Biz & IT —

How extorted e-mail provider got back online after crippling DDoS attack

Hint: It had nothing to do with the $6,000 ransom it paid to the Armada Collective.

How extorted e-mail provider got back online after crippling DDoS attack

ProtonMail, the encrypted e-mail provider that buckled under crippling denial-of-service attacks even after it paid a $6,000 ransom, said it has finally recovered from the massive assaults seven days after they began.

"It has now been one week since the first attack was launched against ProtonMail," officials wrote in a blog post published Tuesday. "Since then, we have been subject to the largest and most extensive cyberattack in Switzerland, with hundreds of other companies also hit as collateral damage. In addition to hitting ProtonMail, the attackers also took down the datacenter housing our servers and attacked several upstream ISPs, causing serious damage."

Tuesday's update still maintains that there were two waves of attacks carried out by two separate groups. The first attack, the post said, was executed by the Armada Collective, a group that performs distributed denial-of-service attacks on selected targets and then demands a ransom of thousands of dollars to get the assaults to stop. As Ars reported last week, ProtonMail was roundly criticized by many security professionals for paying the group $6,000 in bitcoins, only to come under a much more powerful attack in the following days.

The second round of attacks were much more extensive. For reasons not made public, ProtonMail officials said they were sponsored by a wealthy nation-state. Getting back online required the technical assistance of several services, including networking experts from IP-Max, service provider Level 3 Communications, and Radware, a DDoS-mitigation service. Even now, the attacks are continuing, but they're no longer capable of knocking ProtonMail offline for long periods of time. In Tuesday's post, ProtonMail officials wrote:

  • ProtonMail was attacked by at least two separate groups. The first attacker, the Armada Collective, demanded a ransom, more on this can be found in the previous posts copied below. The Armada Collective has contacted us to deny responsibility for the second attack.
  • The second group caused the vast majority of the damage, including the downing of the datacenter and crippling of upstream ISPs, exhibiting capabilities more commonly possessed by state-sponsored actors. They never contacted us or made any ransom demands. Their sole objective was to take ProtonMail offline, at any cost, with no regards for collateral damage, and to keep us offline for as long as possible. They have still not been identified.
  • It was not until the 3rd day of attack that we realised there were two separate attackers. Given the sophistication of the attack used by the second group, we believe they may have been preparing their attack against us for some time. After seeing the first attack, they chose to strike immediately afterwards in the hopes that they would not be discovered as being a separate attacker.
  • If there are DDoS experts interested in reviewing the attack data, we welcome them to contact us at security@protonmail.ch

There was no explicit mention this time that the group responsible for the second wave was sponsored by a nation-state.

Tuesday's update came a few weeks after the Swiss Governmental Computer Emergency Response Team warned of the recent arrival of the Armada collective.

"The Armada Collective blackmails their victim, demanding 10 BTC (Bitcoins), which is around 2,500 (Swiss Francs) [or about $2,480 at the exchange rates at the time]," CERT officials wrote in an advisory last updated on October 22. "At the same time, the hackers launch a Distributed Denial of Service Attack (DDoS) against the victim's website to demonstrate their power. This demo DDoS attack usually last for 15min-30min, while the bandwidth varies from around 300Mbit/s to 15GBit/s and occasionally even more. The attackers threats [sic] their victim that in case of non-paying, they will launch another, even bigger DDoS attack to bring the victims website down."

While much is known about the Armada Collective and an earlier DDoS-for-ransom group called DD4BC, little is known about the second attack gang that ProtonMail said hit it. Speculation about the group's motives run the gamut from blackhats who want to punish companies for paying ransoms to a wealthy nation that wants to shut down ProtonMail's encrypted e-mail service.

ProtonMail has promised to release a detailed report on the attacks. It will be worth paying attention to it to see what more can be learned.

Channel Ars Technica