ProtonMail 'mitigates' DDoS attacks, says security not breached

Launch of ProtonMail 3.0 now knocked back

ProtonMail has announced that it has successfully mitigated the DDoS attacks which had hobbled it since last week, while also confirming security systems had not been breached.

The encrypted email service was still being hit as of yesterday, after paying a Bitcoin ransom to one of the two DDoS attackers (the smaller, seemingly less powerful one), known as the Armada Collective, largely due to pressure from other affected companies.

The Swiss Government's CERT (Computer Emergency Response Team) has today published a notice discouraging the payment of ransoms to DDoS attackers.

ProtonMail stated that it is "happy to announce ... that after several days of intense work, we have largely mitigated the DDoS attacks against us."

"These attacks took ProtonMail offline making it impossible to access emails, but did not breach our security," according to a statement sent to The Register.

The attacks against the company have continued, but due to "the valiant efforts" of ProtonMail partners, IP-Max and Radware, they "are no longer capable of knocking ProtonMail offline for extended periods of time."

As our infrastructure recovers over the next several days, there may still be intermittent service interruptions, but we have now largely restored all services.

The DDoS targeting ProtonMail was extremely sophisticated, according to the company, which prides itself on offering a means of secure communication to "activists, dissidents, and journalists".

It was "the largest and most extensive cyberattack in Switzerland," according to ProtonMail, "with hundreds of other companies also hit as collateral damage". The attack also completely took down the the data centre housing ProtonMail's servers and even affected "several upstream ISPs, causing serious damage".

The Register wishes to note it has been unable to corroborate these claims.

ProtonMail thanked the network experts from Geneva-based IP-Max "who volunteered their time and expertise. Without their heroic 18-hour effort, it would not have been possible for ProtonMail to come back up so quickly in the face of such a massive attack".

During the rescue operation, the IP-Max team accomplished the impossible, and managed to connect a brand new direct line from our data centre to the main PoP in Zurich, 114 kilometers away, on a Saturday, in less than 18 hours!

ProtonMail also partnered with Radware, who came into the help the crypto company at a reduced price. Radware's Carl Herberger told The Register that the attack was still ongoing and as such the responders were limited as to what information they might be able to share.

Referencing the 300Gbps DDoS attack against Spamhaus in 2013, Herberger stated "basically, we have the attackers trying all possibilities to get to a DDoS situation".

Asked about attribution, Herberger suggested the resources necessary for such a sizeable, varied, and persistent attack could indicate a nation state.

"It's interesting," he told The Register. "The conjecture around here is that a 'truly' secure email service is more likely to receive these kind of attacks" as it is the only way of preventing these "dark" communications, he added.

ProtonMail has stated that the attack set back its development timeline, and announced that it would no longer be releasing ProtonMail 3.0 at the end of November.

The Register understands that the attack was exceptionally aggressive, with ProtonMail previously stating that there were two stages (and two attackers) that had provoked the company's woes.

The first stage is the volumetric attack which was targeting just our IP addresses. The second stage is the more complex attack which targeted weak points in the infrastructure of our ISPs.

This second phase has not been observed in any other recent attacks on Swiss companies and was technically much more sophisticated.

ProtonMail has promised to reveal the full story behind the attack at some point. It also encouraged DDoS experts "interested in reviewing the attack data" to contact them at security@protonmail.ch. ®


Biting the hand that feeds IT © 1998–2017