Dear Reader,
One thing that stood out among last month's security news is the fact that the internet services we rely on daily are becoming increasingly centralized and, therefore, the impact of security incidents are becoming ever more severe. In this installment of our Cyber Security Magazine newsletter, we look back at some major service outages in recent times and what caused them.
Facebook – Oct 4, 2021
Unless you spent the last month under a rock, you must have noticed the outage affecting Facebook and many of its services, such as Messenger, WhatsApp, and Instagram. Caused by a faulty configuration change to the company's Border Gateway Protocol (BGP) records, the issue persisted for several hours because Facebook's internal tools depend on the BGP routing and reachability information as well – and getting people in front of the actual servers takes a while.
Let's Encrypt – Sep 30, 2021
Not a fault on the side of Let's Encrypt, but still causing a few hiccups around the web was the expiry of one of the service's root certificates in late September. The non-profit Certificate Authority run by Internet Security Research Group provides millions of internet services with TLS certificates, enabling secure communication for much of the internet for free. The downside to so many people relying on one service is that if changes are afoot, you will inevitably have a few folks who forget to prepare for it.
Fastly – June 8, 2021
Earlier this year, one of the world's largest Content Delivery Networks (CDN), Fastly, suffered an outage affecting many popular web services, such as Amazon, Reddit, Spotify, and eBay. What usually enables websites to be served to you more swiftly ended up being a massive point of failure for the services delivering their content with Fastly. What is surely the oddest thing about this particular incident: It was caused by a single Fastly customer, whose configuration change triggered a bug in the company's network.
Various Email Providers – Oct 21, 2021
Aside from configuration issues and expired certificates, there are still "good old" DDoS attacks, of course. This month, they hit privacy-focused email providers around the globe, including Fastmail, Posteo, and Guerrilla Mail. Attackers were demanding payments from the affected organizations to stop the attacks. An extortion scheme, as The Record notes, that remains popular among cybercrime gangs, albeit overshadowed by ransomware.
Outlook
At Cybersecurity Magazine, we have featured a number of articles on DDoS attacks throughout this year, including how this type of attack started, how to defend against it, and how it keeps evolving. If you would like to find out more, check out our website.
Cybersecurity Magazine Editorial Team
-----------------
For our latest video discussions and podcasts please see the River Publishers YouTube.
The latest journal articles from River Publishers in all areas of cyber security can be found on the River Publishers website.
https://cybersecurity-magazine.com/
https://www.linkedin.com/showcase/cybersecuritymagazine/
@magcybersec
https://www.facebook.com/Cybersecurity-Magazine-100535232117942