New Zealand internet outage blamed on DDoS attack on nation's third largest internet provider
(2021/09/03)
- Reference: 1630674790
- News link: https://www.theregister.co.uk/2021/09/03/nz_outage/
- Source link:
Parts of New Zealand were cut off from the digital world today after a major local ISP was hit by an aggressive DDoS attack.
Vocus – the country's third-largest internet operator which is behind brands including Orcon, Slingshot and Stuff Fibre – confirmed the cyberattack originated at one of its customers.
According to a [1]network status update , the company said: "This afternoon a Vocus customer was under DDoS attack... A DDoS mitigation rule was updated to our Arbor DDoS platform to block the attack for the end customer."
[2]
It added:
Based on initial investigations it was this rule change that disrupted service to a range of Vocus customers. We are working closely with the vendor of this platform to understand why this occurred.
This will have affected a range of Vocus customers for approximately 30 minutes.
Details are still sketchy, but the outage has caused significant disruption across the country with many people working from home due to COVID-19 restrictions.
[3]A report by Reuters early this morning suggests that Vocus's response to the cyber onslaught may have had a knock-on effect resulting in the 30-minute outage across the country, including the bigger cities of Auckland, Wellington and Christchurch. We've asked Arbor DDoS protection vendor Netscout for comment.
[4]
[5]
It appears that services were returning to normal at the time of publication.
[6]It's time to decentralize the internet, again: What was distributed is now centralized by Google, Facebook, etc
[7]UK VoIP telco receives 'colossal ransom demand', reveals REvil cybercrooks suspected of 'organised' DDoS attacks on UK VoIP companies
[8]Israeli firm Bright Data named as enabler of Philippines government DDOS attacks on opposition groups
[9]Not very sage rage over UK pay outage: Opayo says 'ohheyno' as payment processor's payments stop processing
Elsewhere, earlier this week [10]two UK VoIP operators had their services trampled following a DDoS attack that is believed to have been sparked by a Russian cyber gang which called for a "colossal ransom."
And in unrelated news, a net outage at Sky Broadband that originally hit the South East of England and part of Wales earlier this week appears now to have been resolved.
Customers started complaining about problems on Wednesday evening. Despite anecdotal reports that things were on the mend, Sky Broadband punters continued to report issues with their service throughout Thursday.
[11]
A Sky spokesperson originally told us that it was "aware of issues impacting Sky Broadband and Talk customers in Cardiff and parts of South East England" and that engineers were fixing the problems.
But customers took to Twitter and [12]Down Detector is reporting outages further afield including East and West Midlands.
Yesterday evening, a Sky spokesperson told us that the "majority of Sky customers impacted by the intermittent issues with Broadband and Talk should now have their service restored."
[13]
The company apologised for any "inconvenience this has caused." ®
Get our [14]Tech Resources
[1] https://www.vocus.co.nz/networkstatus
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YTJGvYS4iJ2ZVLZAlfCKgAAAAMc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.reuters.com/technology/widespread-internet-outages-hits-users-across-new-zealand-2021-09-03/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTJGvYS4iJ2ZVLZAlfCKgAAAAMc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTJGvYS4iJ2ZVLZAlfCKgAAAAMc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2021/08/11/decentralized_internet/
[7] https://www.theregister.com/2021/09/02/uk_voip_telcos_revil_ransom/
[8] https://www.theregister.com/2021/08/26/qurium_bright_data_philippines_ddos/
[9] https://www.theregister.com/2021/06/17/opayo_outage/
[10] https://www.theregister.com/2021/09/02/uk_voip_telcos_revil_ransom/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTJGvYS4iJ2ZVLZAlfCKgAAAAMc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://downdetector.co.uk/status/sky/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTJGvYS4iJ2ZVLZAlfCKgAAAAMc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
Vocus – the country's third-largest internet operator which is behind brands including Orcon, Slingshot and Stuff Fibre – confirmed the cyberattack originated at one of its customers.
According to a [1]network status update , the company said: "This afternoon a Vocus customer was under DDoS attack... A DDoS mitigation rule was updated to our Arbor DDoS platform to block the attack for the end customer."
[2]
It added:
Based on initial investigations it was this rule change that disrupted service to a range of Vocus customers. We are working closely with the vendor of this platform to understand why this occurred.
This will have affected a range of Vocus customers for approximately 30 minutes.
Details are still sketchy, but the outage has caused significant disruption across the country with many people working from home due to COVID-19 restrictions.
[3]A report by Reuters early this morning suggests that Vocus's response to the cyber onslaught may have had a knock-on effect resulting in the 30-minute outage across the country, including the bigger cities of Auckland, Wellington and Christchurch. We've asked Arbor DDoS protection vendor Netscout for comment.
[4]
[5]
It appears that services were returning to normal at the time of publication.
[6]It's time to decentralize the internet, again: What was distributed is now centralized by Google, Facebook, etc
[7]UK VoIP telco receives 'colossal ransom demand', reveals REvil cybercrooks suspected of 'organised' DDoS attacks on UK VoIP companies
[8]Israeli firm Bright Data named as enabler of Philippines government DDOS attacks on opposition groups
[9]Not very sage rage over UK pay outage: Opayo says 'ohheyno' as payment processor's payments stop processing
Elsewhere, earlier this week [10]two UK VoIP operators had their services trampled following a DDoS attack that is believed to have been sparked by a Russian cyber gang which called for a "colossal ransom."
And in unrelated news, a net outage at Sky Broadband that originally hit the South East of England and part of Wales earlier this week appears now to have been resolved.
Customers started complaining about problems on Wednesday evening. Despite anecdotal reports that things were on the mend, Sky Broadband punters continued to report issues with their service throughout Thursday.
[11]
A Sky spokesperson originally told us that it was "aware of issues impacting Sky Broadband and Talk customers in Cardiff and parts of South East England" and that engineers were fixing the problems.
But customers took to Twitter and [12]Down Detector is reporting outages further afield including East and West Midlands.
Yesterday evening, a Sky spokesperson told us that the "majority of Sky customers impacted by the intermittent issues with Broadband and Talk should now have their service restored."
[13]
The company apologised for any "inconvenience this has caused." ®
Get our [14]Tech Resources
[1] https://www.vocus.co.nz/networkstatus
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YTJGvYS4iJ2ZVLZAlfCKgAAAAMc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.reuters.com/technology/widespread-internet-outages-hits-users-across-new-zealand-2021-09-03/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTJGvYS4iJ2ZVLZAlfCKgAAAAMc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTJGvYS4iJ2ZVLZAlfCKgAAAAMc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2021/08/11/decentralized_internet/
[7] https://www.theregister.com/2021/09/02/uk_voip_telcos_revil_ransom/
[8] https://www.theregister.com/2021/08/26/qurium_bright_data_philippines_ddos/
[9] https://www.theregister.com/2021/06/17/opayo_outage/
[10] https://www.theregister.com/2021/09/02/uk_voip_telcos_revil_ransom/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YTJGvYS4iJ2ZVLZAlfCKgAAAAMc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://downdetector.co.uk/status/sky/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YTJGvYS4iJ2ZVLZAlfCKgAAAAMc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
It wasn't DDoS...
ShadowSystems
It was DNS. It's always DNS. =-)p
Wait for the big hit
Constant online connectivity is a real problem in the world where everybody has been busy to make themselves dependent on the internet. The example here, where large parts of a population in a country gets serious disruptions is a mere taste of what is possible and what is likely to come.
Let us take out a small country? Isn't that a nice thought? Present it with the words " You have a nice country there. It would be a shame if anything happens to it. ".
But like so many things, nothing will be done about it until a "big" country is taken down for more than just a few minutes. We should diversify communications. We should learn again not to depend on answers that must be within milliseconds of the question. Slow down may be the best way to speed up.