Thread: BREAKING NEWS: AT&T Blocks img.4chan.org

I thought that thing wasn't operational?!

I don't think this can be called censorship
This is damage control from AT&T

Someone was DDOS'ing 4chan with spoofed IP's (IP's belonging to AT&T)

When you contact a server over TCP/IP,
- You first send a SYN packet - I want to talk to you
- The server will respond with a SYN-ACK packet - I'm ready to talk
- Finally, you respond with an ACK packet - Ok, here it comes
- Then the actual data packets start flying around

If you spoof your source IP, the server will send it's SYN-ACK packets to the spoofed IP (who has no idea what to do with them, as they didn't ask for a conversation)
So, the spoofed client will just drop the packet

The server, having not received an ACK, will resend (up to 4 times) the SYN-ACK packet

DDOS'ing 4chan with spoofed IP's will result in the spoofed network (AT&T) being DOS'ed by the server (4chan)

This secondary, by-product DOS of the original DDOS, will potentially be up to 4 times as much as the original DDOS on 4chan

a simple (albeit crude) solution for AT&T, is to just block the IP from 4chan

Well, yes. That's one of the main rumors floating around. But, AT&T would have to contact 4chan's admins before doing that, and cutting access all of a sudden.

"moot" said AT&T never contacted him.

Originally Posted by [SomeGuy]

Well, yes. That's one of the main rumors floating around. But, AT&T would have to contact 4chan's admins before doing that, and cutting access all of a sudden.

"moot" said AT&T never contacted him.

Why would they have to contact anybody?

I've got a similar setup on my network
If I get flooded with bogus TCP packets, I block the source IP (only for a few hours)
It's all automated and is a crude, but effective way to nip DOS attacks in the bud

But AT&T blocking a server without contact?

If they were being DDoS'd by that IP, there's no point in contact. If I was being DDoS'd, I would just block the IP instead of trying to contact the attacker.

No no no. 4chan was DDoS'd. AT&T blocked access it to stop the attacks, they claim.

They should have contacted moot.

Monday, July 27, 2009

Here's what happened:

For the past three weeks, 4chan has been under a constant DDoS attack. We were able to filter this specific type of attack in a fashion that was more or less transparent to the end user.

Unfortunately, as an unintended consequence of the method used, some Internet users received errant traffic from one of our network switches. A handful happened to be AT&T customers.

In response, AT&T filtered all traffic to and from our img.4chan.org IPs (which serve /b/ & /r9k/) for their entire network, instead of only the affected customers. AT&T did not contact us prior to implementing the block. Here is their statement regarding the matter.

In the end, this wasn't a sinister act of censorship, but rather a bit of a mistake and a poorly executed, disproportionate response on AT&T's part. Whoever pulled the trigger on blackholing the site probably didn't anticipate [nor intend] the consequences of doing so.

We're glad to see this short-lived debacle has prompted renewed interest and debate over net neutrality and internet censorship—two very important issues that don't get nearly enough attention—so perhaps this was all just a blessing in disguise.

Aside from that, I'll also add that there is some big news due later this week. Keep an eye on the News page, Twitter, and global message for updates.

As always, I can be reached at [email protected].

---

PS: If any companies would like to hook us up with some better hardware, feel free! The architecture we've got powering this large and influential beast is really quite embarrassing. ( ._.)

So, it looks like everything is all good now.

Well, that's good.

They can again sit down and browse /b/ all day. Thank god.

Originally Posted by Exhalent

They can again sit down and browse /b/ all day. Thank god.

And /r9k/