Lack of investment a threat to Irish ISPs

IRISH INTERNET service providers (ISPs) are running the risk of disruption to their internet services because of a lack of investment, a security expert has warned.

Technical director with Rits Security, Conor Flynn, said cutbacks could leave ISPs open to similar problems experienced at Eircom over the past two weeks, which left subscribers with little or no internet access for several hours.

“One of the dangers always is that things like patching and upgrading services like these are almost seen as extra levels of insurance when there’s no need for it. Until there’s an incident it looks like dead money,” he said.

“I would think that there were other ISPs who are likely to be in a situation where they could be a target for a denial of service or possibly DNS [domain name server] poisoning.”

The Eircom disruption was caused by a drastic increase in traffic between 6pm and 11.15pm on Monday. It followed a similar incident eight days earlier.

“The DNS servers [through which most ISP traffic goes] have the ability to deal with higher volumes of traffic – that’s not the issue,” said Eircom spokesman Paul Bradley. “The issue is when you have to deal with 100 per cent increase in your traffic volumes. They can’t cope. Therefore the customer experiences congestion, or they can’t get on the internet.”

There are fears that another attack could leave internet users cut off again. Following the attack, Eircom said it was taking steps to try to prevent similar attacks.

“Since we spotted irregular traffic patterns, we have taken measures to try to curb the activity and curb the impact traffic is having on customer experience.

“We have taken measures . . . to minimise the amount of bogus requests getting through to our DNS servers; we’ve taken steps to make changes in terms of software upgrade patches and hardware architecture adjustments.”

However, the measures were described as “reactive steps rather than proactive” by Mr Flynn.

He has also called for action at governmental level. “We don’t have what’s called national infrastructure protection centre or organisation at a governmental level in Ireland like a lot of other countries, such as the UK and the US, would have, who would have critical infrastructure protection and would communicate with ISPs and help them in defending against denial-of-service attacks.”

Meanwhile, consumers who fear being cut off have options. During Monday’s disruption, a number of Eircom users managed to get back online through their PC by using alternative DNS settings obtained by signing up for free accounts online.

The system works on a simple basis. Traffic goes through your ISP’s DNS servers. Should these be flooded with traffic – as happened with Eircom at the weekend – you can still get online by going around the congested servers, using alternatives such as OpenDNS or similar sites such as DNS Resolvers or DNS Advantage.

Using these DNS services might seem risky, but Mr Flynn said the approach may be one way forward for internet users who find their services disrupted.