Root server DoS attack slows the net

have you noticed a diffrence ? i cant say i have
as reported from the register.co.uk

http://www.theregister.co.uk/content/6/27731.html

Quote:

---

A denial of service attack on the Internet's root DNS servers that began last night continues to vex users today.

The DNS servers resolve names queries to numbers, and the slowdown should only be apparent the first time a user hits a site. After that, your ISP's cache ought to bypass the issue.

The attack highlights the importance of DNS and its consequent vulnerability.

Over at IcannWatch, Michael Froomkin revives Karl Auerbach's proposal of a CD-based "DNS in a box" for such emergencies.

"The proposed CD would have contained the configuration files for BIND plus zone files for a root and selected contents of the big TLDs, plus some sort of wildcard for in-addr.arpa.... but it would have dented ICANN's claim to being uniquely necessary, and besides the idea came from the wrong source," observes Froomkin.

Last year ICANN vowed to take security seriously, and after the latest attack it ought to explain why this is such a bad idea.®

---

lol I have been getting malformed packets from icann.org all day, was wondering what that was all about :)





El Diablo

I remember the root servers had a simlar DoS attack last spring. I use to have a great link that showed all the root servers traffic but I can't find it. I did find these two links that can give you some what of an idea.

http://www.cymru.com/DNS/dns.html
http://www.caida.org/cgi-bin/skitter_monitors/main.pl

Well I can speak on behalf of the nations 4th largest ISP and the largest hosting company in the US, that our DNS servers have not been affected in the slightest. And to be honest, had this statement been true, i am sure our beloved network admin would have known, and let us know bout a looming threat. So I would not worry about a thing.

I was just reading a similar article, but it is more in depth.

link

detoxsmurf: thanks for the links... thats pretty cool

Crazy to think that someone could possibly "take down" the internet. Just imaging if they had done it longer and with more hosts attacking all the servers...

Then what would we all do?

I've trashed all my board games...
Guess we still have our video games. :) Metal of Honor baby!

Yes, I did notice a difference also and took to now to discover what was going on. Thing is it was a probe a concept, now it worked. So lets see how to break the net most likely just kidz that is the sad part more info here in the US http://apnews.excite.com/article/200...D7MQTP5O0.html and I hate media reports will look for some more tech info over the next few days. Hard to say if it is media hype very little over the tech channels so far must still be assessing things.

Will add to what Dr. Toker said while there are root servers that are on the backbone DNS also by nature takes into account the loss os these puters which is why there are more DNS servers then one can count now. If I noticed a slight slowing was because of re-routing, this place was designed to be taken out by nukes not kidz with gas :)

hey more news on this from http://www.abc.net.au/

http://www.abc.net.au/news/scitech/2...23130601_1.htm

Quote:

---

The core servers that direct email and Web surfers to their desired destinations around the world have been attacked in an apparently coordinated attempt to cripple the Internet.

Authorities say the attack, which largely failed, was launched at about 7:00am (AEST) yesterday.

Paul Vixie, the chairman of the California-based Internet Software Consortium, which operates one of the root servers, says the attack targeted the 13 root servers that make up Internet's Domain Name System.

He says the attack lasted about an hour.

Steven Berry, a supervisory special agent at the FBI, says the bureau's National Infrastructure Protection Centre was "aware of the issue and we are addressing it".

He declined to comment further.


Little effect

Experts say the so-called "distributed denial of service" attack congested some traffic but would not have been noticeable to average Internet users.

Mr Vixie said: "It was like redirecting all traffic between Highway 101 and the street you live on, or into your driveway.

"You would not be able to get home because the street in front of your house would be full of cars from [Highway 101]."

Denial of service attacks are designed to temporarily shut down servers by overwhelming them with too much traffic, usually coming from drone computers around the Internet.

The Domain Name System - which matches up the long numerical codes computers use to match other computers attached to the Internet with the Web addresses people type in - and the root servers it relies on for address information, have long been considered the Achilles heel of the Internet, capable of shutting down the network if attacked.


Modern cockroach

Mr Vixie says the attack on the servers proves the Internet will not be so easily toppled, adding that the Internet is designed to route around obstructions.

"What we learned yesterday is ... it is hard to kill this system," Mr Vixie said. "The Internet is sort of the cockroach of the modern age. It survives.

"We've known all along that this could happen and it does happen periodically against root servers," he added. "It was interesting because it was an attack on all 13 root servers. That's kind of rare."

Peter Salus, the chief knowledge officer at Texas-based Matrix NetSystems, which monitors Internet performance, has speculated that the root server attacks were related to a distributed denial of service attack on a number of Web sites that lasted a few hours later in the day.

"My guess is script kiddies having a good time earlier decided on a new target," Mr Salus said.

He says that of the 13 root servers, those that were the worst affected were the ones operated by: the US Department of Defence Information Centre in Vienna, Virginia; the US Army Research Lab in Aberdeen, Maryland; the Internet Corporation for Assigned Names and Numbers in Los Angeles; and one each in Stockholm and Tokyo.

Ted Julian, co-founder of computer security company Arbor Networks, says the root server attack "is just another reminder that distributed denial of service attacks remain, arguably, the number one threat we face" on the Internet.
Print-friendy version

---

EDITED for another link

http://www.boston.com/dailyglobe2/29...rattack+.shtml

edited for another link http://zdnet.com.com/2100-1105-963005.html

Well my ISP was certainly suffering, all web activity slowed to a crawl over here and I have got a 600k connection, not good!

detoxsmurf if you find the other link to show the traffic on the root servers I would be very interested to see it .

Just had an e-mail from one of our ISP's EasyNet, saying that they are experiencing a severe DOS attack which is affecting al of their network

Is there a point to fire housing the root servers? definatley not cool man.

Another and complete source to analyse graphically the attack is http://k.root-servers.org/ktotal/-weekly.html

Really interesting to view. Note that I post this 5 days after the attack and that my isp dns server is still doing crappy things since the attack. And many of my friends have the same problems.

Sounds to me like Kevin Mitnick got a new computer.

Sounds to me like Kevin Mitnick got a new computer.

This is why us people are feared. Sad but true those people are the ones who make us suffer
the cost of freedom. If we took it in to are own hands things like this would not happen.

This is why us people are feared. Sad but true those people are the ones who make us suffer
the cost of freedom. If we took it in to are own hands things like this would not happen.

The www.2600.com website is reporting the following about the attack.

>>2600 has learned that the FBI is having little success in its attempts to investigate an Internet attack which happened last Tuesday. <<

I have yet to hear anything else on the FBI's efforts in this invetigation.

The www.2600.com website is reporting the following about the attack.

>>2600 has learned that the FBI is having little success in its attempts to investigate an Internet attack which happened last Tuesday. <<

I have yet to hear anything else on the FBI's efforts in this invetigation.

considering we run several dns servers in house, and have one hell of a cache on our proxy we've really not noticed much. In any case the effects will only be when a query for a domains nameservers is passed, considering the average cache timeouts, and the fact that the rest of the queries are destined for whatever the domains nameservers are I doubt that it will be noticeable unless one *realy* watches his timings.

Still, should the root servers become unavailable for a long period of time, we may have a problem.......

considering we run several dns servers in house, and have one hell of a cache on our proxy we've really not noticed much. In any case the effects will only be when a query for a domains nameservers is passed, considering the average cache timeouts, and the fact that the rest of the queries are destined for whatever the domains nameservers are I doubt that it will be noticeable unless one *realy* watches his timings.

Still, should the root servers become unavailable for a long period of time, we may have a problem.......