top | item 23535192

“Massive DDoS attack” just T-Mobile error?

127 points| sethbannon | 5 years ago |twitter.com | reply

14 comments

order
[+] graton|5 years ago|reply
I think this is what caused the problems with the MVNO (Mobile Virtual Network Operator) I use. I noticed today that calling and texting weren't working on our phones. Our MVNO uses T-Mobile as its network, so this kind of explains everything.

Luckily I use Google Voice as my primary # and it rang on my computer but I didn't understand why it wasn't ringing on my cell phone. Now I know :)

[+] momothereal|5 years ago|reply
Out of curiosity, how does a T-Mobile error affect services like Messenger and Facebook?

I live in Canada and they were unreachable for about an hour. My ISP has no relation to T-Mobile. Is the FB network solely dependent on a mobile carrier?

[+] cbhl|5 years ago|reply
Some ideas:

- Facebook sends SMS 2FA. Users on T-mo would be unable to receive codes. What behavior does the 2FA-sending code have in this condition? Does the process just sit there and time out (possibly exhausting some finite server resource, like file descriptors)? Are there automated retries in a client? Are humans retrying aggressively because they are frustrated by being unable to log in?

- SWEs and SREs on on-call rotations may have configured pages to go to a cell phone on T-mo. Usually the three fallbacks are "phone call", "sms", and "pubsub/push notification", but both voice and data were broken today. May have taken longer to notice/escalate/resolve an outage.

- Messenger may have seen increased load because people were using it to replace voice and texts that they would have normally sent over T-mo.

[+] erikerikson|5 years ago|reply
Certainly if you are connecting through T-Mobile hardware either as a customer or as a customer of a provider who contracted with T-Mobile on your behalf.

Even if you weren't connecting through T-Mobile managed hardware, if the T-Mobile customer base found or was provisioned with alternative connection mechanisms then they could have been competing with you for bandwidth.

The direct answer is no, network outages don't effect services but if you can't access them the experience is though they were out. Consider a friend you want to call. They may be alive and well (or even besides you) but if your phone can't reach theirs you still can't talk to them on your phones.

[+] boomboomsubban|5 years ago|reply
Are you sure the problem wasn't on your end? The Twitter thread explains why some sites were listed as down, and shows Facebook up for the day.
[+] aritraghosh007|5 years ago|reply
Would love to see if T-Mobile publishes an RCA later. There seems to be so many conflicting reports speculating about a DDoS attack such as this https://www.forbes.com/sites/jessedamiani/2020/06/15/t-mobil...
[+] boomboomsubban|5 years ago|reply
From the post, the "attackmap" always looks like that and downdetector was showing that those sites were down for T-Mobile users. Other than that, the only report listed was an anonymous Twitter account.
[+] downerending|5 years ago|reply
Having dealt with T-Mobile at length regarding local tower problems, I doubt we'll see anything but a blanket denial. And perhaps a map showing that we all have "excellent" coverage.
[+] dekhn|5 years ago|reply
I thought it was funny when somebody linked to an "attack map" which was really just a heatmap of the US population (https://xkcd.com/1138/) and then went on to speculate it was the US gov't messing with protestors.
[+] alfiedotwtf|5 years ago|reply
"It starts with T-Mobile. They were making some changes to their network configurations today. Unfortunately, it went badly."

KATE: Wait a minute, the fourteenth, that's the same day the worm ends its run. I mean... Da Vinci virus, didn't Phreak say that's what he was being charged with? Look, they blame hackers!