Alora Fane

My site's been down all week, and that's been incredibly frustrating. It's back now... but based on what support said, I don't know how long it'll stay up.

The issue has been so frustrating because I don't know the cause. Customer support is maddening too. The blocks seem to be placed on the site automatically, at which point I get a (probably) automated email about the issue with a data dump which allows me to track the problem to "emails", but nothing more specific like a certain email address or script. I don't even know if they're incoming or outgoing emails that are causing the issue.

I've replied to these automated emails, but the responses take days to come, and they always seem oblivious to any previous emails in the chain and to whatever I've said in my reply. Their responses are all obviously largely copied-and-pasted, and not even relevant to the specific situation. Hilariously, I waited five days for a reply and got one which said something about contacting 'my developer' (I am the developer) and 'downloading updated versions of my scripts' (I wrote the scripts!)... and also contained a paragraph at the end asking me to rate their service. I was tempted to do so very negatively, but just ignored that bit instead. Ugh.

I understand that I'm just one of many customers and most are probably completely ignorant about any of the technical aspects, but I just wish I could talk to an actual person in real time. There is a live chat, but they seem to be for even simpler issues and just direct me to the 'technicians' who reply to these emails (after going around in circles for hours, not understanding what I'm saying). How am I to pinpoint the cause of the issue though when all I have to go on are these days-delayed, often conflicting or off-the-mark email responses which all seem to be written by new people who ignore anything that's come before? They seem to have access to logs that I don't, and without those logs, I'm blind as to what's even causing the issues.

The cause seems to at least have been narrowed down to 'emails' which are causing process overload. These shared sites can only run 25 concurrent 'processes' before giving an error; back in the Fig Hunter days, this happened not-infrequently at times of heavy use due to the inefficient chat system I'd coded. In that case, I could understand how 25+ server processes could all be trying to cram through the door at the same time, causing overload

In this case, though, the same process list is showing only one or two processes whenever I look... yet these emails tell me it's being constantly overloaded? The last one said that the site has been 'killed' for this overload multiple times in the past week, even though the site's been down during that time? That makes no sense.

I have been receiving emails in my tobias at alorafane account, at a rate of like 2-3 a day, but I've been unable to send out emails from that reliably for about a month. I don't know why that would be. It's why I've changed my address to the new alorafane at gmail one (mentioned at the bottom of the page).

Looking through the site's files a few days ago, I found a couple of worrying control panel things (folders full of scripts with names like 'login' and so on), which was like finding out that my neglected garage had been turned into a drug den unbeknownst to me, or something. I like that as an analogy because it's likely fitting for what this is; I don't think it was targeted towards me or the site exactly, but rather it just seems to be something generic that was deployed in hidden folders here to presumably hijack the site's resources to send out spam. Or at least that situation seems reasonable to me as a way that spam emails would propagate. I don't know for sure though.

When I talked to support a few weeks ago when my site was infected with phishing malware, I was directed to install some security thing called Sitelock which is supposed to eradicate any malicious files and protect the site. And yet these dodgy files seem to have been lingering there - deep in these hidden folders - since that breach, untouched. I wonder if this amazing protection service is completely useless. I get the feeling a lot of technology aimed at appeasing the ignorant is entirely hollow under its shiny scales.

I've deleted those files now, so I'm hoping that will be the end of this. But the last email said that there'd been overloading in the past 24 hours.

It also said that the load was being caused by a specific script, the one used for account creation. But that makes no sense at all, because I disabled the email-sending code days ago! And if it was from this script being repeatedly spammed, I'd see that in the database - there'd be a lot of bizarrely-named unvalidated accounts clogging it up - but I don't. I did see a few unvalidated accounts, but they seemed like real people, and I've received emails from some saying they'd never got the validation email, presumably for the same reason I've been unable to send out mail myself.

I've temporarily disabled account creation, just to be sure.

So I don't know what's going on, or whether I've fixed it, or whether it'll just go down again in a few hours. It's not as if there's anything I can monitor to see load building up, or where it's coming from, which is absolutely crucial if there's to be any hope of fixing something like this.

What a terrible time for it! I'm supposed to be releasing MARDEK very soon!

If anything like this ever happens again, I'll be posting on ∞ my Twitter account ∞ with updates.

4 COMMENTS

Tama_Yoshi82~4Y

I have a friend who did a Bachelor's degree in computer security, and he had stabs in the dark from the quasi-nothing I told him (maybe it's a front-end XSS vulnerability, maybe someone logged into the server with FTP due to the password being weak). Said no viruses were detected here by his anti-virus. Said SSL/LTS appeared secure. Said it's really annoying you don't have access to the logs. Said alora fane has also not being blacklisted for sending spam emails (although, apparently, SiteLock removes you from these blacklists, so...)

I suggested you contact him, he said he's very busy, but could potentially look into it quickly. If you're willing, I can send you his contacts.

Tobias 1115~4Y

Thanks for asking someone with knowledge in this area about this! Of course the whole crippling social anxiety thing makes the idea of talking to someone about this something I'd rather find another way around... but thanks for at least giving me the option!

Since my site's still up at the moment, I'm hoping that means I fixed the root cause... but I suppose I'll find out when I wake up tomorrow. I mean, I did find two very suspicious folders full of dodgy files, so I can't imagine they were doing nothing! Notably, they were both deep in two screenshots folders, suggesting they were put there by something that looks for folders with that name? I'd also added something called dopresskit() to handle press stuff for Sindrel Song, which might have introduced a vulnerability that was exploited... but really I just don't know.

I don't think it would have been a weak password issue though; I use generated ones which are just a bunch of gibberish characters. It also seems strange to me that they'd not do a whole lot more if they had that kind of access.

Thanks for asking someone with knowledge in this area about this! Of course the whole /crippling social anxiety/ thing makes the idea of talking to someone about this something I'd rather find another way around... but thanks for at least giving me the option!

Since my site's still up at the moment, I'm /hoping/ that means I fixed the root cause... but I suppose I'll find out when I wake up tomorrow. I mean, I did find two very suspicious folders full of dodgy files, so I can't imagine they were doing nothing! Notably, they were both deep in two screenshots folders, suggesting they were put there by something that looks for folders with that name? I'd also added something called dopresskit() to handle press stuff for Sindrel Song, which /might/ have introduced a vulnerability that was exploited... but really I just don't know.

I don't think it would have been a weak password issue though; I use generated ones which are just a bunch of gibberish characters. It also seems strange to me that they'd not do a whole lot more if they had that kind of access.

Alright. If you change your mind, do tell. My friend is really pleasant and I doubt you would find much issue with him.

Ptyrell37~4Y

Hey on the plus side, I'm sure you'll get a few more twitter followers out of this!