Bandwidth Hit with DDoS Attack, Dealing with Service Disruptions

Bandwidth and a number of critical communications service providers have been targeted by a rolling distributed denial of service (DDoS) attack.

With DDoS, cybercriminals flood a network with so much malicious traffic that it can’t operate or communicate normally. Regular traffic then comes to a halt.

Bandwidth issued the following statement on Wednesday about the DDoS attack:

“Bandwidth teams are currently investigating an incident impacting inbound and outbound calling at this time. Customers may experience intermittent call failures or voice quality issues and/or one-way audio scenarios. All teams are actively engaged.”

David Morken is Bandwidth‘s co-founder, chairman and CEO. In a blog written for customers and partners, he said, “while we have mitigated much intended harm, we know some of you have been significantly impacted by this event.”

Bandwidth’s David Morken

“We are working around the clock to support your teams and minimize the impact of this attack,” he added. “Our account managers and support teams have been actively reaching out to customers individually to address any issues. If you are experiencing problems and you haven’t heard from us yet, please let us know.”

According to Bleeping Computer, the Bandwidth DDoS attack caused nationwide voice outages over the past few days.

David Doolittle is Bandwidth’s director of communications.

“Currently, we are seeing some intermittent disruptions in service and working around the clock to restore,” Doolittle told Channel Futures.

DDoS Attacks Can Be Very Disruptive

Erich Kron is KnowBe4‘s security awareness advocate. He said attacks against tier one service providers “can be very disruptive if not handled immediately.”

KnowBe4’s Erich Kron

“DDoS attacks and related extortion [are] nothing new to the internet, and has been occurring for years,” he said. “However, as more services are consolidated with single providers, the impact is far greater than if attacking a single organization in the same way. By using the name and reputation of the REvil ransomware group in the DDoS extortion demands, the attackers are likely trying to look more menacing than they really are. While they were able to disrupt the service for a short time, it is unlikely that they can do so for an extended time, especially now that countermeasures have been deployed.”

Cyber crime is a very lucrative business, and DDoS extortion campaigns are no exception, Kron said.

“By renting botnets for a time, even the small groups can appear to have more resources than they really have,” he said. “Organizations are wise to have a DDoS mitigation strategy in place in order to react quickly and avoid long outages if targeted by this sort of cyber crime.”

Particular Organizations Highly Vulnerable to DDoS Attacks

Chris Clements is vice president of solutions architecture at Cerberus Sentinel, an MSSP.

Cerberus Sentinel’s Chris Clements

“These attacks can adversely affect any victim, but in addition to the usual expected damage from system downtime, there are particular organizations that are uniquely vulnerable to damages from DDoS attacks,” he said. “First, any organization that depends on low latency network communications, in this instance a VoIP provider; but in others, online gaming companies. A DDoS attack that would otherwise introduce a noticeable but manageable delay in service for many organizations – say a half-second up to a second – can make a low latency provider like VoIP or online gaming effectively unusable, as any delay can quickly make the service intolerable for users.”

The second type of organization that can face inordinate damages from such an attack is one that has embraced the cloud for scalable services, Clements said.

“Scalable services are great for rightsizing computing power to varying demand,” he said. “But an organization leveraging this can find themselves facing an astronomical bill from their provider if hit by a major DDoS attack.”