Ubuntu Servers Reportedly under Sustained Massive DDOS Attacks from Iran Backed Hacking Groups

So, I found that I could not resolve the Ubuntu servers when I went to run Mint updates today.

Puzzled I googled it, and found this story.

Not a big deal on my end, I was able to switch to other mirrors, but still interesting.

Of all things, I wonder why they chose Ubuntu as a target, and not something more closely tied to the U.S. like Cisco or something like that.

This is happening a lot lately, a while back it was Arch servers being targeted.

I’m noticing a bunch of stuff not working today.
It explains a few things.

Yeah it's been bad for Canonical the last 2-3 days at this point. It's really hampering their ability to push out patches for CopyFail as well.

Zarathustra[H] said:

So, I found that I could not resolve the Ubuntu servers when I went to run Mint updates today.

Puzzled I googled it, and found this story.

Not a big deal on my end, I was able to switch to other mirrors, but still interesting.

Of all things, I wonder why they chose Ubuntu as a target, and not something more closely tied to the U.S. like Cisco or something like that.

Click to expand...

I was trying to update a vm, wondered why I had the same issue.

Zarathustra[H] said:

Of all things, I wonder why they chose Ubuntu as a target, and not something more closely tied to the U.S. like Cisco or something like that.

Click to expand...

Because Iran's regime are morons.

Their site says everything is back up, but I still can't update off the launchpad servers. They still time out.

https://status.canonical.com/

Switching to a regional mirror is the right call during something like this and worth keeping as a habit anyway since they tend to be faster for most people regardless. The timing hitting Canonical right when they needed to push out the CopyFail patches is what makes it particularly messy. Status pages saying everything is back while servers are still timing out is a classic infrastructure recovery situation where the monitoring clears before actual traffic normalizes.

quintinmorrow said:

Switching to a regional mirror is the right call during something like this and worth keeping as a habit anyway since they tend to be faster for most people regardless. The timing hitting Canonical right when they needed to push out the CopyFail patches is what makes it particularly messy. Status pages saying everything is back while servers are still timing out is a classic infrastructure recovery situation where the monitoring clears before actual traffic normalizes.

Click to expand...

Worth noting.

I used mirrors for my updates, but I struggled with a distribution upgrade, as when you start upgrading to the next distribution release, it overwrites your mirrors.

I needed to do a distribution update while the servers were down, so I just edited my /etc/hosts file, and grabbed the IP address of my preferred mirror, and used my hosts file to make sure that the official Ubuntu domain names pointed to the mirror servers instead, and it actually worked.

After the upgrade was done, I removed those lines from my hosts file again.