The popular online note-taking service Evernote says it began to suffer a denial-of-service attack on Tuesday which prevented users from accessing their accounts.
The first that most of the firm’s 100 million users knew about the problem was when they saw Evernote fail to sync on their desktops or smartphones, preventing them from accessing the notes and web-clippings they had collected over the years.
With the service inaccessible, many Evernote users realised just how dependent they were on the cloud-based service, and took to Twitter to express their disgruntlement.
A quick trip to Evernote’s status page (if you could reach it) revealed that the company was struggling to repel a denial-of-service attack.
Jun 10, 2014 (6:17 pm PT)
[=>] An update on the service disruption
We’re actively working to neutralize a denial of service attack. You may experience problems accessing your Evernote while we resolve this.Jun 10, 2014 (2:43 pm PT)
[!] Evernote service accessibility issues
The Evernote.com service is currently unreachable; our Operations team is investigating the issue. We will provide updates as we learn more.
The latest update I have been able to find from Evernote appeared on their Twitter account (strangely they haven’t updated their network status page – maybe they’ve had trouble reaching it? ;) ) where they claim to have restored access for users, but that the service might continue to experience “a hiccup or two” for the next 24 hours or so.
Evernote is up and running. There may be a hiccup or two for the next 24 hours. We appreciate your patience.
— Evernote (@evernote) June 11, 2014
A BBC News report quotes Evernote spokesperson Ronda Scott, who says that the denial-of-service attack began at 14:25 PST on Tuesday and had not yet ended.
“We continue to mitigate the effects of the attack, but have successfully returned Evernote to service. As is the nature of DDoS attacks, there was no data loss, and no accounts were compromised.”
Scott’s final comment there is important to stress. A denial-of-service attack does what it says on the tin: it stops you from being able to access a service or website.
It doesn’t mean that any of your data has been stolen, or that a website’s servers have been hacked.
Instead, an online criminal has managed to bombard a website or online service with so much traffic at such intensity that it becomes stressed, can’t handle the information overload and, effectively, falls over in a gibbering wreck.
Attackers can make a denial-of-service even more severe by harnessing hijacked computers around the world to join in the bombardment, in a so-called distributed denial-of-service attack (DDoS).
What is unclear is why Evernote was targeted. Frequently denial-of-service attacks might be instigated by hackers who have a grudge against a particular company or user of the company’s service, or with the intention of extorting payment for a return to normal service.
This isn’t, of course, the first time that Evernote has found itself the recipient of unwanted attention from internet criminals.
In March 2013, for instance, the company informed all of its users that they should change their passwords after its servers were compromised by hackers.
A denial-of-service attack is unwelcome news, and angers customers who can’t access their data. But it’s nothing like as bad as having your servers hacked and customer information stolen.
Were you hit by the Evernote denial-of-service attack? Leave a comment below sharing your thoughts and experiences.
I never understand why so many people freak out of this, much less bashing Evernote the way they do. Evernote works just fine offline. I noticed a little problem trying to sync around midnight PT, but so what if it won't sync for a while. You still have all your notes locally.
Just goes to show why you shouldn't rely upon or use so-called "cloud" services.
@Mara This assumes you have offline notebooks. If you are leveraging evernote for critical areas of your life where you need immediate, always-on access to to your notes, I agree that you should pony up the money, get a premium account and keep the critical information locally.
For the desktop client, yes. For the Android and iOS clients, not without paying for Evernote premium. For people who use a tablet like it is a desktop, this is the crucial difference; they were unable to get to their notes except if they could get on a computer (one that they had previously installed the client and synced to). And even if they had premium, maybe they didn't turn on the offline syncing (it defaults to off).
I'm a desktop/laptop guy myself so I would not have had the problem, but I do empathize with people who try to exclusively use a tablet for everything and thus were shut out of their notes.
Feedly.com also got knocked out by this attack. As of this writing, it's still struggling to get back up.
I still cannot get access to sync, and just fail while typing a note in the web version!
Graham, I love your sense of humour (then again, my longest standing friends are from England…). This: "strangely they haven’t updated their network status page – maybe they’ve had trouble reaching it? ;) " made my day not only because I would think of the same thing (always on the lookout for irony, word play, and that includes intended puns/etc), but because it is hilarious.
Otherwise: the cloud. What to even write… how about starting with: it is so stupid. Always has been and always will be. The fact you can access it "anywhere" is frankly as ridiculous as claiming you can access "google" from anywhere (but irony: notice how some weren't able to access it. So much for different, right?). Really, who would have thought that a network of networks (i.e., the Internet) would give you that capability? Besides, do the words server farms mean anything to anyone? But the real problem isn't even that. The real problem is people think it is their personal hard drive! Wake up people. The only one responsible for YOUR data is YOU. Backup, daily, or you are asking for trouble. And let's be real, sometimes THAT is not perfect (not even talking about corrupted tape or backup by hardware failure or user error which indeed is bad as well, hence redundancy is only one of many measures to take). Imagine the horror when you find your backups were silently being corrupted over time (by what/whom? Dark Avenger of course!) to the point that your only backups are corrupted! No, I never was infected with it but it is quite relevant to the point: backups are not perfect so if your backups are not perfect why do you rely on someone ELSE to backup (at all! – not all hosts do, by the way!) or have 100% safe backups (no such thing)?
It really is crazy how people still do not understand the backup issue and even worse is having the nerve to blame a remote host for having any problem (DoS, DDoS, network cable cut, maintenance downtime, power outage longer than the UPSs can keep them up, …). It is quite arrogant really (why not put yourself in their place, instead of whining about forgetting to backup/do X/Y/Z?). And the most ironic part of it is, when the youth of today talk about how it is so different and things are so more [whatever]. In general the DDoS attacks had their own versions in the past (e.g., smurf) when we had less bandwidth and guess what? These types of attacks still exist (other amplifcation attacks, say) and with more bandwidth (but that goes for everyone that is effected by an attack) and in fact there are _more_ and _better_ security measures in place (your encryption was not always common place, you know, and that includes over networks, and there are many other examples). No, it isn't so different or so extra hard (see part of improvements) and no we don't misunderstand you – you just want to believe that. Almost everyone goes through that kind of thing (or should I write: almost everyone went through that kind of thing ALREADY?). Here's a thought: maybe we're not too old to understand but instead YOU are too YOUNG to understand (or know and remember)!