AWS vs Azure vs Google Cloud Platform – Compute

 by Jess Panni

In this series, we’re comparing cloud services from AWS, Azure and Google Cloud Platform. A full breakdown and comparison of cloud providers and their services are available in this handy poster.

We have assessed services across three typical migration strategies:
Lift and shift – the cloud service can support running legacy systems with minimal change
Consume PaaS services – the cloud offering is a managed service that can be consumed by existing solutions with minimal architectural change
Re-architect for cloud – the cloud technology is typically used in solution architectures that have been optimised for cloud

And have grouped services into 10 categories:
Compute
Storage & Content Delivery
Database
Analytics & Big Data
Internet of Things
Mobile Services
Networking
Security & Identity
Management & Monitoring
Hybrid

In this post we are looking at…
Compute

This category covers all services that can be used to run applications in the cloud.
AWS

Amazon is often been seen as the Infrastructure as a Service (IaaS) market leader with their Elastic Compute Cloud (EC2). AWS lets you choose from a range of 40 virtual server instance sizes from low cost ‘nano’ instances to high end memory, storage or GPU optimised products, offering up to 128 ‘vCPU’s and a whopping 2TB of memory (be warned this doesn’t come cheap!). The lower end T2 instances offer baseline performance with the ability to ‘burst’ above the baseline for short periods. EC2 comes with images for Linux and Windows Server. A free tier is available for 1 year (equivalent of running one low end instance) although this is unlikely to be a major decision factor for most organisations. On-demand instances are billed per-hour, and discounted prices are available on instances that are paid up-front, or reserved on a recurring schedule, and there is even a spot pricing option on excess capacity. Auto-scaling these instances is supported, with the ability to scale in response to a range of run-time thresholds reported by CloudWatch.

AWS offers persistent disk options through Elastic Block Store and comes with a variety of SSD and HDD flavours. Disk storage is backed by Elastic Block Store and is automatically replicated across multiple servers within an availability zone (a specific location with an AWS region). Replication across regions is supported by shipping snapshots.

AWS Container Service is Amazon’s solution for running and managing docker containers. It relies on ECS to provide the underlying container instances. Standard images are available or you are free to choose your own. EC2 Container Registryallows developers to publish their docker container images to a private managed repository which is important to support development and devops workflows.

Amazon also offers a good range of PaaS services. Elastic Beanstalk is a PaaS compute solution for running web applications written in Python, PHP, JavaScript, .NET, Ruby, Java and Go. It can scale on request or based on certain run-time thresholds such as CPU usage. Elastic Beanstalk also allows developers to run applications as docker images.

For running discrete compute tasks AWS has Lambda which executes code in response to various triggers, such as application or storage events. Lambda automatically scales to meet demand and supports JavaScript, Python and Java.

AWS has a large number of centers spread spread over 13 geographically dispersed regions, so there are good options for organisations with strict data sovereignty rules.
Azure

Azure has been rapidly closing the gap to Amazon in recent years with Virtual Machines. Coincidentally (perhaps) Azure also offers 40 instance sizes offering up to 20 cores and 140GB of memory. It is good to see Microsoft fully embracing Linux on Azure, so organisations with large Linux estates need not worry about choosing that platform. Red Hat and Windows images are available ‘out of the box’ with other distributions available from the Azure Marketplace. Virtual machines are billed per-minute (and discounts across all Azure services are available on 12 month pre-paid subscriptions or as part of an Enterprise Agreement).

Local (temporary) and persistent disk are supported, with VHDs being stored in Storage page blobs. SSDs are available as Premium Storage options. Azure will automatically replicate data to a neighbouring region (Standard Storage only) as well as locally across fault domains (physically isolated infrastructure). Cross region replication of Premium Storage disks is possible through snapshots.

Azure supports virtual machine auto scaling which can scale VMS in response to metrics reported through the Azure diagnostic extension.

Azure supports running docker containers with Container Service. Container Service supports both Docker Swarm and Mesosphere DC/OS orchestration engines and is backed by Virtual Machines running Linux container instances. Azure doesn’t offer a managed Docker registry, however it is possible to host your own on blob storage.

Microsoft has been traditionally strong with it’s PaaS offerings and they are not about to give up their crown just yet. App Service platform provides a fully managed environment for running .NET, Java, PHP and Node.JS applications. App Service includes Web Jobs for running background worker processes. It also comes with support for running APIs (as opposed to front-end web applications) and Logic Apps, Microsoft’s integration and workflow solution. The latest addition to the App Server family is Azure Functions, Azure’s answer to AWS Lambda.

In between App Services and Virtual Machines lives Cloud Services, the original PaaS solution offered on Azure. Cloud Services brings many of the benefits of PaaS while providing additional control over the underlying OS. This is a useful option for solutions that require the installation of third party components.

For batch workloads Azure has Batch allowing organisations to burst compute over hundreds of thousands of cores.

Microsoft is the first of the three providers to offer a fully fledged cloud microservice platform in Service Fabric. Service Fabric allows developers to write highly resilient and scalable solutions and offers full support for life-cycle management, provisioning, deploying, monitoring and upgrading services.

Azure is available in 24 regions, the most of all three providers. There are also specific Azure cloud instances for various special interests, such as the US Government and China.
Google Cloud Platform

Google’s Compute Engine provides a range virtual machine options. A number of pre-defined virtual server instances are available as well as a novel ‘build your own’ option which lets you choose between 1 and 32 ‘vCPU’/cores and up to 6.5GB of RAM per vCPU. Google’s ‘Predictable’ pricing is based on the number of cores and GB of memory. OS support comes with Linux and Windows, either pre-installed or bring your own. Compute Engine also offers a per-minute billing model and offers discounts for prolonged usage. Temporary and permanent HDD and SSD storage options are available with local redundancy built-in by default and comes with the ability to snapshot disks.

Auto scaling is fully supported with integration into Slackdriver, Google’s cloud monitoring and logging solution.

For batch workloads Google has Preemptible Vms, these are cost effective Compute Engine instances that take advantage of excess Compute Engine capacity. Google may terminate instances based on system events and will always stop instances running after 24 hours.

Google Container Engine can be used to run docker containers and is based on Kubernetes. Container Engine comes with a managed master instance, all other nodes are Compute Engine instances. This is reflected in the pricing which has a flat hourly fee (free for clusters with less than 6 nodes) plus the Compute Engine instance costs. Google offer a private container repository with Container Registry.

Google bundles its managed application services under the App Engine product. It offers a complete platform of running managed application written in Java, PHP, Node.js and Ruby. Where AWS and Azure have chosen to split out their services in to different products, App Engine comes with a no-sql store, memcache, search and traffic management (compared later in this series). This approach offers a cohesive set of related services that are easy to understand and consume.

Google offers their services across 5 geographically dispersed regions.
Conclusion

There is very little to choose between the 3 providers when it comes to virtual servers. Amazon has some impressive high end kit, on the face of it this sound like it would make AWS a clear winner. However, if your only option is to choose the biggest box available you will need to make sure you have very deep pockets, and perhaps your money may be better spent re-architecting your apps for horizontal scale.

Azure’s remains very strong in the PaaS space and now has a IaaS that can genuinely compete with AWS. Looking at the full migration journey, from lift and shift to fully cloud engineered solutions, Azure arguably has the best coverage of the three providers. It’s great to see Microsoft coming out with innovative new services such as Service Fabric, however, if your applications are written in Ruby then your options are limited to virtual machines or Docker containers.

Google offers a simple and very capable set of services that are easy to understand. However, with availability in only 5 regions it does not have the coverage of the other players.

Talking of regions, be aware that not all services are offered in every region. This applies to all three providers, so be sure to check if you have strict requirements on where your data resides.

Next up we will be looking at Storage and Content Delivery.




About the author


Jess has over 18 years’ experience helping companies succeed through the smart use of technology. He has spent most of his career working for leading Microsoft partners across the UK and Australia and is now Principal at endjin, working with clients to envision and execute disciplined innovation programmes. You can follow Jess on twitter.

McAfee suggests about 2.5 million IoT devices were infected in Q4 of 2016

Image: Linino

Two and a half million Internet of Things (IoT) devices were infected by Mirai botnet by the end of fourth quarter last year, a new report by cyber security company McAfee said on Tuesday.

Mirai is a malware that turns networked devices running on obsolete versions of Linux into remotely controlled “bots” which can be used for a large-scale network attacks.

The ‘McAfee Labs Threats Report April 2017’ estimated that five IoT device IP addresses were infected by Mirai botnet each minute.

“The security industry faces critical challenges in our efforts to share threat intelligence between entities, among vendor solutions, and even within vendor portfolios,” said Vincent Weafer, Vice President McAfee Labs, in a statement.

Overall count of new malware samples grew 24 per cent in 2016 to 638 million samples despite showing a drop of 17 per cent in fourth quarter.

McAfee also detected 176 new cyber-threats every minute, almost three every second in fourth quarter of 2016. Further, the total mobile malware grew 99 per cent in 2016.

“The number of total ransomware samples grew 88 per cent in 2016, despite 71 per cent drop in fourth quarter,” the company said.

The findings further showed that the number of new Mac OS malware samples grew 245 per cent in fourth quarter due to adware bundling, though still small compared to Windows threats. Also, overall Mac OS malware grew 744 per cent in 2016.

IANS

Publish date: April 11, 2017 4:30 pm| Modified date: April 11, 2017 4:30 pm

50,362 cyber security related incidents were logged in 2016, says CERT-In

Image Credit: Venture Beat

  09 Feb 2017 , 08:56

Over 50,300 cyber security incidents like phishing, website intrusions and defacements, virus and denial of service attacks were observed in the country during 2016, Parliament was informed today. “As per the information reported to and tracked by Indian Computer Emergency Response Team (CERT-In), a total number of 44,679, 49,455 and 50,362 cyber security incidents were observed during the year 2014, 2015 and 2016, respectively,” Minister of State for Electronics and IT P P Chaudhary said in a written reply to Lok Sabha.

He added that the types of cyber security incidents included phishing, scanning/probing, website intrusions and defacements, virus/malicious code and denial of service attacks. “With the proliferation of Information Technology and related services, there is a rise in instances of cyber crimes in the country like elsewhere in the world,” he said.

As per the data maintained by National Crime Record Bureau (NCRB), a total of 5,693, 9,622 and 11,592 cybercrime cases were registered during the years 2013, 2014 and 2015, respectively, showing a rise of 69 per cent during 2013 to 2014 and 20 per cent during 2014 to 2015. “This includes cases registered under the IT Act, 2000 and related sections of Indian Penal Code and Special and local laws involving compouter as a medium/target. Similar data for the year 2016 is under collection,” he said.

Also, RBI has registered a total of 9,500, 13,083, 16,468 and 8,689 cases of frauds involving credit cards, ATM/debit cards and internet banking during the year 2013-14, 2014-15, 2015-16 and 2016-17 (upto December 2016), respectively. Further, CBI has registered a total of 87 cases during 2014 to 2016. Out of these 87 cases, charge sheets have been filed in 36 cases, status report filed in copmpettent court in 4 cases, 6 cases were closed and 41 cases are under investigation by CBI.

Besides, 4,699 and 6,266 cases were registered during the year 2014 and 2015, respectively for stalking women (Section 354D IPC) during 2014-15, as per data maintained by NCRB. This is a rise of 25 per cent during 2014 to 2015. The Minister said a total number of 28,481 websites were hacked in 2013, 32,323 (2014), 27,205 (2015) and 33,147 (2016).

“It has been observed attacks are launched through compromised computer systems located in different parts of the world. Masquerading techniques and hidden servers are also used to hide the identity of the actual systems being used by malicious actors,” he said. The attacks are observed to be originating from various countries including China, Germany, Hong Kong, Japan, Malaysia, Pakistan, Romania, the UK, the US, Syria, the UAE and Italy, he added.

PTI

Facebook introduces delegated recovery to secure accounts for third party services

Image: Which.co.uk

By tech2 News Staff /  31 Jan 2017 , 08:56

Facebook has introduced a new method for recovering lost accounts for third party services through a method known as delegated recovery. The new feature is being introduced first for GitHub, and is planned to be rolled out to other third party services based on how well the process works for GitHub. Users can recover their lost GitHub accounts through Facebook verification, instead of using an e-mail address or phone numbers.

The new method is called delegated recovery, and Facebook has published the protocols on its open source site at GitHub. Both Facebook and GitHub intend to publish open source implementations of the security protocol in various programming languages as references for developers. Facebook plans to eventually open up the authentication and account recovery mechanism for any third party service. Facebook also wants to allow users with accounts in third party services, such as GitHub, the ability to recover their lost Facebook accounts.

This is how delegated recovery works. Users have to set up the account recovery process in advance. Users have to save a recovery token that is generated by Facebook on request. The recovery token is encrypted, and Facebook or GitHub does not read any personal information, but only confirm that the person trying to access the accounts is the same. If a GitHub account is lost, users can re-authenticate on Facebook, and Facebook sends the recovery token to GitHub with a timestamped counter-signature. The entire process takes place through a browser, over https, and requires only a few mouse clicks.

Security questions are risky as they expose accounts to compromise by those who personally know the individual. If fake answers are given, the recovery questions are inconvenient. Re-using the same security questions and answers across accounts also exposes the users to more malicious attacks. Using recovery emails and SMS are dated, and do not guarantee end to end security, and are getting less reliable with an influx of the next wave of internet users. Facebook hopes to address these problems with the delegated recovery protocol. Facebook and GitHub will jointly reward those who find security issues with the delegated recovery protocol.

The announcement follows close on the heels of Facebook improving the security of its own accounts by allowing authentication of accounts through physical USB keys. GitHub already supports a login process that authenticates accounts through physical USB keys. The physical USB keys use the U2F standard developed by Google and Yubico.

#Video ..7 places you can’t find on Google Maps

US files a lawsuit against D-Link for failing to secure its routers and security cams from hackers

Image Credit: D-Link

  06 Jan 2017 , 11:14

The U.S. Federal Trade Commission filed a lawsuit against D-Link Corp on Thursday, accusing the Taiwan-based manufacturer of failing to take reasonable steps to protect its routers and internet-linked security cameras from hackers.

The FTC brought the charges as part of a broader effort to improve security of internet-connected devices, including routers, webcams, digital video recorders and other widely used consumer electronics devices. The company said the claim is without merit.

“D-Link denies the allegations outlined in the complaint and is taking steps to defend the action,” it said in a statement. “The security of our products and protection of our customers private data is always our top priority.”

Concerns about security of internet-connected devices, which are sometimes referred to collectively as the internet of things, or IoT, have surged since last year when hackers used armies of compromised routers, webcams and other electronic devices to launch a series of increasingly powerful attacks that severed access to some of the world’s biggest websites.

Security experts blamed those attacks on lax security in large numbers of IoT devices from dozens of manufacturers. They have called on the industry to better secure their equipment, removing easy-to-exploit vulnerabilities such as the use of default passwords that give hackers the keys to remotely access machines over the web.

Allison Nixon, director of security research with cyber intelligence firm Flashpoint, said the FTC’s action could encourage IoT manufacturers to beef up security. “I think vendors are going to take it seriously,” she said. “The IoT world needs to shape up quickly because this is a big problem.”

The FTC’s complaint alleged that D-Link neglected to protect the devices from “widely known and reasonably foreseeable risks of unauthorised access,” even as it highlighted security features in communications with consumers.

The FTC asked the U.S. District Court for the Northern District of California to order D-Link to improve its security practices and to pay the agency’s legal costs. The agency filed the case after issuing guidelines on securing IoT devices in 2015. FTC commissioners voted 2-1 to approve the filing of the lawsuit. The Democratic chairwoman Edith Ramirez and commissioner Terrell McSweeny voted yes, but the lone Republican commissioner, Maureen Ohlhausen, opposed the filing of the lawsuit.

Reuters

Russian security service has hit Ukrainian state institutions with 6,500 hack attacks

Image Credit: Venture Beat

  30 Dec 2016 , 09:21

Hackers have targeted Ukrainian state institutions about 6,500 times in the past two months, including incidents that showed Russian security services were waging a cyberwar against the country, President Petro Poroshenko said on Thursday. In December, Ukraine suffered attacks on its finance and defense ministries and the State Treasury that allocates cash to government institutions. A suspected hack also wiped out part of Kiev’s power grid, causing a blackout in part of the capital.

“Acts of terrorism and sabotage on critical infrastructure facilities remain possible today,” Poroshenko said during a meeting of the National Security and Defence Council, according to a statement released by Poroshenko’s office.  The statement said the president stressed that “the investigation of a number of incidents indicated the complicity directly or indirectly of Russian security services waging a cyberwar against our country”.

Relations between Kiev and Moscow collapsed in 2014 following Russia’s annexation of Crimea and support for pro-Russian separatists in eastern Ukraine, where fighting continues despite a ceasefire agreement. Among the 6,500 attacks Poroshenko said the country had been hit by, the attack on the State Treasury halted its systems for several days, meaning state workers and pensioners had been unable to receive their salaries or payments on time.

Cyber security firm CrowdStrike said last week a hacking group linked to the Russian government likely used a malware implant on Android devices to track and target Ukrainian artillery units from late 2014 through 2016. Its findings are the latest to support a growing view among Western security officials and cyber security researchers that Russian President Vladimir Putin has increasingly relied on hacking to exert influence and attack geopolitical foes.

Russia has repeatedly denied hacking accusations. Poroshenko’s comments come as the Obama administration plans to announce retaliatory measures against Russia for hacking into U.S. political institutions and individuals and leaking information in an effort to help Donald Trump win the presidency. Trump has dismissed the assessments of the U.S. intelligence community.

In December 2015, Ukrainian regional power company Prykarpattyaoblenergo reported an outage, saying the area affected included the regional capital Ivano-Frankivsk. Ukraine’s state security service blamed Russia. Experts widely described that incident as the first known power outage caused by a cyber attack. The U.S. cyber firm iSight Partners identified the perpetrator as a Russian hacking group known as “Sandworm”. As a result of the cyber attacks, Ukraine’s security council agreed measures to protect state institutions, the statement said. It did not disclose what the measures were.

Reuters

Qualcomm follows many others in pointing out vulnerabilities of electronic financial transactions in India

How an ATM attack works. Infographic from Symantec's blog.

By tech2 News Staff /  14 Dec 2016 , 14:41

Qualcomm has pointed out that most banking apps and mobile digital wallets in India do not use hardware-level security measures to ensure that the financial transactions are not compromised. Qualcomm is in the process of approaching the makers of such apps to integrate hardware level security features of Qualcomm chipsets into the applications. The sandboxing approach prevents any malware from affecting financial transactions.

There has been an increased focus on the security of electronic financial transactions, ever since a malware got into the systems of Hitachi Payment Services, which provides back end services to ATM machines and Point of Sale nodes across India. 32 lakh debit cards were compromised including those issued by SBI, HDFC, YES, AXIS, BOB and ICICI.

Security experts and consultants have pointed out various holes in the electronic transaction systems in place in India. ATMs need to implement state of the art encryption. The magnetic stripe cards need to be replaced with newer EMV chip cards, a global standard created by Europay, MasterCard, and Visa. ATM transactions are vulnerable to skimming and cloning attacks because of the continued use of the magnetic stripe cards. The databases of the banks themselves have to be adequately secured.

Intel has also warned that ATM machines in India are vulnerable to malicious attacks. Intel points out that countries in the Asia Pacific region are developing and are particularly vulnerable because of old systems and machines being used. The ATM machines tend to use outdated operating systems such as Windows XP, which makes them a easier target to execute malicious attacks against. Intel has also called for securing ATM machines with multiple levels of authentication and industry standard encryption.

The humans are the weakest link in the security chain, and there is a need for banks to educate users about phishing web sites, frauds, and scam emails. This is particularly important to users who are only starting to use digital wallets and banking apps after the demonetisation. The critical login credentials of users can be compromised by someone merely glancing at the screen and the app being used in a public place, a method of low-tech hacking known as shoulder surfing.

Antivirus solutions installed by users on their devices to protect financial transactions, actually end up making online banking less secure, according to researchers from the  Concordia University in Montreal, Canada. The anti virus software intervene in the regular operations of the browser and operating system, and can be used to fool the system with fake credentials. Commonly used security services were tested, and the researchers found that they lowered the levels of security normally provided by the browsers.

The hacking collective known as Legion has warned of weaknesses in the Indian Banking System. The group has said that it has the capability of hacking into financial systems, but has chosen not to do so. Legion has also said that there have been significant breaches in the past, but Banks have not alerted their consumers about it. There is no requirement by law to disclose data breaches to customers, the onus is on the Banks to do so.

However, it is not just amateur hackers who are a threat. There are serious cybercriminals and even the largest financial networks are susceptible to attacks. Swift has confirmed that hackers trying to get into the system have succeeded multiple times, and are continuously using newer and more sophisticated techniques. Swift has warned of consistent efforts by the group that pulled of the Banladesh Bank Heist to compromise the systems.

The laws in place are outdated, and need to be tweaked taking into accounts new developments. Digital wallets in India currently have no prescribed security standards, and are free to implement their own measures. There are no laws to hold the digital wallets responsible if something goes wrong during financial transactions.

Qualcomm senior director product management Sy Choudhury lauded the efforts by Aadhaar. The India Stack, which is a collection of APIs, which are ready to be integrated with applications and services. One of the aims of the India Stack is to ensure smooth and secure financial transactions. Unified Payment Interface (UPI), Aadhaar linked biometric identification, Unique Identification Authority of India (UIDAI), e-KYC, Aadhaar Enabled Payments System (AEPS) are all elements of the stack, that can improve security of transactions.

Legion: Here’s how to keep your online accounts safe from malicious attacks by hacker groups

Representational Image

By Aditya Madanapalle /  13 Dec 2016 , 10:25

The hacking group Legion seems to be going after high level targets, in a campaign similar to the one executed by OurMine. The Legion group does not seem to be as sophisticated as OurMine, because they are choosing targets from an already compromised data, instead of deliberately finding ways to take down marks of interest. There are some elementary safety precautions that you can take to secure yourself against attacks by groups such as Legion.

One of the OurMine takedowns of Mark Zuckerberg’s social media accounts compromised Twitter and Pinterest at one go. Zuckerberg apparently used a “dadada” as the password, even though Zuckerberg is safe enough to physically put a tape over the webcam of his laptop. Being paranoid is a good idea when it comes to information security, and every additional security measure helps, even if it is a bit of tape. The main takeaway from the attack is to use different passwords for different accounts.

Paranoia is a security feature

The leaked passwords used by Vijay Mallya in the hack showed that he had taken this precaution to a certain extent. A number of base text strings were used, with variations added on top. Now someone who has access to these base strings and variations can attempt to guess passwords for new accounts. It is important to constantly cycle passwords for critical accounts, and not share the same passwords across services. Variations might be simple to remember, but it is more secure to have completely different alphanumeric strings.

Lastpass is a password manager that works across platforms.

Keeping track of multiple usernames and passwords can be daunting, a secure password manager such as LastPass is better than saving your passwords in a notepad file in your email inbox. The mobile application available on iOS and Android allows users to store their passwords behind the biometric security offered by a fingerprint scanner. One common mistake is to write down your passwords on a sheet of paper, it is worse to list all your usernames and passwords on a single sheet of paper.

Constantly cycling passwords protects users from compromised dumps. If a service offers two factor authentication, it is better to activate it to prevent hostile takeovers to accounts. Most popular email, social networking and content distribution platforms support two factor authentication. Another vector of attack is through the secret questions set at time of account creation. Do not key in the actual answers to the questions, as someone who knows users personally can guess the answers. Instead use obscure questions, as well as hard to guess answers, even if a known person attempts to takeover your account. Guessing the answers to the secret questions is one of the most common ways accounts are compromised.

Haveibeenpwnd shows which data breaches contain your data.

It is a good idea to check if any of your accounts have already been compromised. Haveibeenpwned is such a service that allows users to check if their email addresses or usernames are compromised in any of the large well known data dumps. These are large dumps of login credentials farmed from compromised third party sites.

The site will let you know in which dump your credentials appear, and you can take steps to safeguard that account. There is also a mention of what details were compromised in the particular hack. Users can sign up to be alerted when their accounts are compromised in future hacks. Checking the site periodically is a good idea to keep your accounts safe.

Deutsche Telekom attack part of global campaign on routers

Representational Image

  30 Nov 2016 , 09:59

A cyber attack that infected nearly 1 million routers used to access Deutsche Telekom internet service was part of a campaign targeting web-connected devices around the globe, the German government and security researchers said on Tuesday.

The revelation from the German Office for Information Security, or BSI, stoked fears of an increase in cyber attacks that disrupt internet service by exploiting common vulnerabilities in widely used routers, webcams, digital video recorders and other web-connected devices.

Security researchers said the infections spread to countries including Brazil, Britain and Ireland using a technique similar to one that stopped millions of people in the United States and Europe from reaching websites including PayPal Holdings Inc , Twitter Inc and Spotify on Oct. 21.

The BSI said that German government networks were also targeted in Sunday’s attack on Deutsche Telekom customers, though authorities said they succeeded in keeping systems online.

Deutsche Telekom, Germany’s largest telecom company, said internet outages hit as many as 900,000 of its users, or about 4.5 percent of its fixed-line customers.

Deutsche Telekom and the German government did not identify other victims, though cyber security firm Rapid7 Inc said it observed the attackers trying to infect routers across the globe.

Irish telecom operator Eir and Vodafone Group Plc in Britain use routers that were vulnerable to same kind of attack, said Rapid7 security research manager Tod Beardsley.

Flashpoint, a second U.S. cyber security research firm, said it routers were infected in Brazil, Britain and Germany.

Eir said in a statement it was aware of potential vulnerabilities in broadband modems from Taiwan’s ZyXel Communications Corp used by about 30 percent of Eir customers.

“We have deployed of a number of solutions both at the device and network level which will remove this risk,” Eir said. It reported the incident to Irish regulators.

Vodafone declined to comment on whether it customers had been infected, but said it was aware of a vulnerability in routers that enables attackers to mount denial-of-service attacks.

The Brazilian National Computer Emergency Response Team told Reuters it was analyzing the impact of the attack on Brazil, but declined to say how many computers had been infected.

Mirai Botnet

The attacks were launched with software known as Mirai that seeks out vulnerable connected devices, then turns them into remotely controlled “bots” for mounting large-scale attacks that disrupt access to websites and computer systems.

Deutsche Telekom executives apologized for the outages, saying the company had provided details about the attack to other network operators and security agencies.

Security experts said the problem affected Deutsche Telekom customers using three types of routers manufactured by Taiwan’s Arcadyan Technology, which created a software patch that was pushed out to users on Monday.

Arcadyan did not reply to Reuters’ requests for comment.

Security experts said attributing blame for the attacks may prove impossible because the Mirai software had been released on the internet. It is relatively easy to use, which means hackers with relatively few technical skills could be to blame for follow-on attacks, they said.

Reuters