Experts cast doubt on ABS' Census DoS claims

Technology and security experts are questioning claims by the national statistics agency that a series of denial-of-service attacks forced it to take the Census site offline last week, arguing a lack of proper planning and bad decisions were more likely the cause.

The Australian Bureau of Statistics said it downed the Census website late last Tuesday to mitigate against a claimed four DoS attacks perpetrated from overseas. The failure of the network geoblocking function and the collapse of a router also contributed to its decision.

The site remained down well into Wednesday, with users continuing to report problems accessing it in the week following.

The federal government pinned the blame for the problems on Census service provider IBM, which built the platform and is also hosting it out of its Baulkham Hills, Sydney data centre.

The government is conducting a review into the matter to ascertain whether IBM had failed to mitigate against a "completely predictable" DoS attack, as Prime Minister Malcolm Turnbull labelled it.

But reports have been swirling in the IT and security industries that the systems issues actually lay with the ABS' architecture and security provisions, rather than any external attack.

Last week security commentator Patrick Gray reported the ABS got spooked by one small DoS attack and made a series of bad decisions that ultimately led to the site being pulled offline.

He said the website was initially hit by a small-scale attack from overseas, which the ABS mitigated by blocking all non-Australian packets. Some time later, the website was affected by separate a DNS reflection attack that filled up the firewall's state tables.

In response, the ABS decided to reboot the firewall without syncing its ruleset to the secondary firewall, which resulted in an outage.

Compounding its problems, logs that were later sent out from IBM's monitoring equipment were misinterpreted as a data exfiltration attempt given the initial DoS attack, prompting the ABS to shut down the site to avoid any data compromise, according to Gray.

He also reported that the ABS and IBM had been offered prevention services for DDoS attacks from their upstream provider, but had declined them and instead decided to simply geoblock all traffic outside of Australia should an attack occur.

The ABS did not respond to repeated requests from iTnews for clarification on the issue.

Today, computer science and security experts from the University of Wollongong went public with their theory on what went wrong, similarly claiming the evidence of a DoS attack "does not stack up".

Professor Katina Michael and Professor Willy Susilo from the school of computing and IT argued it was more likely that the ABS had failed to appropriately dimension the resources needed for the site.

“Network activity maps on the night of 9 August don’t show evidence of an attack from overseas. All the maps are showing no activity for the night in question," Michael said.

“[The ABS] mentioned the possibility of four attacks, but by the time the fourth attack happened, the website would have been closed down to ensure the security of the data. This does not sound like a denial of service attack to me," Susilo said.