offline (API, line bot, website)
17:20 attack stopped
17:26 recveived another email from different address but using the same terms, thus should from the same person

Cloudflare report https://drive.google.com/file/d/1XkD4o4l95iqUKf8AVHzeODlK8MhAMJBa/view?usp=drivesdk

DDoS requests: 12.82M
- 1M req / min, QPS = 16K
Attack method: rapidly accessing the same page using different IPs: cofacts.tw/article/2v60p2lt2jmdx
攻擊可以判斷為寄信者，希望將此網頁下架

Time

17:16 Attack start, Cloudflare starts blocking requests
17:30 health check: all service timeout (API, website, line bot)
17:32 MrOrz acknowledge downtime, investigating Cloudflare, found that it’s an attack
17:47 Setup Cloudflare WAF rule:
- If incoming requests match… http.request.uri.path contains "/article/2v60p2lt2jmdx", take action: Managed challenge
17:54 Website starts working
18:24 health check: all services response 520
19:09 MrOrz acknowledge downtime; found that the attack target switched to cofacts.tw/article/1rfvth8iy4fnc
19:16 MrOrz turns on I’m under attack mode
20:06 MrOrz finds out that service gets back by itself
- Probably because site-zh restarts itself every 30 minutes at 0 & 30 min of every hour?

Cloudflare report

Full https://drive.google.com/file/d/10bx6J1HD_IHi3rC_x0ckNDUOK_KFYI53/view?usp=sharing
17:00 ~ 17:40 https://drive.google.com/file/d/11ZqlfDKftAWi96szEW1UhNJdaeoIdDbQ/view?usp=sharing
- Managed by Cloudflare DDoS detection
- DDoS requests: 15.32M, 24min; QPS=10.6K
- Attack target: /article/2v60p2lt2jmdx
17:45 ~ 18:15 https://drive.google.com/file/d/1vozVBEwMhJlEz2kVf_h2ICx_om8yDCf_/view?usp=drive_link
- Contained by Managed challenges + DDoS block
18:15 ~ 19:15 https://drive.google.com/file/d/1RVGjViKQiu45BCzWoRaHbaiTrGzXNtmo/view?usp=drive_link
- Attack switched gear to attack /article/1rfvth8iy4fnc, Service down
20:13 ~ 20:20 https://drive.google.com/file/d/1QMTrK9gM4nLGQKCVHCXCcFkeBx3aGrOT/view?usp=drive_link
- Peak 1.5M / min; QPS: 25K (highest today)
- No downtime triggered

Go to Security > Event to see what page is under attack
If a single page is under attack, go to WAF > “Visiting certian page” action > add link
Let’s add all articles in scammer’s email