A surge of cyber attacks on the New Zealand stock exchange and numerous large websites, including those of banks and media companies, has prompted the justice minister, Andrew Little, to warn of “criminal actors” targeting the nation, and called in the help of the country’s spy agency.
Occasional cyber attacks do happen in New Zealand, but there has been a noticeable rise in recent activity, with the NZX falling victim every day except Monday in the past week.
So who is behind the attacks, and why has New Zealand suddenly piqued the interest of cybercriminals?
Why New Zealand, and why now?
Dr Lech Janczewski is a data security expert at the University of Auckland. She told RNZ New Zealand had recently attracted international interest after Donald Trump criticised Prime Minister Jacinda Ardern’s much-lauded success at managing coronavirus after a handful of fresh cases emerged.
“New Zealand is now in the spotlight because of the way we have dealt with Covid – even President Trump has mentioned us. We have become a country of interest so why not test some cyberattacks against us and then announce to the world, ‘hey we are so good at attacking the higher-ups’ – and then ask for money.”
How many attacks have there been, and what is their aim?
The attacks are known as distributed denial of service (DDoS) attacks, which involve flooding a website with traffic with the aim of causing it to crash. Janczewski calls it “one of the most powerful weapons on the internet”.
“DDoS attack software is constantly evolving and attack vectors are becoming more and more complicated. Due to the DDoS characteristics, only the biggest and most vulnerable sites are targets of these attacks,” she said. “Defence against a DDoS attack, when it is launched, is extremely difficult … perhaps the only solution is to switch off the site.”
Numerous New Zealand experts have suggested the motive is simple – ransom money, something that has been confirmed in a number of the attacks. Dr Rizwan Asghar at the school of computer science at the University of Auckland said paying a ransom was “highly discouraged”. “Otherwise, determined cybercriminals can target any critical infrastructure that could result in financial and reputation losses,” Asghar said.
Justice minister Andrew Little said it remained unclear where the attackers were based, or what there motives were, besides money.
What is the government doing to stop the attacks?
Little has brought in the country’s spy agency, the Government Communications Security Bureau (GCSB), to help stop the attacks and find out who is behind them. The move has been welcomed, if seen as slightly belated. With the general election just over six weeks away, the stakes are higher than ever.
Little said the GCSB’s investigation was proceeding well, telling commercial radio the agency had some leads. “The NZX got a message, an email before they got bombarded, so there’s work going on tracking back where that might have come from,” said Little.
It appeared that criminal rather than state agents were responsible, he said. “You can’t rule it out [state-based actors] but it’s more likely than not to be criminal activity.”
Little said the attacks appeared co-ordinated, persistent and “pretty sophisticated”, but besides the investigation there was little the country could do: “In the end you just have to withstand it and let it fizzle out.”