DStv self-service portal taken offline by Dimension Data security response
The MyDStv self-service portal is back online after an almost nine-hour outage on Wednesday evening and Thursday morning after Dimension Data null-routed its Internet Protocol (IP) address.
Based on feedback from Dimension Data, it blackholed the server’s IP address after receiving a complaint about a phishing attack originating from the same network.
Absolute Hosting provides upstream services to the company that handles DStv’s web hosting, and confirmed that one offending IP address was null-routed, then later its whole network.
However, it wasn’t clear why Dimension Data blocked Absolute Hosting’s entire range of IP addresses.
Furthermore, Absolute Hosting said it had resolved the issue and was informed that the client whose IP address was null-routed would be re-opened, only for Dimension Data to bring their whole network offline.
The outage that brought down MyDStv began at around 22:30 on Wednesday and lasted until 07:18 on Thursday.
In a notice posted on the MyBroadband forum to customers impacted by the outage, Absolute Hosting provided its side of the story.
“[The Dimension Data] abuse team null-routed a single IP on our network after a client’s site was used to launch an attack against [Microsoft],” it said.
“They subsequently sent an email to us requesting us to take action, but the email was quarantined on [Microsoft 365], so the notice was never received. They apparently tried to call us and then 30 minutes later null-routed that IP.”
Absolute Hosting spent around four hours diagnosing the issue with the client, only to discover that traffic inbound and outbound for that IP was being dropped.
“After numerous calls and escalations, we were told that the ‘port would be opened,’” the company stated.
On Thursday morning, when they found their whole network offline and scrambled for a solution and explanation, Absolute Hosting searched for the original email notice from Dimension Data.
They found that the takedown notice was only sent at around 21:00 on Wednesday, while the IP was null-routed at 16:35.
The DStv self-service portal was broken on Wednesday, telling users they weren’t signed in even after going through the login flow
Dimension Data responds to MyDStv outage
MyBroadband asked Dimension Data about the incident, and it provided the following response to our questions.
“Strict security protocols are a critical element of Dimension Data’s overall security guidelines,” a spokesperson for the company said.
Dimension Data said it acts in the interest of the whole system, as the consequences of not doing so are often far more significant.
“As such, Dimension Data was alerted to a potential phishing attack on 2 November 2022, within the Absolute Hosting environment,” it said.
“Our services team alerted the client, who was unavailable. As a precautionary measure, we went ahead and suspended the services.”
Dimension Data said services were restored after working through the issue with the client on the morning of 3 November.
MyBroadband asked for clarity on why Absolute Hosting’s entire network was null-routed rather than just the offending IP address. It provided the following response:
“Dimension Data worked with the client to restore the services. Services could not be restored earlier as testing only took place this morning, due to the client’s availability.”
Absolute Hosting comments on MyDStv outage
Jade Benson, Absolute Hosting managing director
MyBroadband asked Absolute Hosting founder Jade Benson for comment.
“Absolute Hosting was only made aware of the abuse complaint hours after the affected client’s IP was null routed,” Benson stated.
“This information was provided to Absolute Hosting during a call with the managed services team, and shortly after being provided with this information, we were able to notify the affected client and have them remove the content responsible for the abuse complaint.”
Benson said they relayed this to Dimension Data, which agreed to remove the null routing.
“However, this was unsuccessful and resulted in complete loss of connectivity to our ranges,” he said.
“Dimension Data was notified of the issues and only restored routing hours later after a misconfiguration of [virtual LANs] was resolved.”
Now read: NTT launches first phase of load-shedding immune Johannesburg 1 data centre
Loading ...