Intellectual Property Law

Oops! AT&T Blackhole Was 4Chan?s Fault

By Kevin Poulsen

The internet was in an uproar Sunday when AT&T DSL subscribers around the country found they couldn’t reach the /b/ board on 4chan, that petri dish of mischief that’s led to many an internet meme and more than one federal criminal indictment against Anonymous members.

Did those NSA-loving suits at AT&T block the site in a craven bout of puritanism? How would Anonymous retaliate? The pieces seemed set for the greatest battle between control and chaos since Control versus Kaos.

“If you’ve been affected, I would advise you call or write customer support and corporate immediately,” 4chan founder Moot wrote on the site’s status page Sunday.

AT&T responded Monday morning with a press release confirming it had temporarily blackholed img.4chan.org. But it said the ban (which has since been lifted) was a defensive response to denial-of-service traffic hitting an AT&T subscriber, and originating from 4chan’s own network. Reached by Threat Level, AT&T declined to elaborate.

Now 4chan?s founder, Moot, has admitted that his network was sending spurious traffic, but he still faults AT&T for going too far with its response.

“They essentially dropped a nuke instead of using the fly swatter,” Moot said in an e-mail to Threat Level. “I was told by someone within the company that an engineer essentially overreacted and made a mistake in choosing how to deal with a rather trivial issue. That’s how we got to where we’re at now.”

The trouble was triggered by 4chan’s response to a denial-of-service attack that’s been targeting the site’s image board for three weeks. “We were able to filter this specific type of attack in a fashion that was more or less transparent to the end user,” Moot wrote in an afternoon update. “Unfortunately, as an unintended consequence of the method used, some internet users received errant traffic from one of our network switches. A handful happened to be AT&T customers.”

Filtering is normally a passive process not prone to spewing traffic onto the net. But Moot says his filtering appliance was sending response packets to the incoming DDoS traffic. Because the DDoS traffic used spoofed internet IP addresses, the replies went to innocent computers.

“A handful of AT&T customers … complained to AT&T, and AT&T’s response was to blackhole our IPs across their entire network, as opposed to blocking traffic for just the customers who were being affected,” Moot says. “I highly doubt the traffic was higher than a few megabits total — it would have not degraded their network at all.”

We won’t question the most influential person on Earth. We’re just glad that the war was called off before it escalated beyond a single fake news report claiming AT&T’s CEO died.

In these times of heightened tension, it might be a good idea to set up a Cold War-style red phone linking Moot and the presidents of various internet providers. Just to avoid future misunderstandings.

Updated 7:00 p.m. with Moot’s response.

Photo: Jim Merithew/Wired.com

See Also:

• Palin E-Mail Hacker Says It Was Easy
• How Anonymous Hackers Triumphed Over Time
• Anonymous Hackers Track Saboteur, Find and Punish the Wrong Guy
• ‘Anonymous’ Member Pleads Guilty To Scientology Web Attacks
• Hackers Assault Epilepsy Patients via Computer

Full post as published by Threat Level on July 27, 2009 (boomark / email).