X Outage Cyberattack: Analyzing Elon Musk’s Claims, Technical Insights, and Global Implications

Craig: welcome back. and today, we're gonna talk about the worldwide x outage. as today, we're recording this as march eleventh, and yesterday, there was a huge disturbance where x, was under a distributed denial of service attack, and was out for a big chunk of the day, and there's a lot of stuff going on around it. john, you said you weren't affected by this.

Jon: yeah. no. well, i like, i so i use twitter more just to stay on top of things. so i use it for when i get notifications. so i was getting notifications of new tweets tweets, like, posts, whatever. i hate that. i hate that he changed the name to x, by the way. i'm gonna you know what? i'm just gonna call it tweets. i don't care. i don't care if we get backlash. but, yeah, i get notifications on new tweets. getting that, and i was there were times where it said post on unavailable, but that's it. like, once, i think, it would happen.

Craig: so there was significant disruption of services for millions of users globally. initial investigations indicated it was a sophisticated distributed denial of service attack. elon musk claims, regarding the attack are prompting some controversy. we're gonna get into that. and the attribution of cyberattacks remain a complex issue of, you know, who did it, where they come from, that kind of stuff because, you know, it's not easy. and if you're good, you can write your stuff through different areas and have different ips with different vpns. and he incident highlights the ongoing vulnerabilities within major social media platforms. so yeah. let's get into this. the outage of cyberattack, it says march eleventh here, but it's, march tenth that the cyberattack happened. i just happened to write this, today, this morning early. so, at two am, there was initial wave affecting primary mobile users. and then by six thirty, a second wave impacting both web and app interfaces. and by eight fifteen to ten fifteen, the most severe outage period, and then throughout the day, there was sporadic interruptions. during peak disruptions, users logged over forty thousand complaints indicating issues across multiple continents. so, they were out. it was a huge thing. it seems like elon musk is getting a lot of, negative attention as it were these days for all sorts of reasons. experts suggested attack was a sophisticated denial distributed denial of service attack. this type of attack overwhelmed servers with massive traffic, making services unavailable. according to netblocks, the attack was characterized by multiple waves targeting different system vulnerabilities, distributed sources across various countries, evasion of ddos mitigation techniques, and, specific targeting of x's infrastructure. so yeah. so for those of

Jon: you that don't know what a ddos attack, they're they're just a way to disrupt online services. what they do is they flood a website with traffic from these bots and stuff from multiple different nodes, we'll call them, and overwhelm its servers, making it inaccessible to users. so, they're difficult to defend against because they can be launched from anywhere, like you said, and they can involve these nodes that are difficult to trace. so i don't know where elon's coming from, where he's just blaming the ukraine, but not surprised. but, yeah, i know there was, a, a hacking group that took credit for it. do you know more information about them?

Craig: yeah. we're gonna talk about the pro palestinian hacker group called, dark storm in a minute. so we haven't even got the elon musk claims. so i'm sorry. yeah. you just said, you know, a ridiculous claim. we haven't told anybody what it was. so elon musk claims and accusations. elon musk addressed the outage promptly on social media saying, x has experienced a massive massive ddos attack working, to mitigate. his subsequent, tweets claim that attack needed significant resources beyond typical hackers. traffic patterns suggested state sponsored involvement. many attacking ip addresses originated from ukraine. timing of the attack coincided with his political statements. so this implied possible retaliation by ukraine, leading to black ash from experts questioning the validity of his assertions. so that more details can be found on article in times india where we were looking. we are talking just before we got started, but there's a lot of ways to route traffic, and a lot of hacker traffic is routed through ukraine. so, you know, whether that is just a function of how people do it and it's easy to do that or whether there's massive amounts of hacker groups specifically they're doing stuff that's a different story, and i'm not gonna say whether it's related to this or not. so darkstorm, the propelist innocent group darkstorm team claims responsibility through their telegram channel. they provided screenshots of successful connectivity disruptions, politically motivated claims against musk, and technical details suggesting insider knowledge. orange cyber defense categorized them as hacktivists with a history of targeting organizations seen as aligned with israeli interests. so, experts are skeptic about the attribution. many cyber experts raise concerns over a mass attribution. they highlighted ipg location is often unreliable. like i mentioned, attackers commonly mask their origins, and attribution requires extensive forensic beyond simple traffic patterns. it's one of those things. you can't just look at it. you gotta say, okay. not only what was coming out of there, but what was going in and that kind of stuff. so, it's great that we had a ukraine based ip address, but, you know, i can spoof my ip address right now and pretend i'm, something else. so coming from another country. so yeah. there's some political context surrounding this, you know, criticism of ukraine military strategies. there was talk about, starlink, and the military version of it being used and deployed in ukraine and talk about it being shut off for some reason. i'm not really sure if that came from musk or just other discussions. so proposal for reduce, western aid in ukraine, you know, as he's supporting with, what trump's doing, and they're trying to stop the, war, obviously. however, that discussion didn't go too well a couple of weeks ago in the white house, so, hopefully, things are back on track for that. concerns over ukraine government transparency. so, also, with trump, he'd, they started withholding money and aid from ukraine, but the last stuff i saw is that that has been turned back on again. it looks like everyone's coming to the table again. so okay. you know, there's stuff going on that people really get upset about. and i'm not going to say one good, one bad, one this, one that because, you know, i'm not being shot at. i'm not needing military protection. i'm not in those things. so i'm not i just pray those that the killing stops soon and that, you know, we can get to a peaceful resolution. so, elicit various reactions, frustrating over access issues, skeptical towards must claims, political division regarding motivations, and discussion of alternative platforms. are people gonna go to blue sky more now because of this? x focused on technical restoration, implemented enhanced ddos protections. so that happened. we thought we'd talk about it a little bit because, you know, it happened just yesterday. when you're this will go out in the podcast probably march eighteenth. so it'll be a week from now.

Jon: yeah.

Craig: so there'll be a little bit more information available at the time. but, you know, the broader implication of this is can anybody be brought down if, you know, somebody decides they don't like their stance on anything, whatever that might be? absolutely.

Jon: yeah. just use a ddos attack. like, the the hacktivist have proven that. now there are cyber mitigation techniques that can be deployed, but it seems like these ddos attacks it's all it is is just, swarming the site with requests. right? so yeah.

Craig: they make legitimate quests yep. the request itself is as light as possible, but the processing time on the server is as heavy as possible. yeah. mean meaning that they try to get to, a thousand times difference in processing where i can make, for example, one of the more modern ones is a time ddos attack where it's requesting some sort of time synchronization. so that server's gotta go out and do something, but it's a very easy request. and they're malformed requests, meaning, i'll send the request, but i won't wait for the reply immediately drop and send the next one, the next one, next one. so the server becomes overwhelmed because i don't have to wait. i'm just pounding it with thousands of requests, and now i get thousands of machines on different countries pounding it with thousands of requests. and each of those requests are a heavier work load on the server, and, eventually, the server stops responding. yeah. just from a so, yeah, they got a obviously, they came at it with some interesting next gen ddos attacks, and now we have to develop some next gen ddos mitigation systems, adopt maybe a decentralized more of a decentralized architecture, collaborative defensive strategies among platforms, potential for new regulatory frameworks, for major platforms. so we'll have to see, what they end up deciding to do, but it makes everyone and i think all the platforms rethink one. should we be taking a stand on either side on any of these issues? because when you take a stand on a side, you offend all the people on the other side who now don't like you. or should you, as a company, be neutral and maybe you wouldn't have these types of things? you know, i hate it when you're forced into making a choice where i don't wanna, present, our company values because we might be attacked.

Jon: yeah.

Craig: so yeah. what are your final thoughts on this before we, jump off?

Jon: yeah. i think, this is a great time to talk about web three technology and how that could potentially mitigate ddos because it's a distributed architecture. but i don't know too much about, like, it can mitigate ddos attacks to some extent, but it's not entirely immune. but, i think as we move to a more decentralized architecture, i think that's going to help. but that's just my opinion.

Craig: yeah. we'd love to hear your feedback. let us know what you think around, where these attacks came from, and what kind of mitigation strategies, and what else you feel about, this x outage. we'd love to hear your feedback.