OpenAI Battles Service Disruption Linked to Russian Hackers

ChatGPT was hit by a distributed denial of service (DDoS) attack on Wednesday, which OpenAI confirmed in a status update on Thursday. According to a report by Bloomberg, the attacks were allegedly orchestrated by a group of Russia-backed cybercriminals calling themselves Anonymous Sudan.

“We are dealing with periodic outages due to an abnormal traffic pattern reflective of a DDoS attack,” the company said. “We are continuing work to mitigate this.”

The group claimed responsibility for the attack on Telegram in retaliation for OpenAI’s support of Israel, Bloomberg reported.

A Distributed Denial of Service attack is a malicious attempt to disrupt access to a targeted server, service, or network by overwhelming it—or its surrounding infrastructure—with a flood of internet traffic.

The problem emerged on Tuesday with reports of sporadic outages on ChatGPT and its API beginning at 10:52 p.m. EST. While OpenAI said the problem had been fixed by midnight, the outages started again.

“API and ChatGPT has degraded once again—we’re continuing the investigation,” the status update said, again saying the issue was resolved later that night.

On Wednesday, beginning at 8:52 am EST, the outages started once more, continuing for nearly two hours.

“Between 5:42 a.m. and 7:16 p.m. PT, we saw errors impacting all services,” OpenAI said. “We identified the problem and implemented a fix. We are now seeing normal responses from our services.”

OpenAI did not respond to Decrypt’s request for comment.

“The easiest way to think about a [denial of service attack] is like a phone line,” David Schwed, COO at Blockchain cybersecurity firm Halborn, told Decrypt in an interview. “If you have a phone line with ten phones, and they’re calling you from 20 at the same time, they’re going to jam up the phone lines, and they won’t be able to answer the phones.

“That’s what a denial of service is; if you have 10 gigabits of bandwidth, they’re flooding it with more bandwidth than the equipment at the other end can handle,” Schwed explained.

He added that because of their distributed nature, coming from different locations simultaneously, DDoS attacks are nearly impossible to stop with IP filtering or blocking.

“It’s just coming from millions of infected machines and IoT devices launching an HTTP query, a ping, or any query against a server or a router,” he said. A network operation center, he added, would notice someone was wrong before it reached the end user based on the abnormal amount of bandwidth being consumed.

Schwed cautioned that even though network operation centers have ways of diverting “bad traffic,” a large enough attack can bring those machines down as well, adding that companies may simply have to wait until it’s over.

While denial of services attacks may be new to AI chatbots, the blockchain industry has dealt with this form of cyberattack for many years. The popular Solana network was the target of a series of attacks.

In September 2021, a denial of service attack was blamed for taking the network down for over 17 hours. In May 2022, Solana was hit again by a bot swarm, “Candy Machine,” which launched a denial of service attack against the network. In June 2022, Stepn, a Move-to-Earn game on the Solana network, was hit with a distributed denial of service attack.

After a rough 2022, in July, the Solana Foundation told Decrypt in an email that the company has seen 100% uptime since February this year, reporting a dramatic improvement in network performance.

Edited by Ryan Ozawa.