Experts debunk Elon Musk’s claim Ukraine caused X outage

Cyber experts have called into question Elon Musk’s claim that a cyber-attack on X was caused by Ukrainian hackers.

Yesterday Musk revealed the social media platform was undergoing a “massive cyber-attack” that had been carried out by “large, coordinated group and/or a country”. And earlier today he told Fox the IP addresses originated from Ukraine.

However, the former chief executive of the UK's National Cyber Security Centre, said Musk’s suggestion is "pretty much garbage."

Speaking to the BBC, Ciaran Martin said: “What Mr. Musk has said is wholly unconvincing based on the evidence so far.”

The hit on the platform affected thousands across the world, with platform monitor Downdetector revealing it had more than 1.6 million reports of issues with the site. Users were unable to post tweets and load their feeds.

It is understood the breach was caused by a distributed-denial-of-service (DDoS) attack, which involves flooding a network with a large volume of internet traffic from different sources, known as botnets, to overwhelm and bring down the targeted system.

Martin said: “I am very surprised that X fell over as a result of a DDoS attack, it’s a very large-scale DDoS attack but it’s not that sophisticated, it’s a very old technique.”

He said he was unaware of a company the size of X that had “fallen over to a DDoS attack for a very long time," adding the incident "doesn't reflect well on their cyber security."

Martin said IP addresses "tell you absolutely nothing," as a DDoS attack means addresses could come from multiple locations.

Similarly, Dmitry Budorin, founder of Ukrainian cybersecurity firm Hacken, said on X: “DDoS attacks typically don’t reveal their true source easily. Botnets use hijacked devices worldwide, and the IP addresses seen in the attack traffic are just those of the infected machines, not the masterminds."

And Jake Moore, global cybersecurity adviser at software security firm Eset, said it would be "dangerous to point the finger" at Ukraine solely based on IP address location.

“Unfortunately, X remains one of the most talked about platforms making it a typical target for hackers marking their own territory…All that can be done to future proof their networks is to continue to expect the unexpected and build even more robust DDoS protection layers.

“IP addresses can also be directed via software to be seen to have originated anywhere in the world.”

Musk has been critical of the Ukrainian government recently, using X to lash out against President Volodymyr Zelensky.