Grants.gov Denial of Service Attack - Site Performance

Beginning Tuesday, May 17, 2005 the Grants.gov site has experienced significant degradation in performance. It was determined Thursday evening, that Grants.gov was the target of a denial of service attack that began early Tuesday morning. The attack targeted the download feature of the PureEdge viewer installer file (approximately 3MB) and requested a download every few seconds. This activity continued until we finally detected the attack Thursday evening. Over the course of the 35 hours during which the attack was under way, Grants.gov received a total of over 21,000 download requests from the address in question. And probably transferred 50 GB of file data.

The processing capacity chewed up by this attack, coupled with a high volume of application submissions the Grants.gov site became almost inaccessible at times. Despite experiencing numerous periods of a 100% usage of the processors over the last 3 days over 600 applications were successfully received. The site did remain up at all times.

In order to stop the attack, several IP addresses had to be blocked by the hosting facility. Rolling IP addresses were used during the attack and all traffic from the 67.119.190.xxx subnet has been blocked. This subnet will remain blocked to guard against additional changes in IP address until the attacker can be shut down. The subnet appears to be owned by a legitimate service provider and was probably hijacked for this attack.

This service provider serves the California area and any users will be blocked from the site. The Grants.gov Contact Center has been notified and any calls from blocked users will be documented and the Agency noticed of the caller inability to submit.

Grants.gov apologizes for the inconvenience and added work this attack has caused both the agencies and grant community. Many Agencies have had to extend closing dates and handle numerous calls from frustrated applicants and congressional offices. Grants.gov staff has preserved the server logs as evidence and I will refer the incident to HHS security for possible law enforcement action.