Incident: Pokemon Go Servers Taken Down by DDoS Attack by PoodleCorp

Published Date: 2016-07-16

Postmortem Analysis
Timeline 1. The software failure incident of Pokemon Go servers being taken down by a hacker group occurred on a Saturday after the app was launched in 26 new countries in Europe [45689]. 2. Published on 2016-07-16. 3. Estimated timeline: The incident likely occurred on July 16, 2016.
System 1. Niantic's servers [45689]
Responsible Organization 1. PoodleCorp [45689]
Impacted Organization 1. Pokemon Go fans worldwide [Article 45689]
Software Causes 1. DDoS attack by hacker group PoodleCorp on Niantic's servers [45689]
Non-software Causes 1. The failure incident was caused by a DDoS attack carried out by the hacker group PoodleCorp [45689].
Impacts 1. Pokemon Go fans worldwide were unable to access the game and catch Pokemon due to the company's servers being taken down by a hacker group, causing panic among players [Article 45689]. 2. Users experienced difficulties accessing the game or encountered freezing issues, disrupting their gameplay experience [Article 45689]. 3. Niantic's servers had already struggled to cope with the overwhelming demand for the game even before the DDoS attack, indicating existing vulnerabilities in handling the user load [Article 45689]. 4. The incident led to frustration among fans who had planned to spend time outdoors hunting for Pokemon, as documented on social media platforms like Twitter [Article 45689]. 5. The attack highlighted the vulnerability of Niantic's servers to DDoS attacks, potentially raising concerns about the security and stability of the game's infrastructure [Article 45689].
Preventions 1. Implementing robust DDoS protection measures to mitigate the impact of potential DDoS attacks [45689]. 2. Conducting thorough security testing and vulnerability assessments prior to launching the software to identify and address any weaknesses that could be exploited by hackers [45689]. 3. Scaling server capacity and infrastructure to handle the expected demand and traffic spikes, especially during new launches or expansions to additional regions [45689].
Fixes 1. Implementing stronger server infrastructure to handle the overwhelming demand for the game [45689]. 2. Enhancing server security measures to prevent future DDoS attacks [45689]. 3. Conducting regular stress tests on the servers to ensure they can handle peak loads [45689].
References 1. PoodleCorp, the hacker group claiming responsibility for the DDoS attack on Niantic's servers [45689] 2. Pokemon Go Twitter account, providing updates on the server issues [45689] 3. Users and fans of Pokemon Go, documenting their experiences and frustrations on Twitter [45689]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident having happened again at one_organization: The incident of the Pokemon Go servers crashing due to overwhelming demand and potential DDoS attacks has happened before with Niantic's servers. The article mentions that Niantic's servers had already crashed several times on their own simply due to the unexpected demand for the game [45689]. (b) The software failure incident having happened again at multiple_organization: The article does not provide information about similar incidents happening at other organizations or with their products and services.
Phase (Design/Operation) design, operation (a) The software failure incident in the article was related to the design phase. The failure occurred due to a DDoS attack launched by a hacker group called PoodleCorp, which overwhelmed Niantic's servers with a flood of requests, causing them to shut down. This attack was a result of vulnerabilities in the system design that allowed the hackers to exploit the servers [45689]. (b) The software failure incident in the article was also related to the operation phase. Users reported difficulties accessing the game or experiencing freezes, indicating issues with the operation of the system. Additionally, the servers had previously crashed multiple times due to the unexpected demand for the game, highlighting operational challenges in handling the user load [45689].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident of Pokemon Go being taken down by a hacker group was primarily due to a DDoS attack on Niantic's servers. The attack overwhelmed the servers with simple requests for information carried out simultaneously, causing them to become overwhelmed and shut down. This vulnerability of the servers was evident as they had already crashed several times on their own due to the unexpected demand for the game [45689]. (b) outside_system: The DDoS attack on Niantic's servers, which led to the software failure incident, originated from outside the system. The hacker group PoodleCorp, comprised of six members, claimed responsibility for the attack. They used botnets to bombard the servers with requests for information, causing them to shut down. This attack was a deliberate external action aimed at disrupting the service [45689].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in the article was caused by non-human actions, specifically a Distributed Denial of Service (DDoS) attack orchestrated by the hacker group PoodleCorp. The attack overwhelmed Niantic's servers with a flood of simultaneous requests, causing them to become overwhelmed and shut down. This incident was not directly caused by human actions within the company but rather by external malicious actors [45689]. (b) Human actions were also involved in the software failure incident as Niantic's servers had already struggled to cope with the overwhelming demand for the game even before the DDoS attack. The unexpected demand for the game led to server crashes on their own, indicating that the company may not have adequately prepared for the scale of users trying to access the game. Additionally, frustrated fans expressed their disappointment and urged Niantic to resolve the server issues quickly [45689].
Dimension (Hardware/Software) software (a) The software failure incident in Article 45689 was not attributed to hardware issues but rather to a DDoS attack orchestrated by a hacker group called PoodleCorp. The attack overwhelmed Niantic's servers, causing them to shut down and preventing Pokemon Go players from accessing the game [45689]. (b) The software failure incident in Article 45689 was primarily caused by a DDoS attack on the software's servers. The attack was carried out by PoodleCorp, a hacker group, using botnets to bombard the servers with requests for information simultaneously, leading to server overload and shutdown [45689].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The software failure incident in this case was malicious, as it was caused by a hacker group known as PoodleCorp launching a DDoS attack on Niantic's servers. The attack was claimed to have been carried out intentionally to disrupt the service and prevent users from accessing the Pokemon Go game. The group specifically mentioned their actions on Twitter, indicating their malicious intent [45689]. (b) The software failure incident was non-malicious in the sense that the overwhelming demand for the game itself had already caused Niantic's servers to struggle and crash several times prior to the DDoS attack. The unexpected popularity of the game led to server issues, freezing, and difficulties for users trying to access the game, which were not intentional acts of harm but rather a result of the high demand for the service [45689].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident in the article was related to poor_decisions. The failure occurred due to a DDoS attack carried out by a hacker group called PoodleCorp. The group claimed responsibility for taking down Niantic's servers with the attack, causing disruption to Pokemon Go players worldwide [45689].
Capability (Incompetence/Accidental) accidental (a) The software failure incident reported in Article 45689 was not attributed to development incompetence. The incident was caused by a DDoS attack carried out by a hacker group, PoodleCorp, targeting Niantic's servers. This attack overwhelmed the servers with simultaneous requests, leading to the servers being taken down. The attack was a deliberate act by the hacker group rather than a result of development incompetence. (b) The software failure incident in Article 45689 was accidental. The failure occurred as a result of a DDoS attack orchestrated by the hacker group PoodleCorp. The attack was not a result of accidental factors but rather a deliberate action by the hackers to disrupt the service provided by Niantic's servers.
Duration temporary (a) The software failure incident in the article was temporary. The servers of the Pokemon Go game were taken down by a hacker group through a DDoS attack, causing fans around the world to be unable to play the game. The attack overwhelmed the servers, leading to difficulties accessing the game or experiencing freezes. The company acknowledged the server issues and mentioned they were working to fix them, indicating a temporary disruption [45689].
Behaviour crash, omission, other (a) crash: The software failure incident in the article is related to a crash where the company's servers were taken down by a hacker group through a DDoS attack, causing the system to lose its state and not perform its intended functions [45689]. (b) omission: The incident also involved omission as fans of the game reported difficulties accessing the game or experiencing freezing issues, indicating that the system omitted to perform its intended functions at that instance [45689]. (c) timing: There is no specific mention of a timing-related failure in the articles provided. (d) value: The incident does not directly relate to a value-related failure where the system performs its intended functions incorrectly. (e) byzantine: The behavior of the software failure incident does not align with a byzantine failure where the system behaves erroneously with inconsistent responses and interactions. (f) other: The other behavior observed in this software failure incident is a deliberate attack on the system by a hacker group using a DDoS attack, causing the servers to go down, which is not covered by the options (a) to (e) [45689].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence delay The consequence of the software failure incident reported in the articles was primarily related to delays and frustration experienced by users of the Pokemon Go app due to the DDoS attack on Niantic's servers by the hacker group PoodleCorp. Users were unable to access the game, experienced freezing, and were met with server issues, leading to widespread disappointment and inconvenience. There were no reported instances of physical harm, death, impact on basic needs, or property loss due to this software failure incident. The primary consequence observed was the delay and disruption in gameplay for users [45689].
Domain entertainment (a) The failed system in this incident was related to the entertainment industry. The software failure incident involved the popular game Pokemon Go, which is a mobile game that revolves around capturing virtual creatures in the real world [45689].

Sources

Back to List