The Nigerian Communications Commission (NCC) has unveiled a bold initiative to strengthen consumer protection in Nigeria’s telecommunications sector through enhanced data analytics and strategic partnerships. This move is part of the NCC’s broader commitment to safeguarding consumer rights, ensuring quality service delivery, and promoting a fair and competitive telecom industry.

In a statement, the NCC announced that it is leveraging data for proactive decision-making and has partnered with Innovations for Poverty Action (IPA) to establish an Embedded Consumer Lab. This lab will serve as a dedicated research hub, analyzing consumer complaint trends, predicting emerging challenges, and shaping policies that enhance the telecom experience for Nigerians.

A Proactive Approach to Consumer Protection

The NCC emphasized that the increasing complexity of Nigeria’s telecom landscape requires a more dynamic and data-driven regulatory approach. The new Embedded Consumer Lab will enable the commission to:

• Monitor and analyze consumer complaints: Identifying recurring issues and systemic service gaps.
• Anticipate emerging concerns: Using predictive analytics to address potential telecom challenges before they escalate.
• Improve complaint resolution: Enhancing the efficiency of telecom operators in resolving consumer issues.
• Strengthen regulatory frameworks: Implementing data-backed policies for a more responsive and consumer-friendly telecom sector.

By integrating cutting-edge research and analytics, the NCC aims to improve how consumer complaints are managed, ensuring that telecom subscribers receive timely and effective resolutions to service-related grievances.

Harnessing Data for Evidence-Based Regulation

According to the NCC, the use of data is a game-changer in the regulatory space. The commission believes that by embracing evidence-based decision-making, it can develop policies that not only protect consumers but also drive improvements in the industry.

“This year, we are enhancing our analytical capacity to better protect telecommunications consumers by leveraging data for proactive decision-making,” the NCC stated. “Through our recent partnership with Innovations for Poverty Action, we are establishing an Embedded Consumer Lab to analyze consumer complaint trends, anticipate emerging issues, and inform policy decisions.”

With millions of Nigerians depending on telecommunications services for business, education, and daily communication, the NCC’s initiative is expected to foster a more transparent and consumer-centric telecom sector.

A Stronger Consumer Experience Ahead

As Nigeria continues its digital transformation, regulatory agencies like the NCC play a crucial role in ensuring that telecom services meet global standards. By leveraging data-driven strategies, strengthening consumer rights, and enforcing quality service delivery, the NCC is setting a new benchmark for consumer protection in the industry.

With the launch of the Embedded Consumer Lab, the commission reaffirms its dedication to creating a telecom environment where consumers are not only heard but also empowered with better services, quicker complaint resolutions, and a regulatory framework that prioritizes their needs.

This initiative represents a major step forward in the NCC’s mission to build a robust and consumer-friendly telecom ecosystem in Nigeria.

Between January 20 and 24, the town of Davos-Klosters, Switzerland hosted the annual World Economic Forum (WEF). Among the key highlights drawing media attention were several special addresses by prominent political figures. NETSCOUT’s ASERT team of engineers and researchers specialising in information security observed an increased volume of distributed denial of service (DDoS) attacks shortly before and during at least one of these addresses. This piece chronologically follows the events of the WEF while elaborating on events in the Swiss cyberspace.

DDoS Attack Chronology

Between the opening and closing of the event, ASERT observed more than 1,400 DDoS attacks of varying sizes and vectors. During, and around the WEF, the observed number of attacks were approximately twice as high as comparable time periods in December. The following graphs will explore the observed DDoS attack events by day. An overview is provided in Figure 1, with the grey-highlighted vertical bars representing the Forum’s schedule.

Figure 1: Three DDoS attack metrics as observed by ASERT. The grey regions mark the official schedule of the event.

• January 19: Although the Forum was not set to begin until midday on January 20, ASERT detected high-bandwidth DDoS activity targeting a major Swiss service provider network. The attacks were observed between 10:50 and 12:30, peaking at 426 Gbps. The primary vector was DNS reflection amplification traffic, symptomatic for attacks aiming for bandwidth saturation. It is possible this was a preparation or reconnaissance run, and threat actors were testing the effectiveness of the chosen attack vector. To ASERT’s knowledge, the 426 Gbps attack did not cause any significant harm or outage. We will examine in future attacks that the vectors and methodology employed by attacker changed.
• January 20: The Forum’s first official session began at 14:00 UTC (15:00 local time). The opening was accompanied by high-bandwidth and throughput anomalies, that spiked at 24 Gbps during the event at 15:20 UTC. Contrary to the previous day’s attacks, the DDoS attacks leveraged various reflection amplification vectors likely in the hope of a more disruptive effect.
• January 21: As day two progressed, ASERT observed an ever-growing number of DDoS attack activity leading up to one of the speeches. The attacks feature primarily TCP-based vectors, while some smaller avalanches of attack traffic target DNS servers with query floods on UDP/53 and TCP/53. The switch to TCP-based attacks may represent yet another shift in operation from adversaries.
• January 22: The third day of the event exhibits similar patterns to the previous day, though attacks were less bandwidth saturating. TCP RST or SYN floods, along with TCP SYN/ACK amplification attacks are symptomatic for a flood of small packets, as it was observed for the day.
• January 23 and 24: Day four was relatively uneventful compared to activity of previous days. However, the closing day of the WEF coincided with notable DDoS attack activity. Even after the Forum concluded, ASERT continued to observe notable DDoS attack anomalies for several hours.

WEF in the Crosshairs of Cyber Hacktivism

DDoS attacks during high-profile events like the WEF are often indicative of politically motivated adversaries. One such actor, NoName057(16) – an actor aligned with Russian interests – is frequently associated with DDoS campaigns targeting political figures or aiming to disrupt notable events where policy discussions occur.

The group operates a notorious DDoS botnet called DDoSia, which is usually the facilitator of HTTP flooding attack traffic. However, in this instance, the adversary primarily deployed TCP-based attack methods, diverging from their usual tactics, and aligning with ASERT’s previously observed attack patterns. We show the percentage of different methods facilitated through the botnet in Figure 2.

Figure 2: An overview of the DDoS attack instructions of the DDoSia botnet. Although, their signature is HTTP application layer attacks, this time the botnet primarily instructed clients to facilitate TCP traffic.

Targets of the DDoS Attacks

Figure 3 compares the industries of the DDoS attack targets in Switzerland during the WEF. It aligns with observations made during comparable events in the past – stressing again the need for resiliency and preparedness of large service providers. Often, attack traffic is directed towards service provider networks, such as telecommunication providers and cloud infrastructure. Events like these – those of international significance – also create additional stress for upstream providers.

Figure 3: ASERT detangled the ~1,400 DDoS attacks and mapped the destination addresses onto their corresponding industries. It becomes clear that international assemblies primarily attract DDoS attacks that target telecommunication providers.

Conclusion

The analysis of the DDoS landscape in Switzerland highlights the importance of network visibility and sophisticated DDoS defence, such as NETSCOUT’s Adaptive DDoS Protection and curated ATLAS Threat Intelligence Feed (AIF). It underlines that service provider networks must be on alert during events of international significance.

About NETSCOUT

NETSCOUT SYSTEMS, INC. (NASDAQ: NTCT) protects the connected world from cyberattacks and performance and availability disruptions through its unique visibility platform and solutions powered by its pioneering deep packet inspection at scale technology. NETSCOUT serves the world’s largest enterprises, service providers, and public sector organizations. Learn more at www.netscout.com or follow @NETSCOUT on LinkedIn, X, or Facebook.

©2024 NETSCOUT SYSTEMS, INC. All rights reserved. Third-party trademarks mentioned are the property of their respective owners.