Executive Summary: Wikileaks recently faced a severe cyberattack immediately preceding a major document release. To secure its digital infrastructure, the organization transitioned to a robust cloud platform.
Yesterday we reported that Wikileaks' web site suffered a targeted denial of service (DOS) attack just before the publication of its most recent cache of sensitive documents. The site was down for only a few hours, according to Forbes' Andy Greenberg.
Today, The Guardian reports that Wikileaks turned to Amazon.com's Elastic Cloud Computing (EC2) service to get back online and survive the ongoing DOS attack. This strategic move highlights the importance of elastic, decentralized server hosting in modern web environments.
The Anatomy of the DOS Attack on Wikileaks
There are various ways to conduct a DOS attack, but most methods work by placing an enormous burden on a targeted server. For example, malicious actors might make a huge number of frivolous requests for pages of a web site until the server is overloaded and crashes, denying access to legitimate users.
Wikileaks originally claimed it was receiving a distributed DOS (DDoS) attack. A self-described "hacktivist" using the name th3j35t3r took credit for the attack, and later claimed it was not a distributed DOS attack, but rather a targeted application-layer disruption.
Why Cloud Infrastructure Mitigates Cyber Threats
The Guardian says that the EC2 pricing model and infrastructure makes the service significantly less vulnerable to DOS attacks. However, it's worth noting that last year a massive DDOS attack brought down the EC2 hosted site Bitbucket. That incident led some to caution against using cloud hosting for mission-critical services.
However, it could be that EC2 has drastically improved its defenses against DOS attacks since the Bitbucket incident. A highly scalable infrastructure would certainly help absorb malicious traffic spikes, as would hosting content on multiple redundant providers.
Understanding the Difference: Bitbucket vs. Wikileaks
Update: George Reese of the cloud security company Enstratus tells us that the attack on BitBucket was very different from the attack on Wikileaks. The BitBucket attack targeted a vulnerability specific to EC2 that Amazon.com claims to have since fixed. The WikiLeaks attack, in contrast, was a generic DOS attack coming from outside the network. The BitBucket attack actually targeted internal IO resources, causing localized failure.
According to the Guardian, not all of Amazon.com's servers are hosted in the US and "it could cause a major incident if the US government were to take action against a company on the basis that it might be hosting material the government finds embarrassing." While it may be unlikely that the US government would take direct action against Amazon.com, it is entirely possible that Amazon.com would decide to remove Wikileaks on its own due to terms of service violations.
However, the latest cache of documents are not hosted on the same servers as the rest of the Wikileaks site. The actual document repository, cablegate.wikileaks.org, is securely hosted by a French company called Octopuce.
Frequently Asked Questions (FAQ)
To provide further context on this developing story, we've compiled some common questions regarding cloud security and hacktivism:
- Why did Wikileaks move to Amazon Web Services (AWS)?
- Wikileaks moved its hosting to Amazon Elastic Cloud Computing (EC2) to utilize a highly scalable infrastructure capable of mitigating intense distributed denial of service (DDoS) attacks.
- What type of cyberattack did Wikileaks face in 2010?
- Wikileaks suffered a severe denial of service (DOS) attack right before publishing a massive cache of documents, causing temporary downtime.
- Can cloud hosting like Amazon EC2 prevent all DDoS attacks?
- While elastic cloud pricing models and decentralized servers help absorb DDoS traffic, no system is perfectly immune, as seen when a different attack brought down Bitbucket on EC2.