The New Zealand Stock Exchange (NZX) was down again briefly on Wednesday morning.
This followed a shut down and trading halt on Tuesday afternoon due to a DDoS attack.The SMC asked experts to comment on the attack.
Professor Dave Parry, Department of Computer Science, AUT, comments:
"This is a very serious attack on critical infrastructure in New Zealand. The fact that this has happened on a second
day indicates a level of sophistication and determination which is relatively rare.
"A Distributed Denial of Service attack (DDoS) works by overloading traffic to internet sites e.g. web servers, etc.
This means the web servers cannot service transactions normally and this is clearly a huge issue for a trading site
where timing and assurance that transactions have completed are both critical. Attackers normally infect large numbers
of 'innocent' computers with malware, turning them into 'bots' that can be instructed to keep trying to access the
affected site. It’s like large numbers of people all shouting at you at once – you can’t distinguish the real messages
from the false ones.
"Normally there are two main ways to react:Shut down the 'bots' – often by getting users to update security patches and delete the malware.Block the IP addresses of the 'bot' machines using a firewall - blacklisting - so that the NZX site doesn’t have to deal
with them.
"Because this is coming from overseas, the first option is difficult although there will be communication with
legitimate ISPs and governments overseas. For the second option, Spark will be looking at network traffic to identify
sources and block them. Sophisticated attackers will be changing the IP addresses of the attacking computers,
potentially via Virtual Private Network software, turning them on and off and also adding new ones.
"GCSB will be involved along with CERT in trying to identify the source of the attack. Unfortunately, the skills and
software to do this are widely available and the disruption of COVID and people working from home all over the world
potentially with lower security on their computers means that these attacks are easier than usual.
"These sort of attacks can be mounted by governments or private criminal gangs. Recently, Australia has pointed the
finger at the Chinese government for similar attacks; the Chinese government has strongly denied this. As yet, there is
no evidence that this attack is by an overseas government. Criminal gangs, especially if they are based in
poorly-regulated countries, can use these attacks to demand ransoms.
"This is not an issue around New Zealand computers being vulnerable to security breaches, but it is worth checking that
anti-virus and security patches are up to date, and that people running websites, etc. notify their ISP if there is
unusual activity."
No conflict of interest.