NZX's network connectivity restored, after trading was halted for 3.5 hours today due to a second cyber attack; Commerce Minister says it doesn't look like the attack came from a state actor

Commerce and Consumer Affairs Minister Kris Faafoi says the cyber attacks that have halted trading on the NZX twice in the past 24 hours don't look like they came from a state actor.

Faafoi said he had been told they didn’t have the “trademarks” of attacks from a state actor, but couldn’t rule this out categorically.

AUT Department of Computer Science Professor Dave Parry said it would be difficult to track the source of the attack. He noted a state actor could get a gang to launch the attack and demand a ransom, making it look like it was a private criminal.

The NZX wouldn't comment on the source.

The Government Communications Security Bureau said it doesn't typically comment on whether or not it's involved in investigating a particular case. Parry was confident it would be involved. 

Trading on the NZX resumed at 3pm today, after it was halted at 11:24am. Meanwhile trading was halted at 4:57pm on Tuesday, as the NZX was heading towards a near record close.

Attackers were saturating the network with large volumes of internet traffic. This kind of attack is known as a volumetric DDoS, or distributed denial of service attack.

The NZX said it was working with its network service provider, Spark, to address the "system connectively" issue.

The Financial Markets Authority said: “NZX notified us of the incident last night and we remain in close contact around this issue. We will support NZX wherever we can to assist them in operating safely and efficiently through this situation. 

"Our ongoing review of NZX strategy and governance of technology is advanced and general cyber security resilience is being assessed as part of that process.”

Here's more from Parry:

This is a very serious attack on critical infrastructure in New Zealand. The fact that this has happened on a second day indicates a level of sophistication and determination which is relatively rare.

A Distributed Denial of Service attack (DDoS) works by overloading traffic to internet sites e.g. web servers, etc. This means the web servers cannot service transactions normally and this is clearly a huge issue for a trading site where timing and assurance that transactions have completed are both critical. Attackers normally infect large numbers of 'innocent' computers with malware, turning them into 'bots' that can be instructed to keep trying to access the affected site. It’s like large numbers of people all shouting at you at once – you can’t distinguish the real messages from the false ones.

Normally there are two main ways to react:

1. Shut down the 'bots' – often by getting users to update security patches and delete the malware.
2. Block the IP addresses of the 'bot' machines using a firewall - blacklisting -  so that the NZX site doesn’t have to deal with them.

Because this is coming from overseas, the first option is difficult although there will be communication with legitimate ISPs and governments overseas. For the second option, Spark will be looking at network traffic to identify sources and block them. Sophisticated attackers will be changing the IP addresses of the attacking computers, potentially via Virtual Private Network software, turning them on and off and also adding new ones.

GCSB will be involved along with CERT in trying to identify the source of the attack. Unfortunately, the skills and software to do this are widely available and the disruption of COVID and people working from home all over the world potentially with lower security on their computers means that these attacks are easier than usual.

These sort of attacks can be mounted by governments or private criminal gangs. Recently, Australia has pointed the finger at the Chinese government for similar attacks; the Chinese government has strongly denied this. As yet, there is no evidence that this attack is by an overseas government. Criminal gangs, especially if they are based in poorly-regulated countries, can use these attacks to demand ransoms.

This is not an issue around New Zealand computers being vulnerable to security breaches, but it is worth checking that anti-virus and security patches are up to date, and that people running websites, etc. notify their ISP if there is unusual activity.