« Microsoft Expected to Release a Record Number of Patches Next Tuesday | Main | Gemalto's Amol Deshmukh Discusses the Fail-safe Network Identity Manager (NIM) »

A disturbing report found at Dark Reader questions whether the distributed denial-of-service (DDOS) attack that temporarily crippled, but did not crash, two of the internet’s 13 Domain Name System (DNS) root servers was really just a test run.

Last week’s DDOS attack was the latest in a series of DNS attacks that started last year, when EveryDNS and EasyDNS, two DNS providers, each experienced attacks. Experts had predicted that it was only a matter of time before botnet operators went after a bigger target, which is what last week represented.

The attackers targeted five DNS root servers, using an army of bots from all over the globe to execute the attack. The majority of the traffic came from Seoul (61%), Beijing (18%), and San Francisco (13%). Two of the root name servers dropped 90 percent of their DNS query traffic, while the remaining three stayed operational.

"Yesterday's attack was likely a precursor to a larger attack. The rise of DNS attacks in the last year has been worrisome," says David Ulevitch, CEO of OpenDNS, and founder of EveryDNS, both DNS services. "I believe the attack yesterday and the night before were tests to see how far someone could push the limits."

The good news is that, while the operator will likely not be found, they will be able to pin down most of the IP addresses of the bot-network and shut them down. That means if and when they execute another attack, they’ll have to start at square one.

"This attack is a strange one," says Craig Labovitz, director of engineering at Arbor Networks. "This has some people scratching their heads. It has some of the earmarks of a trial run, but it wasn't insignificant enough to fly under the radar. It was fairly large and disruptive."

A much more frightening prospect is if the same sort of attack was aimed at a business. "How many midsize to large enterprises do you know that have 13 highly redundant data centers with highly redundant DNS servers?" says Paul Parisi, CTO for DNSstuff.com. "I'm worried about the corporate environment... This proves the technology is out there and can be leveraged autonomously.

Experts believe this just proves the potential devastating effect of botnets, which gives hackers a much larger base to launch these attacks. "Networks need to stop letting botnets run rampant across their backbones," OpenDNS's Ulevitch says. And "end users need to be running up-to-date antivirus software. Software manufacturers need to write better code. There are a hundred things that need to be done. And unfortunately, none of them are going to happen anytime soon."

Posted by pschooff in |Digg This|Add to del.icio.us

Trackback Pings

TrackBack URL for this entry:
http://www.ebizq.net/mt/mt-tb.cgi/1336