July in cyberspace: continuing denial-of-service attacks and scams

July in cyberspace: continuing denial-of-service attacks and scams
Photo: Seiko Kuik

In the last day of June, the SOS2 emergency call handling system was down for about an hour. During that time, emergency response centres processed emergency notifications on paper, which took longer than usual and resulted in call queues. The incident was caused by the response to a complex event: many users were simultaneously opening and updating the event, causing the system to continuously recalculate new dispatch plans. Due to a significantly higher than usual load, the server cache filled up, causing disruptions in the operation of SOS2.

Due to a denial-of-service attack, there were disruptions in the networks of various telecommunications operators in the functioning of Mobile-ID in the afternoon of 3 July. There were also disruptions in Mobile-ID service of Telia in the afternoon of 5 July, but the cause remains unknown to us.

In the morning of 8 July, the Eesti app failed to process queries for identity documents and other services for about an hour. As an option to use the app as a proof of identity had been added a day before, the number of users of the app and the number of queries grew steeply. This revealed a configuration error that did not manifest itself under lighter loads.

In July, denial-of-service attacks took place against the websites managed by the Estonian Centre of Registers and Information Systems (RIK), the name server of the Estonian Ministry of Defence and the Ministry of Justice and Digital Affairs, the website of Enterprise Estonia, as well as the border queue management information system eestipiir.ee. As a result, brief interruptions occurred in their operations, but the attacks did not have any wider imact. Once again, denial-of-service attacks were carried out against RIA, CERT-EE, SMIT, and TEHIK name servers, but they had no impact.