Lessons from 8th June’s Massive Internet Outage across the Globe
The massive internet outage on Tuesday, June 8, 2021, which saw several leading news portals and other very popular sites around the world disappear (for sometime during the day), yet again, stresses on the importance of network resilience and need to improve our approach to critical infrastructure.
What exactly happened?
On Tuesday, Several prominent websites experienced a brief but global outage due to glitches in cloud services provider Fastly’s content delivery network (CDN).
Some of the big names include Reddit, Spotify, Twitch, GitHub, Quora, PayPal, Shopify, CNN, the Guardian, the New York Times, the BBC, the Financial Times and more, which flashed the message “Error 503 Service Unavailable,” have now been recovered.
The internet outage reportedly affected websites across 80 service locations including India. The US-based CDN provider offers vital but behind-the-scenes cloud computing “edge servers” to these popular sites. These servers store, or “cache,” content such as images and video in places around the world so that it is closer to users, allowing them to fetch it more quickly and smoothly.
While the sites were affected for only a few hours, it is a lesson that the importance of network resilience simply cannot be ignored. Moreover, it shows the important role CDN’s play in people’s lives.
A spotlight on CDNs
Platforms such as Facebook, Amazon and those with large quantities of data held in global libraries, host their geographically relevant content closer to where that content is to be consumed. This ensures the end customer is able to access the content faster. Majority of web traffic across the world today is routed through CDNs.
While Fastly identified the problem and a fix was applied, with the CDN provider justifying “customers may experience increased origin load as global services return” the damage has been done. However, Nikhil Taneja Managing Director-India, SAARC & Middle East, Radware states that while organizations often use CDN providers to support global site and application performance, the trouble is, CDNs provide a particularly insidious cover for attacks as organizations cannot block traffic coming from the CDN’s IP addresses.
Lotem Finkelstenn, Head of Threat Intelligence at Check Point Software Technologies, agrees. “CDNs generate replicas of original websites for the website owners to allow load balancing. So instead of everyone all over the world accessing one centralized server and causing an overload, what they do is actually spread the load between different replicas,” he says.
He explains with an example referring to the recent CDN provider, Fastly. “The original server could sit in San Francisco, but there are replicas in Paris, Manhattan, Tel Aviv and Hong Kong. Everyone is routed to the nearest server to their device, and when a CDN fails, it means that all the replicas are unavailable and no one is able to see the content from the original server. So it seems like Amazon, Reddit, Twitch and all these big sites have been attacked in unison, but they were not attacked. There is no outage for these companies. The only outage was at Fastly, the CDN that serves them.”
Not the first time
Short-term internet outages are not uncommon and this is also not the first time that an issue with CDN has caused many other dependent websites to go down. Previously in 2020, Cloudflare, another leading global cloud platform, had faced issues that impacted its client websites. The glitch resulted in sites such as Discord, Feedly, Politico, Shopify, and League of Legends going down.
Finkelstenn also compared the Fastly incident with a similar incident from October 2016, where the Mirai botnet infected several high-profile targets with distributed denial-of-service (DDoS) attacks.
“Mirai was an IoT botnet that took control of cameras and other such devices, making them send requests to take down Dyn, the DNS company that served many brands, including Twitter, BBC, Visa and Reddit,” he says.
With increased dependence on online and digital services that most of us neither understand nor control, we as organizations, societies and individuals are exposing ourselves to new risks.
“Networks have never been more critical than they are right now. Business, education, telemedicine, social, all have moved to virtually and multi-participant interactive video calls have become fundamental to our daily lives. Besides, a massive consumption of streaming media (largely video based), and similarly an all-time high in online gaming continue to drive CDN growth,” says Vivek Kalra, Head of Telecom & Cloud Business – INDIA & SAARC, Juniper Networks. The problem is, when a CDN goes down, websites don’t have an added line of defense against cyber attacks.
While attacks on critical infrastructure and network glitches cannot be completely ruled out, the recent incident showed that smart organizations use a more sophisticated approach to ensure that more sophisticated companies experience outages, but they can also recover fairly quickly.
As the Guardian editorial aptly sums, “The outage, like the pandemic, should remind governments, companies and citizens of our vulnerabilities and the importance of designing with not just the slickest outcomes but also the worst-case scenarios in mind.”
