Update on CNN.com attacks, slightly down but (not) defaced (UPDATED)

Let's give you the latest updates on the attacks on CNN.com following my previous post. Now we know what they meant with "this has already obstructed the motherland’s normal network communications". The attack did slow down CNN.com but it never stopped working. It did seem to slow down the site from the China mainland.

The latest post on Arbornetworks gives us some interesting details:

Even after the attacks were called off, we saw evidence of some DDoS attacks, and CNN has confirmed it. Maybe not everyone got the message, or maybe someone just felt like grinding an axe. The attacks didn’t seem to disrupt their service much, and the network operators around CNN seemed to handle the attacks quite well. Most of the attacks were TCP SYN floods (still popular after all these years), targeting three different CNN websites. Attack intensity was pretty small on average, with the peak attack intensity still a modest (by global attack standards) 100 Mbps. Here’s a breakdown of the attacks as we saw them over the weekend.

Attack bandwidth	peak: 100 Mbps, average: 20 Mbps
Attack duration	peak: 30 minutes, average: under 15 minutes
Attack targets	www2.cnn.com, www3.cnn.com, edition.cnn.com

But TheDarkVisitor referred us to Danwei.org telling us that the Website of The Sports Network (TSN) got defaced. As of this writing, there is still a 'sorry page' displayed. A screenshot of the defaced website is displayed at the beginning of this post. The chinese hackers were celebrating their victory with this screenshot.

The Sports Network (commonly known as TSN) is a Canadian English language cable television specialty channel and is Canada's leading English language sports television channel. I don't see a direct connection between the two besides that sports.si.cnn.com resolves to the same IP as www.sportsnetwork.com but it's hosted on another network then CNN. So the chinese hackers thought they were hacking CNN.com.




Update: Changed the text above. It was not a part of CNN that went down but an innocent bystander. And it seems that CNN did went down for a very small time. At least according to Netcraft:

The CNN News website has twice been affected since an earlier distributed denial of service attack last Thursday. CNN fixed Thursday's attack by limiting the number of users who could access the site from specific geographical areas.

Subsequently, an attack was purportedly organised to start on Saturday 19th April, but cancelled. However, our performance monitoring graph shows CNN's website suffered downtime within a 3 hour period on Sunday morning, followed by other anomalous activity on Monday morning, where response times were greatly inflated.

Related posts:

• DDoS Attack on CNN, cancelled or delayed? An overview.