News
German Telekom sees 900,000 routers go offline after possible cyberattack - expert comments
November 2016 by Stephen Gates, chief research intelligence analyst at NSFOCUS
Nearly 900,000 Deutsche Telekom customers were hit by network outages — an attack
reportedly aimed at hijacking consumer routers, the media reported on Tuesday.
The attack, which began on Sunday and continued till Monday, rendered the victims
without internet service on the weekend. According to the company, this is the
second such large-scale attack on internet-connected devices since late October.
Stephen Gates, chief research intelligence analyst at NSFOCUS, comments:
“In many broadband networks, customer premise equipment (home/business routers)
calls home to company headquarters to validate paying customers, and to periodically
get configuration and software updates. Take the systems offline that provider this
service functionality to the routers, and the network can likely be impacted.
Another possibility for the outage is that hackers uploaded malware to the update
servers, and this malware was either pushed or pulled to thousands of routers. This
is a perfect example of a denial of service outage that did not involve a targeted
DDoS attack.
"Most people don’t know that all broadband service providers have ensured they
have backdoors into ‘their’ customer-edge devices; which can be cable modems,
DSL modems, routers, etc. The reason for this is simple. It ensures people don’t
get services for free, while at the same time allowing the provider access into the
remote devices for troubleshooting, updating, billing, etc. This helps reduce truck
rolls and the associated costs. In this case, it appears that hackers have figured
out a way to capitalise on the backdoor, and cause a noteworthy denial of service
outage.”
