How can I deal with people threatening to attack my site?

Question

I've watched a site I work with go down many times because users get angry about moderation decisions, threaten us with a DDOS attack, and then go through with it.

Obviously, paying them to stop isn't going to help, because it is never good to reward negative behaviour, and if they know you will pay them to stop every time they have no reason to stop.

What can I do to protect my site from attacks and takedown atttempts? Should I reason with the attackers? Accept it will happen? I can't necessarily afford to pay someone to help me prevent this.

What can I do?

Answer 1

Ignore it.

Giving in to their demands, or validating their threat by discussing with them just strengthens their position. If they were to pull through with it, you would fall victim to cyber-racketeering. If they don't, they're simply upset and screaming about - leave them alone to calm their heads. Maybe they'll come back with a little more reason on their side.

You can, of course, "brace for impact", but usually such an attack isn't going to persist past a few days (if it even comes to that). Do make sure that word gets out to your community, though. In one way or another, they have to be informed of the threat, and that there may be difficulties as a result.

Answer 2

Chuckle silently to yourself and wait. It is an angry user and it happens. Occasionally, you'll get lucky and find that someone can follow through on their threat. In that case you do the only thing you can - wait it out. It happens and unless you depend on your service being online 24x7x365, a little downtime isn't going to hurt. If you do depend on that type of up time, you're going to end up paying for technical solutions.

There are technical things that can be done, but they generally involve spending money with your hosting provider. One thing one of my hosts does, to protect themselves, is null route an IP if it sees a massive spike in traffic. This stays in place for 8 hours. It's unfortunate if your service isn't available for that time, but one thing I've noticed since switching to this host is that after 8 hours I've yet to see an attack still on going. The other nice benefit to this null route is I'm not on the hook for this excessive traffic, because it's being stopped at the data center border routers.

To the attacker, it looks like they've won. Hooray! Server is down. Might as well stop this attack now. When they check again in a few hours to see what people are saying about the down time, they notice you are still down. A few hours later, still. Wow. I won. Their ego is inflated and they move on. Obviously this type of defense is fine for a small community. Eight hours of down time isn't going to hurt any thing.

Another, technical, option is getting more bandwidth. A fatter internet hose means it's going to take a larger attack to affect you. After this point you probably need a dedicated person/team to support a denial of service mitigation plan.

Answer 3

Report it to the appropriate authorities. DDoSing a server is a crime in almost all jurisdictions since it is abusing the server in a way that is not authorized by the owner of the server.

If they are a user of your system, there is a decent chance you know who they are, or know enough for authorities to figure it out. If you want to be able to avoid issues with anonymous users, the best bet is generally going to be to not allow anonymous users to participate in your system (such as blocking known TOR exit nodes.)

In the US, you can do this through the IC3. For other countries, you will have to do some digging to find the appropriate place to report such crimes. In many cases, nothing may happen, but if they become enough of a problem in general, action may eventually be taken against them. You could also try a civil suit against them and get their ISP supena'd for their user information.

Other than that, there isn't a whole lot you can do other than use services like CloudFlare to defend against the DDoS attack. Even reasoning with them is probably not advisable unless it is to get them to surrender completely on threat of legal action. You don't want to show them that threatening you is a workable way to get anything they want.