A Thursday denial-of-service attack that took down Twitter and caused disruptions for Facebook and LiveJournal was reportedly a coordinated attack on a single blogger.
The target is apparently a Georgian blogger known as Cyxymu, according to Mikko Hyponnen, a researcher with F-Secure. The attacks affected Cyxymu’s Twitter, YouTube, Facebook, and LiveJournal accounts, and also resulted in spam messages sent from Cyxymu’s account.
“Launching DDoS attacks against services like Facebook is the equivalent of bombing a TV station because you don’t like one of the newscasters,” Hyponnen wrote in a blog post.
“Whoever is behind this attack, they had significant bandwidth available,” he continued. “Our best guess is that these attacks were done by nationalistic Russian hackers who wanted to silence a visible online opponent. While doing that, they’ve only managed to attract more attention to Cyxymu and his message.”
Cyxymu’s Twitter account has since been restored. In a Tweet posted about eight hours ago, he blamed the Russian KGB for the attack.
Facebook confirmed to CNet that Cyxymu was the target of the attack. Facebook did not immediately respond to a request for comment.
Twitter did not provide any details on what took down its site. “As to the motivation behind this event, we prefer not to speculate,” co-founder Biz Stone wrote in a blog post.
“The continuing denial of service attack is being mitigated although there is still degraded service for some folks while we recover completely,” Stone wrote. “Please note that no user data was compromised in this attack.”
Stone noted that the “attack was a reminder that there’s still lots of work ahead.”
LiveJournal said in its own blog post that the site was up, but still experiencing some connectivity problems. “LJ may behave a little quirky for the time being,” the company said.
DDoS attack that downed Twitter also hit Facebook
The same denial-of-service attack that took down Twitter this morning also slammed Facebook but with much less dramatic results.
Facebook noted on its site this afternoon that it too was fending off a distributed denial-of-service attack that was slowing its site. Unlike Twitter, which was down for two hours this morning, Facebook remained online.
“You may have had trouble accessing Facebook earlier today because of network issues related to an apparent distributed denial-of-service attack,” the company wrote. “We have restored full access for most people. We’ll keep monitoring the situation to make sure you have the reliable experience you expect from us.”
Web site performance monitor AlertSite reported that Twitter’s site wasn’t back 100% until 2 p.m. EDT. AlertSite also noted that Facebook appeared to suffer little more than a few sporadic errors. Facebook’s availability was at 97% at 10 a.m. when the attack was underway, and it was up to 100% availability soon after that.
While there’s little more than online chatter and guesswork about the origins of the attacks, security analysts say the incident raises red flags that two giant Internet companies, like Twitter and Facebook would be hit in the same assault.
Randy Abrams, director of technical education at ESET, an IT security company based in Bratislava, Slovakia, said his best guess is that a major botnet herder was offering a demonstration of the power of his botnet to a potential client with a major target in mind.
“They could have been saying, ‘Look what I can do to Twitter. I think my botnet can handle whatever you want it to do,’” said Abrams. “I’d put my money on this being a demonstration, a show of force, by someone looking to hire out their botnet.”
Graham Cluley, senior technology consultant for Sophos, told Computerworld that whoever launched the attacks should beware the clout of those he’s going after.
“Anything is possible, and we could make guesses like this until the cows come home … We simply don’t have enough information yet to be certain as to what the motivation was,” he said. “One thing is certain — if they did do this as a demonstration of how powerful their botnet is, they’ve just made themselves some new and angry enemies in the shape of some major Web 2.0 companies. I wouldn’t be surprised if the computer crime authorities put some serious effort into trying to track down whoever was responsible. After all, if they can bring down social networking sites they can bring down banking sites.”
Cluley also said it’s not yet clear why Facebook faired so much better than Twitter. It could have been that the bulk of the assault was aimed at Twitter or that their defenses simply weren’t as tough.
The attack against Twitter brought the site down between 9 a.m. and 11 a.m. EDT this morning. This afternoon, the microblogging site was still struggling with slowdowns and interruptions caused by the assault.
“As we recover, users will experience some longer load times and slowness,” Twitter reported in its status update at 12:46 p.m. EDT. “This includes timeouts to API clients. We’re working to get back to 100% as quickly as we can.” The company had not posted another update by 3:30 p.m.
Oddly enough, even though the attack hit both Twitter and Facebook, while Twitter was down, frustrated users vented on Facebook. One Facebook user noted, “Suffering tweet withdrawal.”
Post a Comment