Wikipedia was sporadically inaccessible in Europe and the Middle East last weekend following a suspected denial of service (DoS) attack.
The referencing site experienced intermittent issues in the early hours of Saturday morning (7th September) which would have made it unavailable for many users.
Wikimedia, the parent company of Wikipedia, confirmed that the site had been hit by a “malicious attack that has taken it offline in several countries for intermittent periods.”
DoS incidents are often brought about by a service’s underlying systems being overloaded, and to a user it would appear as though the site was not displaying any content. For the affected business it could mean that its systems are no longer responding following the attack.
Wikimedia has described the incident as malicious, which would mean that an attacker has purposefully tried to exhaust the site’s resources, denying legitimate user access.
On occasion, DoS events can happen because of legitimate use. For example, during the Black Friday sales, a high number of shoppers clamouring to bag a bargain on the same website at the same time could have the same affect.
Organisations concerned about the impact of DoS attacks should read guidance published by the NCSC, which also includes a minimal DoS response plan that any organisation should have in place.
More than a million IoT radio devices affected by backdoor vulnerability
Vulnerabilities have been uncovered in Telestar Digital GmbH Internet of Things (IoT) radio devices that could allow attackers to hijack systems remotely.
The vulnerabilities were found by researcher Benjamin Kunz, of Vulnerability Lab, when an anomaly was spotted on a private server.
The first (CVE-2019-13473) covers a weak password vulnerability within an undocumented telnet service presented by the device. This is vulnerable to brute force attacks, which could give the attacker root access to the device’s underlying Linux operating system.
The second (CVE-2019-13474) is a command execution vulnerability which could allow attackers to gain access and issue unauthorised commands.
The affected product line, which includes portable radios and DAB stereos, are sold across Europe and utilise Bluetooth and internet connectivity.
Vulnerability Lab disclosed their findings to Telestar Digital GmbH with the latter responding and producing a patch within the week.
Telestar confirmed they had not seen any evidence of the vulnerabilities being exploited, but automatic updates via Wi-Fi are now available which can be implemented by setting impacted devices back to factory settings and accepting latest firmware version downloads.
The NCSC’s Paul W wrote a blog post last year highlighting the importance of improving cyber security standards for IoT devices. This post followed the publication of the report, ‘Secure by Design: Improving the cyber security of consumer Internet of Things’ which was issued by the Department for Digital, Culture, Media and Sport (DCMS) and supported by the NCSC.