There are red faces at Ireland’s main telecoms operator, Eircom, in the aftermath of Monday’s apparent denial of service (DoS) attack by suspected hackers. Some observers are asking why the backbone of the country’s communications system was not better protected.
This is the second time in a fortnight that internet access has been crippled by what the national provider describes as “unusual and irregular online traffic”.
Eircom customers found themselves late on Monday afternoon unable to access web services, or that browsing was painfully slow, and it was close to midnight before a full service was restored.
An Eircom spokesman said that “an unprecedented volume of traffic” deliberately targeted its network during the past few days.”
Paul Bradley, head of communications at Eircom, told ComputerScope editor Paul Hearns that Eircom’s corporate customers running their own DNS servers were unaffected by the problem.
One commentator, Calyx Security MD John Ryan, told PC Live! it was “difficult” to protect against denial of service attacks but that there were commercial solutions available, such as Tipping Point IPS, to mitigate their effects by analysing the traffic going to a website and using advanced algorithms to block unwanted traffic while allowing valid user traffic to pass.
“I am surprised that Eircom did not have this type of technology in place to help protect its business and its users,” he told us.
He added that internet-based businesses should make sure they had invested in the appropriate technology to ensure they stayed online in the event of a denial of service attack.
One online security specialist who criticised Eircom was Paul C Dwyer, CEO at Team InfoSec. He said the attack would have been easy for Eircom customers to work around, by changing from DNS to something like OpenDNS, for example. However, Dwyer pointed out that Eircom would have had to be in a position to inform subscribers of their options. “The response handling or continuity planning was very poor,” he argued.
Dwyer suggested that, with a number of organisations letting their security people go over recent months, there could be a rise in the number of such problems. “Security is seen as a discretionary spend. A lot of organisations are letting people go and are letting their guard down [but] the bad guys aren’t going away.”
Responding to Ryan’s comments, Paul Bradley, head of communications at Eircom, stressed the company already had a range of protections in place but he accepted Dwyer’s point that providing customers with information in real time about the attack had “been a challenge”, and said the telco was looking at different ways to contact customers.
He said the difficulty was that people were reluctant to provide personal details, such as mobile phone numbers, which could make it easier for Eircom to inform them when there was an outage.
He confirmed that the operator had held meetings with other firms to “kick around ideas and discuss things”.
Another online security specialist said the most likely cause of Eircom’s problems was a DNS cache poisoning attack. Espion security consultant M
Ltd
