As of today, Twitter has been experiencing service interruptions since 6 AM Pacific Time, marring a months-long streak of uptime for the once-notoriously-unreliable messaging service. Twitter announced several hours ago that it is currently subject to a Distributed Denial-of-Service attack (or DDoS attack), in which hackers, utilizing a network of third-party computers, convince a targeted site that it is experiencing vast amounts of “phantom traffic” until it slows and finally crashes.
No one knows for sure what’s going on with the Internet’s fastest-growing social network right now – but here are four possibilities.
1. Twitter is Collateral Damage in the 4chan Civil War
Last week, it was widely reported that AT&T temporarily blocked 4chan.org, sparking an outcry among denizens of the site, known alternately as a haven for online pranksters and the memetic primordial soup of the Internet. However, what wasn’t reported is that the attacks tied into an ongoing internecine conflict among the 4chan community.
4chan itself is merely the most visible part of an online community that centers around an entire network of “-chan” boards, the online culture wiki Encyclopedia Dramatica (possibly NSFW), and LiveJournal. Normally, the rival factions in this subculture are content with crashing each other’s websites. However, 4chan users have contended that the AT&T attacks were actually carried out by agents provocateur from AnonTalk.com, a rival message board, in order to implicate 4chan. Carrying out a similar operation against a single website, rather than AT&T’s distributed network of service providers, would in theory be much simpler.
Until Twitter makes an announcement, there’s no way to be sure what’s going on – but the concurrent attacks on LiveJournal, where many members of these communities maintain accounts, indicate a possible link between the two incidents.
2. Someone Has Figured Out a Way to Game Twitter Applications
An ever-increasing share of Twitter users utilize the service not through the website, but through third-party applications such as TweetDeck and Twitterberry. These applications access Twitter through a series of discrete requests for attention known as API calls.
Twitter recently increased the number of permissible API calls per account per user per hour from 100 to 150, showing that the service recognizes the limits of its current system. It’s possible that a hacker has utilized a flaw in a popular application – or even Twitter itself – to bend the site’s infrastructure to the breaking point.
3. Feature Testing Has Gone Terribly Wrong
Twitter is known to be working on several new features for ordinary users, including appending locational information to posts. This could have led to a crash in one of several ways: either the testing of a new feature with a selected group of users overloaded the system, or the new feature was accidentally propagated to all users before it was optimized for large-scale efficiency.
While this alone wouldn’t bring the site down for an extended period, its possible that a determined attacker has been waiting for a weakening of Twitter’s immune system – and thus the right moment to pounce.
4. The Security Holes from Twitter’s July Document Leak are Still Unplugged
When hundreds of Twitter documents were leaked to the outside world in July, it was revealed that the security breach could be traced back to an unauthorized accessing of Twitter.com’s email hosting through Google Apps. While it would be difficult for a malicious individual or group to use Google Apps alone to bring down the entire Twitter website, the incredible wealth of information contained in the documents – including sensitive security information – could be the key to bringing down the site. Twitter’s employees have undoubtedly pored over the leaked documents and attempted to change all of the security information that was released. But even one missed password, technical specification, or API key could have allowed further hackers into Twitter’s systems.
Whatever the cause was, one thing is for certain – the perpetrators of this denial-of-service attack wanted attention. If someone with the resources to crash the actual Twitter service were acting simply out of malice, wouldn’t they have brought down Twitter’s status blog for maximum chaos?
Have a tip we should know? tips@mediaite.com
