CUBE discusses recent Distributed Denial of Service (DDOS) attacks
Last Friday’s attack against Dyn Inc. was felt almost immediately after it started at 07:00 am EST. Users of Paypal, Reddit, Twitter, Netflix, Spotify and others, reported outages.
Cyber Security threat researchers have done the post mortem on the attack and warned it was more likely the work of amateurs than a foreign state sponsored attack. What is particularly interesting about this attack to our industry, is that there are in fact TWO distinct stories here. The first story is this: How did this attack work?
Imagine you could convince thousands of friends to show up at your local cafe. And everyone ordered everything on the menu, with a line of people out the door ready to do the same thing: In very short order the cooks would be overwhelmed, the wait staff frazzled, the cleaning staff in a panic and the food supplies exhausted. The instant that new food supply and help showed up it would happen again and again. It would be next to impossible for any of the regular customers of the cafe to get any service.
This is what happened to DYN’s servers. The hackers sent an incredible amount of information requests to DYN’s servers, making it next to impossible for DYN’s servers to provide any service to regular users. And since the DYN service was basically providing an “address book,” needed to help your devices connect to Spotify, Netflix and various other services, it became impossible for regular users to access Spotify and all those other services reliant on DYN’s “address book” service. Click Here for a live view of this occurring in real time.
So here is the noteworthy thing about this part of the story:
The hackers did not use normal computers to launch this attack. Instead, they hacked into thousands upon thousands of “things” connected to the internet – like security cameras, routers and other “internet-of-things” devices – and used those to generate the massive swarm of traffic that made DYN, Spotify, Netflix and others unreachable. The “things” that got hacked were all vulnerable because their suppliers did not take security seriously.
The moral of the first story is simple:
When connecting “things” to your network, like music players, on-hold players, or digital signage systems: better make sure you are working with a partner like CUBE who takes security seriously.
The second story is this:
What did this attack mean for users of Pandora, Spotify and any other internet streaming music services providing music to retailers, offices, and more? SILENCE.
Some CUBE servers also got hit with a DDOS attack this week as the hackers are not done with their attempts to shut down the internet.
However, because CUBE hardware is designed to keep playing music even when it cannot communicate with CUBE servers, clients serviced by CUBE affiliated partners never had any moment of silence. We withstood the attacks without any negative repercussions to our partners’ service level agreements with their clients – in fact, none of our clients or partners were even aware of the attack.
