Spark stabilises network following nationwide outages

LATEST: Explanations about Spark outage don't add up — security expert

UPDATE / Sept 7, 10am: "The situation relating to this weekend’s denial-of-service attack has stabilised and traffic volumes across our network have returned to normal," Spark spokesman Conor Roberts tells NBR.

A denial-of-service attack, launched from hijacked PCs, seeks to overload a service with connection requests, rendering it unaccessible. Yesterday, Spark suffered nationwide problems with is broadband and mobile data services. The problems were tied to the attack.

"Our teams have put a number of steps in place to mitigate the issue we have seen during the past two days. At the same time, the pressure on our network from these attacks is subsiding.

"We have isolated the customer connections that had been exploited by cyber criminals to send vast amount of traffic through our network to overseas destinations."

It is important to understand that the Spark network itself was not compromised, Mr Roberts says. The customers who inadvertently installed this malware became vectors for the attack on another part of the internet.

"These sorts of attacks are dynamic in nature and the tactics involved are constantly changing so Spark will continue to remain vigilant and monitor the situation.

"Like all ISPs, we cannot guarantee that an attack like this will not intensify again or take a different form."

It’s important that customers keep firmware and security suites up to date to ensure they are not vulnerable to malware or viruses, Mr Roberts says.

A former Spark staffer told NBR he hoped the company's DNS Server setup had been upgraded. He also warned that other ISPs could be equally vulnerable.

UPDATE / Sept 6, 5pm: Spark did not immediately respond to NBR's request for an update, but the company's official Twitter account posted: 

"It appears as though we're not out of the woods on web browsing issues yet. Thanks for your reports, everyone. The team is on the job."

Through social media, Spark is encouraging users to change their DNS settings — a fix that appears to work, but that will be a step too techy for 99% of its customers.

EARLIER / Sept 6: Spark New Zealand is experiencing a high volume of traffic affecting its customers’ ability to browse on broadband and mobile data, spokesman Conor Roberts tells NBR.

"The root cause is likely to be a handful of customers on our network whose computers are affected by malware, generating high levels of traffic destined for overseas sites. It’s highly likely that these customers are not even aware that this is happening," Mr Roberts says.

"It is likely this has occurred as a result of some customers inadvertently installing the malware, which is then activated from offshore, causing increases in data volumes. The increase in fibre upload speeds means that large volumes of traffic can now be generated, but it is important to note this is not an issue with the network as such."

A flurry of complaints on social media indicate the problem is nationwide.

Spark's new Lightbox streaming TV service, which is open to customers of all ISPs is served by Akamai and not affected (or not, ironically, unless you're a Spark customer).

"Our technical teams have been working through the night to monitor block the affected connections but the situation is dynamic and continuing.  We’ll continue to monitor and prevent these issues as fast as possible. For customers this unfortunately means that service will be intermittent when they occur," Mr Roberts says.

"We are working to fix this as quickly as possible. For those customers who do need to urgently use the internet, there is a temporary workaround which can be found here: http://helpbusiness.spark.co.nz/app/answers/detail/a_id/3701/related/1

"We realise this is a fairly technical workaround.  We will stay focussed on sorting the issue as quickly as we can and we apologise to those customers impacted."

Spark has around 50% share of the ISP market, and around 40% of the mobile market.