how come there isn't already a census, technological debacle thread? | PUNT ROAD END | Richmond Tigers Forum
  • IMPORTANT // Please look after your loved ones, yourself and be kind to others. If you are feeling that the world is too hard to handle there is always help - I implore you not to hesitate in contacting one of these wonderful organisations Lifeline and Beyond Blue ... and I'm sure reaching out to our PRE community we will find a way to help. T.

how come there isn't already a census, technological debacle thread?

tigertim

something funny is written here
Mar 6, 2004
30,098
12,511
Yep, it's been a disaster. Website came back up at 4pm today but the ABS are gunna struggle to get 99% of the nation to complete it now.
 

Baloo

Delisted Free Agent
Nov 8, 2005
44,172
19,044
Part of the politics thread I assume.

I'm not sure why they didn't geoblock from the start. Something like this is always going to become a target for script kiddies, rent-a-botnet. DDoS-as-a-Service types (the last two are in fact real)
 

tigersnake

Tear 'em apart
Sep 10, 2003
23,734
12,223
absolute debacle

I know zero about computers, except how to write a word doc, surf the net, and put a bet on, but my friend who is a self-taught highly paid computer genius wrote this:

"A web based session queue consumes minimal compute resources, doesn't require personal information thus can go on public cloud where scaling is robust.
The back end at ABS doesn't get overloaded, because it would "pull" the requests in from the session pool at a rate it can handle.
It's not rocket science, but why didn't IBM think of this?."

Makes little sense to me, but knowing this fella, it sounds damning.

Then there is the privacy concerns, and then there logistical stupidity. Why now do one state or one region as a pilot?

Just seems like dumb piled on dumb. Bet they wish they stuck to the old forms now.
 

Baloo

Delisted Free Agent
Nov 8, 2005
44,172
19,044
It wasn't a load related problem as much a DDoS from what I've read. The geoblocking failed which allowed the ddos to hit and hit hard. Bringing it down for so long was odd.
 

IanG

Tiger Legend
Sep 27, 2004
18,117
3,362
Melbourne
Baloo said:
It wasn't a load related problem as much a DDoS from what I've read. The geoblocking failed which allowed the ddos to hit and hit hard. Bringing it down for so long was odd.

IT security specialist on The Project today disputes that. He said they planned for internaitonal blocking but there was no blocking of Aust addresses and that the traffic they received trying to overload the website was within the limit that they should have been able to handle. It was just incompetence pure and simple.
 

Baloo

Delisted Free Agent
Nov 8, 2005
44,172
19,044
IanG said:
IT security specialist on The Project today disputes that. He said they planned for internaitonal blocking but there was no blocking of Aust addresses and that the traffic they received trying to overload the website was within the limit that they should have been able to handle. It was just incompetence pure and simple.

The tech stuff I read seemed to put the blame on a failure of geo blocking. First 3 DDoS attempts they handled. Fourth got them.

Dunno
 

AngryAnt

Tiger Legend
Nov 25, 2004
27,162
15,031
TigerForce said:
Technology will never beat manual. What a laughter this Census is.

About 95% of information based work that we used to do "manually" is now digitised and automated and this is increasing. Technology is not the problem here, implementation and execution is.
 

larabee

Tiger Champion
Jun 11, 2010
3,729
5,531
Tigerland
i don't understand half the stuff that's been written in this thread - wtf is DDos? dos with a stutter?

all i know is that my census went ok. my pen crashed early, but i had a back-up. easy
 

LeeToRainesToRoach

Tiger Legend
Jun 4, 2006
33,186
11,546
Melbourne
Having watched at close range as a large IT project ran off the rails recently (not guilty!), I did spare a thought for those in the hot seat. It's incredibly embarrassing for an application of this nature to fail. We'll probably never know the whole truth.

NB Was able to log on and complete the census just now.
 

Baloo

Delisted Free Agent
Nov 8, 2005
44,172
19,044
larabee said:
i don't understand half the stuff that's been written in this thread - wtf is DDos? dos with a stutter?

all i know is that my census went ok. my pen crashed early, but i had a back-up. easy

DDoS - Distributed Denial of Service. Basically 100s if not 1000s of infected machines are remotely triggered to start bombarding a server, in this case the Census webite with so much traffic that it can't respond to any legit requests. Not really a hack, more a maliciously trouble maker than anything else though it can be used as a distraction to divert attention away from a attempted hack into a system.

But I reckon this was just bored geeks having some fun.
 

Sintiger

Tiger Legend
Aug 11, 2010
18,553
18,517
Camberwell
Baloo said:
DDoS - Distributed Denial of Service. Basically 100s if not 1000s of infected machines are remotely triggered to start bombarding a server, in this case the Census webite with so much traffic that it can't respond to any legit requests. Not really a hack, more a maliciously trouble maker than anything else though it can be used as a distraction to divert attention away from a attempted hack into a system.

But I reckon this was just bored geeks having some fun.
yep. A number of years ago i was involved with an organisation that engaged with hackers, in the IT security business. The overwhelming reason why they did it was because they could. It was about showing that they were better hackers than someone else.
Hacking has moved on a bit since then to be sometimes about politics and even industrial and cross country espionage but the idea that it was just for fun or ego is not fanciful at all.
 

TigerForce

Tiger Legend
Apr 26, 2004
71,264
22,181
57
antman said:
About 95% of information based work that we used to do "manually" is now digitised and automated and this is increasing. Technology is not the problem here, implementation and execution is.

Imagine when we don't use keys anymore and have to press a button to start every car. What happens if it doesn't start? ;D
 

Baloo

Delisted Free Agent
Nov 8, 2005
44,172
19,044
TigerForce said:
Imagine when we don't use keys anymore and have to press a button to start every car. What happens if it doesn't start? ;D

Uber
 

Chiang Mai Tiger

Time for some Tiger Payback
Jun 17, 2004
5,758
25
Thailand
Baloo said:
But I reckon this was just bored geeks having some fun.

Don't ever mess with 'Anonymous', now the Galactic Empire is going to know the names and addresses of thousands of Jediist in Australia!
 

AngryAnt

Tiger Legend
Nov 25, 2004
27,162
15,031
TigerForce said:
Imagine when we don't use keys anymore and have to press a button to start every car. What happens if it doesn't start? ;D

Imagine when we don't use a crank lever to start cars, and have to use a key to start every car. What happens when it doesn't start? ;D
 

TigerForce

Tiger Legend
Apr 26, 2004
71,264
22,181
57
antman said:
Imagine when we don't use a crank lever to start cars, and have to use a key to start every car. What happens when it doesn't start? ;D

Does the button spark the plug like a key does? Dunno. :hihi
 

AngryAnt

Tiger Legend
Nov 25, 2004
27,162
15,031
What if my battery is flat and my car is an EFI automatic? Can I push start it? :hihi
 

AngryAnt

Tiger Legend
Nov 25, 2004
27,162
15,031
Anyway, back to the actual thing...

What I've been told about #censusfail
High level sources say...
By Patrick Gray Start the discussion 0 Comments
August 11, 2016 --
I have been able to cobble together the following by talking to my sources. Sorry this post is so brief, but I'm still trying to get this week's show out and I'm massively under the pump. So here it is: Set your faces to stunned.

IBM and the ABS were offered DDoS prevention services from their upstream provider, NextGen Networks, and said they didn't need it.
Their plan was to just ask NextGen to geoblock all traffic outside of Australia in the event of an attack.
This plan was activated when there was a small-scale attack against the census website.
Unfortunately another attack hit them from inside Australia. This was a straight up DNS reflection attack with a bit of ICMP thrown in for good measure. It filled up their firewall's state tables. Their solution was to reboot their firewall, which was operating in a pair.
They hadn't synced the ruleset when they rebooted the firewall so the secondary was essentially operating as a very expensive paperweight. This resulted in a short outage.
Some time later IBM's monitoring equipment spat out some alerts that were interpreted by the people receiving them as data exfiltration. Already jittery from the DDoS disaster and wonky firewalls, they became convinced they'd been owned and the DDoS attack was a distraction to draw their focus away from the exfil.
They pulled the pin and ASD was called in.
The IBM alerts were false positives incorrectly characterising offshore-bound system information/logs as exfil.
ASD still needs to roll incident response before they can send the website live again. Even though it was false positives that triggered the investigation, there still needs to be an investigation.
At least IBM got to bump their margins up a bit by not paying for the DDoS prevention though... amirite?!

http://risky.biz/censusfail