Hackers strike at the heart of the internet

[261275]

There are signs hackers attacked key parts of the backbone of the internet yesterday but no damage seems to have been done, experts said.

The attack appears to have focused on the domain name system (DNS), which maps text-based domain names to the actual numeric IP addresses of servers connected to the internet, and vice versa. Several key DNS servers saw traffic spike in the early morning on Tuesday, several experts said - a sign of an attack.

John Crain, chief technical officer at the Internet Corporation for Assigned Names and Numbers (Icann), which operates one of the main so-called root DNS servers, said: "It is an unusual large amount of traffic that is hitting DNS servers. We see large attacks on a regular basis but this hit quite a few servers, so it was fairly large."

Yet the DNS servers were able to withstand the onslaught, Crain added. "It was irritating. It ruined my night's sleep. It was extraordinary in the fact that it happened to multiple systems at once but this is not affecting internet users," he said.

DNS serves as the address books for the internet. There are 13 official root DNS servers, which sit at the top of the DNS hierarchy. These root servers get queried only if other DNS servers, such as those at an ISP, don't have the right IP address for a specific website.

If part of the DNS system goes down, websites could become unreachable and email could become undeliverable. But DNS is built to be resilient, and attacks on the system are rare. In 2002, a similar denial of service attack also failed.

Zully Ramzan, a researcher at Symantec Security Response, said: "The main thing is that there was very little impact on the general public, the servers were able to hold up against the attacks. The internet in general was designed to even withstand a nuclear attack."

The barrage of data being apparently targeted at the DNS system started around 02:30(PT) on Tuesday. Multiple root servers saw a traffic spike but the "G" server, run by the US Department of Defense, and "L", run by Icann, seem to have bourn the brunt of it, Ramzan said. Icann's Crain confirmed that impression.

While Icann and Symantec didn't see any effect on the internet at large, ISP Neustar did see slow downs on the net. A representative for the company said: "We would call it a brownout instead of a blackout. It was significant but it did not take anything down."

The true cause of the traffic surge still needs to be determined, both Crain and Ramzan said.

Joris Evers writes for CNET News.com

Source: http://networks.silicon.com/webwatch...9165672,00.htm

[boca]

I think this is good news made to sound scary. They made it sound like a DDOS (denial of service) attack from a botnet, which means there was nothing better available as an option. This does nothing to DNS, as the article correctly says, but slow things down a bit.

[Rubber Duck]

Agreed, it just proved that they are unable to do very much damage.

[Drewbert]

g root server

http://dolphin.ripe.net/dns-servmon/....net&show=SHOW

l root server

http://dolphin.ripe.net/dns-servmon/....net&show=SHOW

ultradns

http://dolphin.ripe.net/dns-servmon/....net&show=SHOW

[boca]

Wow looks like a pretty sustained attack from the 48 hour charts. I still don't understand why some dumbsh*t would do this anyway? Whoever did it would stand to lose their own ability to surf, get email, etc. if they took down the rootservers for any length of time. What, they got tired of regging .mobis?

[Drewbert]

Think thousands and thousands of compromised windows machines, all over the planet, suddenly being told to hit one DNS server with queries.

One day the Fed's are gonna get sick of it, and make Bill fix it all for free.

[boca]

Originally Posted by Drewbert

One day the Fed's are gonna get sick of it, and make Bill fix it all for free.

No, there's a symbiotic relationship there between Microsoft and 3rd party security companies. Microsoft allows them to stay relevant and make tons of money (for incredibly bad products like Norton security center) and in return Microsoft gets some relief on the liability front. Don't look for a real security push anytime soon, fed threat or not.

Just like when they decided to use ActiveX (permanent security hole) to battle the perceived threat of Java, they always conclude that there is nothing to be gained by making their systems more secure, and plenty to gain by doing the opposite, if only they could indemnify themselves.

[rhys]

Originally Posted by boca

No, there's a symbiotic relationship there between Microsoft and 3rd party security companies. Microsoft allows them to stay relevant and make tons of money (for incredibly bad products like Norton security center) and in return Microsoft gets some relief on the liability front. Don't look for a real security push anytime soon, fed threat or not.

Just like when they decided to use ActiveX (permanent security hole) to battle the perceived threat of Java, they always conclude that there is nothing to be gained by making their systems more secure, and plenty to gain by doing the opposite, if only they could indemnify themselves.

I wish that were true, I negotiated a deal btw microsoft and a major security company once - it certainly didn't feel like a symbiotic relationship. Besides MS has its own security product which now makes it a major competitor to Norton, McAfee, and Trend, etc.

[boca]

Lots of talk about these security companies losing out to Microsoft. And you're right, history definitely suggests thats a likely scenario. Remember Trumpet Winsock? Novell netware? Netscape? or any one of hundreds of utilities programs? All allowed to survive for a while, then devoured as a subsequent release of windows incorporated their feature set.

I think they're rationalizing that these guys can mutate and survive. Microsoft thinks these vendors can move farther out away from the core feature set; instead of offering firewall and antivirus they can offer spyware removal, adware detection, email scanning, popup blockers, cookie cutters and any number of other worthless pieces of crudware.