CAO Denial of Service Attack - My Arse
The Irish Times today reported that the Central Applications Office website that students use to accept their college places was unavailable for a time this morning due to a denial of service "cyber-attack".
A denial of service attack is not like a hacker attack where a criminal tries to gain access to a server in order to read some files contained on the server or to modify the contents in some way. During a denial of service attack the criminal attempts to overwhelm the web server with thousands and thousands of bogus requests for web pages. The requests become so numerous that the server cannot handle the traffic and so legitimate customers cannot access the site contents either. It is as if seventy thousand customers tried to get through the front door of a shop all at the same time. In extreme cases the web server is so overwhelmed that it just keels over and dies.
Since a denial of service attack does not really get the attacker anything, most DoS attacks are motivated by spite. Lithuanian banks and government services have been disabled on more than one occasion by attacks that originated in Russia and many believe these attacks were state sponsored cyber-terrorism. It might be interesting to speculate about what the motivation for an attack on the CAO website might be.
The CAO was very quick to announce that the failure of service was the result of an attack. Without detailed analysis of the server logs it would be difficult to distinguish between a DoS and seventy thousand customers simply turning up all at once. In the case of the CAO, however, the office actually asked all seventy thousand customers to turn up at once, so it is no great surprise that there was a short sharp spike in server requests.
If it turns out that the bulk of the requests came from overseas computers in Eastern Europe and Spain, for example, then it probably was a coordinated denial of service attack. I suspect however that the bulk of requests came from Ireland where thousands of of anxious teenagers got up out of bed early and went online to find out which college courses they got into. That so many of them did so as soon as they could, should not have come as a shock to anyone and the appropriate infrastructure should have been put in place to deal with them.
In a world of invisible online badies lurking in dark corners of the Internet it is far to easy to blame anonymous others for an institution's incompetence. If the CAO got it wrong it should fess up and apologise instead of blaming the online boogieman.
A denial of service attack is not like a hacker attack where a criminal tries to gain access to a server in order to read some files contained on the server or to modify the contents in some way. During a denial of service attack the criminal attempts to overwhelm the web server with thousands and thousands of bogus requests for web pages. The requests become so numerous that the server cannot handle the traffic and so legitimate customers cannot access the site contents either. It is as if seventy thousand customers tried to get through the front door of a shop all at the same time. In extreme cases the web server is so overwhelmed that it just keels over and dies.
Since a denial of service attack does not really get the attacker anything, most DoS attacks are motivated by spite. Lithuanian banks and government services have been disabled on more than one occasion by attacks that originated in Russia and many believe these attacks were state sponsored cyber-terrorism. It might be interesting to speculate about what the motivation for an attack on the CAO website might be.
The CAO was very quick to announce that the failure of service was the result of an attack. Without detailed analysis of the server logs it would be difficult to distinguish between a DoS and seventy thousand customers simply turning up all at once. In the case of the CAO, however, the office actually asked all seventy thousand customers to turn up at once, so it is no great surprise that there was a short sharp spike in server requests.
If it turns out that the bulk of the requests came from overseas computers in Eastern Europe and Spain, for example, then it probably was a coordinated denial of service attack. I suspect however that the bulk of requests came from Ireland where thousands of of anxious teenagers got up out of bed early and went online to find out which college courses they got into. That so many of them did so as soon as they could, should not have come as a shock to anyone and the appropriate infrastructure should have been put in place to deal with them.
In a world of invisible online badies lurking in dark corners of the Internet it is far to easy to blame anonymous others for an institution's incompetence. If the CAO got it wrong it should fess up and apologise instead of blaming the online boogieman.
Comments