6

Last night (August 9th) was census night in Australia. Conveniently, the Australian Bureau of Statistics (ABS) have a website where you can enter your household's statistical information.

If you work in IT, you can probably see the potential issue of an entire country logging on to a website at the same time (I had predicted it). And not surprisingly the website went down.

ABS Down

The next day the Australian Statistician, David Kalisch called the DDOS an "attack", "from overseas". Which was quickly rebutted by Michael McCormack, Minister for Small Business.

It is clearly an example of DDoS. But was it a deliberate DDoS attack? Or an accidental DDoS due to unpreparedness and 16 million people all trying to access a service at once?

  • You've misunderstood McCormack's comments. He hasn't rebutted Kalisch at all. He agrees that it was an attack: but he doesn't like calling it a "successful attack", because for him that phrase implies data was stolen. And the answer to your question is in that article. – EnergyNumbers Aug 10 '16 at 6:59
  • I think the biggest confusion will be people thinking that hackers penetrated the ABS's security, as opposed to merely making it unavailable. – Andrew Grimm Aug 10 '16 at 11:23
  • @Andrew why is that the biggest confusion? – user30557 Aug 10 '16 at 13:23
  • @Dawn Because a lot of people in the media have been saying for weeks that this new online census would be major a privacy risk, and now the media are saying that the ABS site was "hacked". – curiousdannii Aug 10 '16 at 14:17
  • 1
    If you wait a month, free analytics should be available for the site which might be enough to demonstrate if significant activity from outside of the country occurred. – called2voyage Aug 10 '16 at 18:25
9

It's not clear at the moment, because there is no public evidence that a DDoS of any description occurred in Australia on census night. And the people in a position to possess any nonpublic evidence that might exist (ABS/IBM/other authorized operators of the census equipment) have not deemed it necessary to produce it for public scrutiny.

The best we can do is look at the explanation that's being officially put forward, and weigh it against the available circumstantial evidence for plausibility.

Arguments/evidence in favor of a malicious DoS/DDoS

  1. The government says that's what happened. From ABS officials, to MP's and ministers, to the prime minister himself, they've all been relatively consistent in blaming the outage on a malicious DoS. There's been plenty of quibbling and waffling about whether the event was an "attack" or just an "obstruction"/"frustration", and whether or not it should be called "successful". But they all tend to agree that the outage was caused by a malicious (and most typically, "foreign") actor.

  2. Most mainstream news sources (including: Sydney Morning Herald, Australian Financial Review, Sky News, Yahoo News, and others) are not challenging the government's version of events. One expects them to do due-diligence and not report something that the government says is fact unless they've independently confirmed it. That's the point of journalism, after all, and the mainstream journalists say it was what the government says.

Evidence against a malicious DoS/DDoS

  1. Public activity logs show no evidence of a DDoS attack occurring at the time:enter image description here There's some further discussion and analysis of this here.

  2. Smaller and/or more tech-savvy news outlets (LifeHacker, The Conversation, News.com.au) have published articles questioning the claims about a malicious DoS, and generally concluding that it's at least equally likely that no attack occurred and that the system simply fell over under the weight of legitimate users trying to complete the census.

  3. Load testing done prior to the census going live appears to have underestimated actual demand. According to ABS statements, they planned for 0.5 million submissions per hour, and load-tested to somewhere between 1 million and 1.5 million submissions per hour. There are somewhere north of 12 million households in Australia, about half of which are located on the Eastern third of the continent. And with the census held on a weeknight, most people would be waiting until sometime after 5:00pm AEST to submit it. On that basis, it's easy to see how actual, legitimate demand could have exceeded what was expected and planned for.

  4. A recent ZDNet article, while characterizing the event as a "denial of service incident", attributes the following statement to the PM (albeit without citing where/when the statement was made):

    Prime Minister Malcolm Turnbull said today the Census site was not taken down by a DDoS attack.

    "There was some anomalous traffic on the night, that appeared to be anomalous, actually it was quite innocent it turned out, but that caused the ABS to take the site down," he said.

    "The site was not crashed by denial of service."

    Oddly, and quite contradictory, the very same article credits Australian Privacy Commissioner Timothy Pilgrim with stating:

    "I am satisfied that personal information was not inappropriately accessed, lost or mishandled," Pilgrim said in a statement. "The ABS's decision to shut down the website -- to avoid any prospect that the DoS attack could include or otherwise facilitate a data breach -- was, in the circumstances, a pro-privacy precaution."

  5. As time goes on, there seems to be a gradual backing away from claims of a significant attack. On the afternoon of the 11th the Sydney Morning Herald declared the attack(s) "small scale", "not particularly formidable", and "low level" (and if you watch the video accompanying the article, you'll also hear "That raises a couple of possibilities, one is that there were no DoS attacks. The government's maintaining that there are, we have to take them at their word on that.").

    And on the morning of the 12th, Sky News is describing the event as a "disruption" that came "from within Australia" and discarding previous suggestions that an overseas DDoS attack occurred.

    Also on the 12th, News.com.au published an article criticizing the system for underestimating the anticipated level of demand, and also pointing out that in previous online censuses (censii?) legitimate traffic was misinterpreted as a DDoS attack by a number of ISPs.

    A subsequent Sydney Morning Herald article notes IT analyst Kevin Noonan casting doubt on the idea of a malicious DoS occurring or succeeding:

    The attack was either a foreign or locally planned denial of service, or just a "large load" that appeared to be a denial of service but was in fact people trying to fill out the Census, he said. It "beggars belief" IBM's data centre could not handle a denial of service attack, he added.

  6. As the official story continues to evolve, it's worth keeping the timeline of events in mind. The ABS says they took the census offline at 7:30 PM on the 9th. However twitter indicates sporadic reports of outages from as early as 9:41 AM on the 9th, with a significant uptick from about 6:00 PM on the 9th (see also: 1, 2, 3). I personally tried to access the census several times between 6:30 and 7:00 PM AEST on the 9th, and could not (I'm on NBN fibre, so the problem wouldn't have been at my end).

  7. Nobody has claimed that the DoS attack continued past 7:30 PM, however it took nearly a full 48 hours before the census was brought back online. A malicious DoS attack is something that should be quickly addressable (particularly given the more recent reports downplaying the size and impact of the DoS).

  8. An ITWire article on Sunday notes that reports of problems accessing the census have continued since it was restarted, despite geoblocking now being enabled (the site reports as down because downforeveryoneorjustme.com is hosted in the U.S.) and a relatively lower volume of forms being submitted since it came back online (2.33 million forms were submitted on census night before the server went offline at 7:30 PM, versus 405,000 in the first 18 hours after it came back online) and no claims involving new DDoS attacks:

    Complaints continue even today, with Guardian Australia political columnist Katharine Murphy saying on the ABC's Insiders programme on Sunday morning that she had tried to submit her form on Saturday, but was unable to do so.

    The same article notes former Australian Bureau of Statistics chief Bill McLennan pointing out that even the ABS system designed to handle requests for paper forms was basically crippled by the amount of legitimate requests it was receiving (emphasis mine):

    McLennan said he had had personal experience with this system. "I rang at different times over one day and couldn't get into the system. In the end I arose from my slumbers early one morning and rang the number at 03:45, and the system worked like a charm - as it should because no people were involved! I would now put my money this problem being caused by bad estimation of the demand, and that is just bad management."

    Note that the system being discussed in that case is separate from the online census system, however still a good example of an ABS system that was rendered unusable by the sheer volume of legitimate requests and not as the result of any sinister/malicious action.

  9. On the 15th, Media Watch did an excellent piece on this issue, pointing out both the dodgy coverage by many mainstream news outlets, the blatantly conflicting stories put forth by the government, and the lack of any evidence supporting any of them. I recommend just watching it in its entirety; it thoroughly rubbishes claims that China and Russia were responsible for any DDoS activity, and includes this little gem:

    Well it may turn out the Chinese were behind it, but was there any evidence for the claim? And can we be sure the census computers were actually subject to a major attack?

    The answer? No, and no.

    I think we're done here.

Conclusion

My conclusion is that there was no malicious DoS attack on the census. #6 is the real clincher for me. We know there were problems accessing the census prior to when the ABS says they took the system offline. There's approximately an hour and a half of downtime unaccounted for, with the most likely explanations being a malicious DoS attack or too much legitimate load on the system. If we take Turnbull's #4 statement that "the site was not crashed by denial of service" at face value, the only remaining option is that it was crashed by legitimate traffic.

So there was, in technical terms, a denial-of-service that occurred. But that was more likely the result of millions of Australians all trying to complete the census at around the same time(s) and the census IT systems being underprovisioned (or poorly implemented and managed).

There's no actual evidence at this point of any malicious actions being taken by domestic or foreign actors against the Australian census. Such claims appear to be based purely upon government say-so, with zero independent verification taking place and observable facts which contradict the government's story. And those claims have been gradually tempering in a way that downplays the role and size of any alleged malicious DDoS attack.

Parting Thoughts

If we were to further examine the less tangible aspects of the issue, we would also find that this incident presents the government and the ABS with significant motivation for dishonesty while not really providing a malicious actor with much motivation for attacking the census (not with a DDoS at least). We'd also see that the timing of the 4 alleged DDoS attacks tended to strongly coincide with times when large numbers of Australians would be attempting to complete the census, and the possible use of an obfuscating scapegoat in claims that geoblocking failed as a DDoS mitigation strategy (which it just plain isn't).

There's also some keen irony in the demands for honesty levelled upon the Australian population by the ABS, and the blatant and brazen manner in which they appear to have lied to the entire population of Australia about what happened.

  • The "what's the motive of a foreign actor" argument is disingenuous - if it was a DDoS and the DDoS traffic was sourced outside of Australia, all it tells us is that the botnet is outside of Australia... Other than that - fairly good decomposition... – HorusKol Aug 11 '16 at 4:56
  • 1
    Please restrict your answer to evidence, there are a lot of points which are pure speculation/rethorical and are not appropriate here. – Sklivvz Aug 12 '16 at 1:14
  • @Sklivvz - Fair enough. Any better now? – aroth Aug 12 '16 at 2:47
  • Regarding point 1 for malicious DoS, if it is truly a malicious DDoS, then there is no question that the DoS are successful. If a DDoS triggered an authorized administrator to shut down service, as has happened here for 48 hours, then service is being denied to legitimate users, i.e. DoS is successful. The question is only whether it is actually a malicious DoS attempt or simply under provisioned server causing a DoS. People who quibble whether or not the DoS is successful, just don't understand what DoS means in technical terms. – Lie Ryan Aug 16 '16 at 8:27
0

The official ABS outage report said:

There were three denial of service incidents during the day. A denial of service is an attempt to block people from accessing a website.

The ABS was expecting denial of service incidents and the protective measures in place managed the first three attempts with only very minor service disruptions.

The Australian Signals Directorate (ASD), a Commonwealth intelligence agency, was notified of this by the ABS.

Use of the online form increased steadily during the day and as at 7:30 the system was receiving 150 forms per second and this was well within the tested capacity of the system.

Just after 7.30pm, the following confluence of events occurred:

  • A fourth denial of service attempt
  • A large increase in traffic to the website with thousands of Australians logging on to complete their Census
  • A hardware failure when a router became overloaded
  • Occurrence of a false positive, which is essentially a false alarm in some of the system monitoring information.

At the time of these events, more than two million forms had already been successfully submitted and safely stored. The ABS applied an abundance of caution and took the precaution of closing down the online Census form to safeguard and to protect data already submitted, protect the system from further incidents, and minimise disruption on the Australian public of an unreliable service.

Government and ASD were notified by the ABS. Reviews by IBM, ASD and ABS have confirmed that this was not a hack – no Census data was compromised.

Had these events occurred in isolation, the online system would have been maintained.

I don't think there's any reason to doubt that there were at least four DoS incidents on August 9, of which three were handled without much difficulty.

The relative sizes of the fourth DoS attempt compared to legitimate traffic, which presumably together brought down the router, is not currently clear.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .