Twitter crippled by denial-of-service attack

[Brian Warkoczeski]

Twitter crippled by denial-of-service attack

by Caroline McCarthy

www.cnet.com

August 6, 2009

Twitter was inaccessible for several hours on Thursday morning, followed 
by a period of slowness and sporadic time-outs (and more outright 
downtime). The company is blaming an "ongoing" denial-of-service attack 
but has not said anything further.

Judging by the timeline of my TweetDeck client, it looks like the 
problems started right around 6 a.m. PDT.

"We are determining the cause and will provide an update shortly," 
Twitter's staff posted at 6:43 a.m. PDT on the service's status blog.

Then, around 7:49 a.m. PT, the company posted, "We are defending against 
a denial-of-service attack and will update status again shortly."

Around 8:15 a.m., the status blog post was updated with "The site is 
back up, but we are continuing to defend against and recover from this 
attack." (I still was unable to access Twitter.)

Perfomance monitoring firm AlertSite says that Twitter's home page went 
down at 6:05 a.m. PT and was showing 40 percent availability at 8:04 
a.m. PT, but that timeouts were continuing from most of its monitoring 
locations at 8:30 a.m.

Way back when, Twitter outages were so commonplace that it was worth 
reporting when it didn't crash--as when it stayed afloat during the 
entire South by Southwest Interactive Festival in 2008. Now, a few 
million dollars of venture capital later, the service is far more stable.

Twitter wants to establish itself as a communications standard rather 
than just a social-media brand. It's been a crucial platform for 
information exchange in the face of global events where more traditional 
means of broadcasting have been inaccessible or blocked.

Some features of Facebook were also experiencing uptime issues on 
Thursday--one reader speculated that log-in servers may have been 
down--which raises the issue of whether a hosting company problem is to 
blame. Alternately, a denial-of-service attack could have been targeting 
both high-profile companies.

Facebook responded later in the morning on Thursday with a statement. 
"Earlier this morning, we encountered issues within our network that 
resulted in a short period of degraded site experience for some 
visitors," the statement read. "No user data was at risk and the matter 
is now resolved for the majority of users. We're monitoring the 
situation to ensure that users continue to have the fast and reliable 
experience they've come to expect from Facebook."

Hacker attack or not, the Facebook outages were not on the same scale as 
Twitter's by any means, said Ben Rushlo, a senior consulting manager at 
performance firm Keynote. "There's been a few slow data points but you 
couldn't even put them in the same sort of stratosphere of comparison," 
Rushlo told CNET News.

DDOS (distributed denial-of-service) attacks typically come from a 
collection of compromised computers called a botnet, said Graham Cluley, 
a senior technology consultant at Internet security firm Sophos. The 
botnet computers can inundate a Web site's servers with communication 
requests, legitimate or malformed to cause extra trouble.

Botnet-based DDOS attacks are difficult to deal with because it can be 
hard to distinguish legitimate communications from those that are part 
of the attack. And just blocking access from the IP addresses of 
offending computers poses complications: "You don't want to block 
legitimate users. The computers probably sending (the DDOS) traffic to 
Twitter belong to legitimate people," Cluley said.

DDOS attacks can be motivated by people seeking ransom money or seeking 
to make a political statement, but Cluley suspected that's not the case 
in this particular attack. "My guess is this is most likely some kid in 
a back bedroom who has access to a large botnet and is showing off to 
his friends what he can do," Cluley said.

Twitter is unusual in that much of its use comes not through its Web 
site but through an application programming interface (API) that lets 
software such as TweetDeck interact with the service. API access also 
suffered during the outage.

"Often there is collateral damage" during a denial-of-service attack, 
Cluley said. "Other servers can begin to fall over."

There have been a notable number of DoS attacks recently in the 
social-media space: On Wednesday, URL shortener Trim claims that one 
such attack rendered its truncated URLs inaccessible for some time; 
earlier in the week, blog network Gawker Media was downed by an attack 
that targeted The Consumerist, a property that it recently sold but 
still hosts on its servers.

There has been no indication that any of these various attacks are 
connected. But it's probably not a coincidence that they all coincide 
with the annual Defcon hacker convention.