Typepad blogging platform hit by cybercriminals for fifth day in a row; a demand for ransom; popular gay blogs affected

As this is written, Towleroad, perhaps the most popular gay blog in North America, is down, as is GoodAsYou. Their blogging platform, Typepad, is being hit by on-again, off-again DDoS (distributed denial of service attacks). Typepad's owner, SAY Media is working with the F.B.I.

Graphic: Shadowserver.org

     That this is happening at all is more evidence that the NSA (National Security Agency) is not doing its job effectively.
     Recently Bloomberg News claimed that the NSA knew about the Heartbleed OpenSSL security breach for two years, quietly exploited it to spy on Americans, but neither said nor did anything to protect U.S. businesses and individuals from having passwords and data stolen.
     More about the TypePad attack from TechCrunch:

     The attack appears to be similar in nature to those which have hit several other high-profile tech companies in recent weeks, including Meetup, Basecamp, Vimeo, Bit.ly and others. Though Typepad has not yet publicly shared much information about its attackers, the typical scenario involves an attacker knocking the victim’s site offline using a flood of traffic, then refusing to stop the barrage until the victim company pays a small amount of “ransom.” The initial amount is usually fairly insignificant, but once the victim agrees, it tends to go up, as they’ve now confirmed themselves as an easy mark.
     While DDoS attacks have always been difficult to handle, many victims today are facing a newer, more powerful sort of attack that exploit flaws in older Internet protocols which were never secured particularly well. Meetup.com, for example, fell after being hit by an NTP-based DDoS attack – meaning, an attack that leveraged NTP (Network Time Protocol), which is used to sync time clocks between multiple servers.
     It’s not uncommon for NTP attacks to be in the 10 Gigabits range, which only a couple of years ago would have been a record-breaking size, said Matthew Prince, CEO at CloudFlare, a company which has been stepping in to help get victims’ sites back online. (Meetup’s attack was 8 Gigabits in size, and knocked the site offline for several days in March).