SECURITY HYGIENE DURING ANNOUNCEMENTS

[Itsapov]

I want to raise a concern about operational security in the recent status updates.

Transparency during incidents is appreciated, but the last few posts have exposed details that should be internal only.

Specifically:

1. Provider name and datacenter location
2. Hardware status and upgrade timeline
3. Mitigation methods and proxy architecture
4. Minute-level attack windows that let an attacker measure what worked and what didn't

None of this information helps users. All of it helps attackers. Keep in mind that every public post is read by the adversary too.

Users need two things from a status update:
1. Reassurance that the team is actively working the problem.
2. A rough ETA for resolution. (if it does not enable another attack)

That's it. No infrastructure specifics required for credibility.
I'd recommend pulling the operational details from the existing posts as well. Even after an incident winds down, those details remain searchable and useful to copycats.

<Edit_1> "It's technically discoverable" and "we confirmed it publicly" are different threat levels.
Recon still takes time and has a cost. Free confirmation eliminates it. </Edit_1>

Please keep your cards closer to your chest.

For what it's worth, I loved Turtle WoW and want to see Octowow thrive. If the team wants another set of eyes on the mitigation approach, I'm happy to help where I can.

[Rainy]

Yes I 100% stand by this, we only need ETA's not that much information, I want Octo to be safe

[Defiant]

A single ping would show that information. You're acting like they revealed some kind of secret information. They didn't.

[Itsapov]

A ping gives you an IP and RTT. Not any of the following.
But that's also besides the point. There is no benefit to spelling any of this out in public.
None of it helps users. All of it helps attackers.

What I refer to:

https://octowow.st/forum/viewtopic.php?t=2188

They posted logs from an attack timeline.

An attacker correlates those timestamps against their own C2 logs and gets a direct feedback loop:
how long each vector ran before it stopped being effective, and whether the response is manual or automated.

https://octowow.st/forum/viewtopic.php?t=2204

Tells the attacker: The mitigation architecture (TCP proxy, temporary, provider-dependent).

https://octowow.st/forum/viewtopic.php?t=2247

They posted a screenshot of internal support correspondence from FlokiNET, broadcasting that parts are missing and in transit.

Now they have a estimation window on how long a cheap stresser service is sufficient before they'd need to escalate to something that can punch through upgraded hardware.

Again, the point is "there is no benefit in sharing"

[Hfm1]

Take op´s advice and stop giving us information.

All i want to know is can u get the server stable in a overseeable timeframe or not.

[Gibom]

yes

[Trusty420]

Take op´s advice and stop giving us information.

All i want to know is can u get the server stable in a overseeable timeframe or not.

This honestly, i kept thinking the same, they give out way too much detail the potential attackers can use against them.

Keep up the good work, we will not give up on this server!
There will be a day where we get past these constant attacks but until then, the community needs to stay strong and not give in and jump ships.

Stay persistent guys, we will get through it eventually!

[Itsapov]

I do hope someone from the team reads this before the next announcement is posted and that they will take down some of the things they have posted.

[Hysterics]

I do hope someone from the team reads this before the next announcement is posted and that they will take down some of the things they have posted.

Ah yes, the old taking things off the Internet strategy. Let's see how that pans out.

You seem to have some technical knowledge, which is why I'm confused here and feeling like you're being disingenuous and just trying to essentially make the devs look bad. None of what you've said is something that the attackers wouldn't already know from the various attacks and probes. Kestrel has acknowledged this in other threads when people raised similar concerns. Also I'm really not sure what you're implying the timeline of the attacks would let the attacker know that they don't already know. They're the ones that initiated the attacks. They know when they start and finish. They can see on their end when they stop being effective.

The correspondence with Floki, I mean they've made the choice to inform the community. They are obviously aware that gives information to the attackers. What does that information even change though? Knowing roughly when they'll need to ramp up the attacks? It's not like we've been given an exact date anyways. Stop treating them like idiots and maybe consider that they want to ensure the community doesn't feel abandoned. If they don't give us details, people get upset. It's a lose lose for them, and they weighed out the pros and cons and decided to keep the community in the loop. But to be clear, Kestrel has acknowledged your concerns in other threads. He's aware.