Team Cymru: Internet Weather Report

Malware Analysis
1

Insights into Internet Outages along Africa's Western Coast

About Team Cymru: Internet Weather Reports

Our Internet weather reports are intended to provide data and technical analysis of significant events occurring across the Internet. The information aims to equip readers with insights that contribute to their own conclusions and provide additional context.

,,,Introduction

On 14 March 2024, a series of major Internet outages were ,,reported, affecting thirteen African countries situated along the continent’s western coast. Up until the time of this blog post, there has been no conclusive reason as to why this happened.

This piqued our curiosity, prompting us to leverage our tools and data for a multinational and cross-continental analysis based on observed traffic patterns.

The impacted countries are highlighted in the map (of Africa!) above. However, for the cartophobic, the list from north to south, including country codes, is as follows:

  • Niger (NE)
  • Burkina Faso (BF)
  • Nigeria (NG)
  • The Gambia (GM)
  • Cameroon (CM)
  • Guinea (GN)
  • Benin (BJ)
  • Ghana (GH)
  • Togo (TG)
  • Côte d'Ivoire (CI)
  • Liberia (LR)
  • Namibia (NA)
  • South Africa (ZA)

Over a week later, in this blog post, we will examine the current status of the situation by analyzing high-level network telemetry data derived from ,,Pure Signal™.

,,,Key Findings
  • At the time of writing, Cameroon is still experiencing ongoing Internet outages, over a week after the initial reports.
  • Impacted countries faced varying degrees of impact, ranging from minor blips within a 24-hour period to widespread outages lasting several days (or ongoing in the case of Cameroon).
,,,Status Update

Cameroon (CM)

Based on our vantage point, it is apparent that at least one country, Cameroon, is still impacted by the outages.

As depicted in the chart above, a decline in client (user) activity was observed on March 14 and has yet to return to the levels observed before the outages were reported.

Server records were also affected, albeit on a smaller scale, primarily due to limited inbound connections to services and websites in Cameroon from other countries in general.

For clarity, client flows are those originating from an IP address located in the country of interest (e.g., country code CM in the chart above). Server flows are those where the destination IP address (server/service) was located in the country of interest. For example, a user in the United States accessing a website hosted in Cameroon.

Benin (BJ) & Ghana (GH)

Several other countries appear to have been impacted for several days. In the case of both Benin and Ghana, connectivity was dramatically and almost completely restored on 20 March.

Nigeria (NG)

A similar situation is observed in Nigeria, where, as of 20 March, normal service appears to have resumed. However, the 'return' seems to have been gradual over several days.

Looking at server flow data for Ghana and Nigeria, it is evident that both countries host comparatively more services that are accessed by foreign users when compared with countries like Benin and Cameroon.

Niger (NE)

Much like the other countries already reviewed, Niger appears to have experienced outages lasting several days. However, since 18 March, there has been a surge in Internet usage to 150-200% of the "usual" levels. This surge potentially indicates a nation catching up on “what was missed” over the preceding days.

Gambia (GM), Liberia (LR), Namibia (NA) & South Africa (ZA)

In some cases, impacts of the outages were limited to a single day, or not fully discernable in our daily snapshots. Liberia, for example, appears to have been impacted within a 24-hour period before returning to business as usual levels. In Namibia, there was a small reduction in traffic, but nothing which would indicate wide-scale Internet outage.

Burkina Faso (BF), Côte d’Ivoire (CI), Guinea (GN) and Togo (TG)

For the final four countries affected by the Internet outages, we witness a different phenomenon as a result of the intricacies of our vantage points into these particular countries. Instead of a drop in traffic, we see a sharp increase in the case of Burkina Faso, Côte d’Ivoire, Guinea, and Togo. In each case, this increase lasts for 4-5 days.

What we are observing here is likely attributable to one of two things (or a combination of both):

  • Attempted and ultimately failed connections to external resources were being observed.
  • Traffic rerouted via indirect paths across the Internet were being observed.

Digging deeper into the data for these four countries combined to examine the top TCP ports observed strengthens this assessment. As can be seen in the image below, the large increase in network traffic is a result of an increase in TCP/443 (generally associated with web browsing) traffic, which is highlighted in green.

,,,Conclusion

In conclusion, the recent Internet outages affecting multiple countries along Africa's western coast have highlighted the vulnerability of digital connectivity in the region. While some nations experienced minor disruptions lasting less than a day, others faced prolonged and ongoing outages, exemplified by the situation in Cameroon.

Article Link: https://www.team-cymru.com/post/team-cymru-internet-weather-report