GitHub hit with back-to-back DDoS attacks

By | March 13, 2013

Posted in: Network Security Trends , Hosting Provider DDoS Protection

It happened...again.

In February 2012, GitHub -- the popular code sharing site -- experienced what they called a prolonged and "intense" week long Distributed Denial of Service (DDoS) attack. In a statement at the time, Github said that the "attack is global, and has been very intense at times. Yesterday morning, for example, github.com suddenly received requests from 10,000 times the number of clients it had handled the minute before."

To combat the incident, GitHub said it was putting "another layer of DDoS defense in place."

Those defenses were put in place more than a year ago, but have apparently not prevented additional incidents.

This week, GitHub found itself, once again, on the receiving end of a back-to-back DDoS attack.

They initially experienced a "major service outage" at 1:03 PM EST on March 9th, saying they "we're recovering from what appears to be a DDoS attack." Service returned a few minutes later. The following day, an outage occurred at 6:43 AM EDT, returning nearly three hours later.

Here is their status log from the two-day event:

March 10, 2013
13:42 UTC Everything operating normally.
11:11 UTC Access to downloadable source code archives and uploaded files is temporarily down. We're working to restore it asap.
10:52 UTC We're recovering from another brief DDoS attack. Service should be returning to normal soon.
10:43 UTC Major service outage.

March 09, 2013
13:11 UTC Everything operating normally.
13:06 UTC We're recovering from what appears to be a DDoS attack. Services are returning to normal.
13:03 UTC Major service outage.
This attack only adds to GitHub's security woes.

Back in October, the site was also apparently hit with two DDoS attacks in the span of two days. It was reported that the initial outage lasted more than an hour and a half, the second was two+ hours.

The security of the site has been a hot topic of discussion since it was discovered in January that users could find sensitive password and account information on publicly accessible sections of the site.

Security Bistro reached out to GitHub for comment. We will update this post when we hear back.

You May Also Be Interested In: