Home
 » ISP News » 
Sponsored Links

Zzoomm Apologises for Disruption in Oxfordshire UK After DDoS

Friday, Jun 25th, 2021 (8:23 am) - Score 2,120
zzoomm yellow van

Alternative broadband ISP Zzoomm, which is deploying a 10Gbps Fibre-to-the-Premises (FTTP) broadband network to 1 million UK homes by the end of 2025, has apologised to their customers in the Oxfordshire town of Henley-on-Thames after a Distributed Denial of Service (DDoS) assault disrupted their connectivity.

DDoS attacks typically work by overloading a target server or end-user with masses of data requests from multiple internet connected devices (often malware hijacked computers / botnets etc.), which can cause the intended target to crash or suffer significant performance problems until the bad traffic stops. Such attacks may also expose other weaknesses that hackers can exploit (or even blackmail), such as happened to TalkTalk in 2015 (here).

In this case, it wasn’t Zzoomm that was attacked, but rather one of their upstream suppliers in the area. “These were instigated by a malicious party who has attempted to extort payment from another of their customers. They effectively flooded the upstream network with traffic overloading their systems,” said the ISP. As a result, Zzoomm’s local customers have also faced related “service interruptions” over the last week.

Advertisement

All of us here at Zzoomm would like to apologise for the service interruptions experienced in Henley-on-Thames over the last week. We have not delivered the level of reliability that you have every right to expect from the Zzoomm service,” said the provider in a reassuringly candid response.

At this point it’s crucial to reflect that DDoS attacks happen to UK ISPs all the time, they’re practically par-for-the-course in this business, but most can be mitigated and few are ever significant enough to disrupt connectivity for lots of end-users. In nearly all cases, these incidents aren’t actually an attack against the ISP, but rather somebody targeting a specific customer or upstream network provider for the ISP.

Most ISPs thus prefer not to speak about such things in public, often putting related incidents down to ambiguous network connectivity faults instead.

Zzoomm Statement

“Working with our upstream provider we have looked at how together we can (1) limit the impact of these attacks and (2) respond faster to the attacks. Specifically, our upstream provider has put in place a DDOS filtering service which should make the type of attack that they, and we, have experienced over the last week ineffective.

In addition, we are putting in place more capacity in the core network, which will make it more difficult to be overwhelmed by DDOS attacks. Finally, we are improving our management tools to allow us to respond faster to reconfigure the core network to sidestep different attack vectors. Making these changes has taken time as services and equipment need to be ordered, delivered, provisioned, tested and made live.”

However, merely resolving the underlying exposure to such assaults was not enough for Zzoomm. On top of the aforementioned changes, they’ve also given “every” customer a free period of service and will even upgrade them – from the beginning of July 2021 – to a fully symmetrical speed for the next couple of months (existing customers who pay for this boost will get it for free over the same period).

Advertisement

Zzoomm has also said that they intend to launch a Service Status page, which customers will be able to check in order to identify whether there are any ongoing problems in particular areas (all ISPs should really have these by default, but some providers still don’t). Finally, Zzoomm said they would “continue to work with all our partners to put in place improved defences and heightened checks to limit the impact of any attacks in the future.”

We have to credit Zzoomm here for being transparent with their experience and doing a great job of supporting their customers, not least with lots of service freebies.

Share with Twitter
Share with Linkedin
Share with Facebook
Share with Reddit
Share with Pinterest
Tags: , ,
Mark-Jackson
By Mark Jackson
Mark is a professional technology writer, IT consultant and computer engineer from Dorset (England), he also founded ISPreview in 1999 and enjoys analysing the latest telecoms and broadband developments. Find me on X (Twitter), Mastodon, Facebook, BlueSky, Threads.net and .
Search ISP News
Search ISP Listings
Search ISP Reviews
Comments
6 Responses

Advertisement

  1. Avatar photo James says:

    A bit of digging suggests the third party supplier who is affected is Amatis: https://status.amatisnetworks.com/

    1. Avatar photo John says:

      I think they simply share the same carrier and Amatis don’t necessarily carry Zzoomm’s traffic.

      From your link:
      “Identified – We have been liaising with our upstream carriers and they have applied some filters and blackhole routing to mitigate the attack. We are gradually seeing traffic levels drop and some services restore.
      Jun 20, 18:45 BST”

  2. Avatar photo Mark Stokes says:

    A single upstream network and no peering at LINX Manchester or LINX London doesn’t inspire confidence in their service… I’m sure within a few weeks they change that setup.

    1. Avatar photo MikeP says:

      A small ISP won’t have the time or other resources to get full peering setup in their early days. Better things to do than installing kit in the LINX 🙂 Taking a fully peered redundant link via an upstream is the Right Thing To Do to get started.

      This case does, however, beg the question of what DDOS protection the upstream had or could implement in a short timescale.

    2. Avatar photo Olly says:

      Amatis are likely using DDoS-protected from transit from NTT, a T1. NTT use mostly Arbor and rate limiting to mitigate.

      Zzoomm have certainly picked an interesting upstream. I can’t find any info to support Amatis owning a physical national or even metro fibre network. I imagine Amatis had a 10G+ lit link somewhere close to Zzoomm’s first rollout area and they’ve simply stuck with them for future rollouts. Who knows!

    3. Avatar photo Pedant says:

      Seems somewhat pointless to have their own ASN if they can’t be bothered to multi-home, or didnt think it was necessary until their upstream gets knocked offline..

      https://bgp.he.net/AS35433#_graph4

Comments are closed

Cheap BIG ISPs for 100Mbps+
Community Fibre UK ISP Logo
150Mbps
Gift: None
NOW UK ISP Logo
NOW £24.00
100Mbps
Gift: None
Vodafone UK ISP Logo
Vodafone £24.00 - 26.00
150Mbps
Gift: None
Plusnet UK ISP Logo
Plusnet £25.99
145Mbps
Gift: £50 Reward Card
Sky UK ISP Logo
Sky £26.00
145Mbps
Gift: None
Large Availability | View All
Cheapest ISPs for 100Mbps+
Gigaclear UK ISP Logo
Gigaclear £19.00
300Mbps
Gift: None
Community Fibre UK ISP Logo
150Mbps
Gift: None
Hey! Broadband UK ISP Logo
150Mbps
Gift: None
Youfibre UK ISP Logo
Youfibre £23.99
150Mbps
Gift: None
Vodafone UK ISP Logo
Vodafone £24.00 - 26.00
150Mbps
Gift: None
Large Availability | View All
The Top 15 Category Tags
  1. FTTP (6051)
  2. BT (3647)
  3. Politics (2727)
  4. Business (2444)
  5. Openreach (2411)
  6. Building Digital UK (2335)
  7. Mobile Broadband (2154)
  8. FTTC (2086)
  9. Statistics (1912)
  10. 4G (1824)
  11. Virgin Media (1774)
  12. Ofcom Regulation (1590)
  13. Fibre Optic (1471)
  14. Wireless Internet (1464)
  15. 5G (1414)
Promotion
Sponsored

Copyright © 1999 to Present - ISPreview.co.uk - All Rights Reserved - Terms , Privacy and Cookie Policy , Links , Website Rules , Contact
Mastodon