massive attack on root servers yesterday?

[Dave Farber <dave () farber net>]

------ Forwarded Message
From: Ross Stapleton-Gray <Ross.Stapleton-Gray () ucop edu>
Date: Tue, 22 Oct 2002 15:19:00 -0700
To: Dave Farber <dave () farber net>
Subject: massive attack on root servers yesterday?

The Washington Post (uniquely... I'm not seeing this anywhere else in the
mainstream press) is reporting that there was a massive attack on DNS root
servers, on Monday:
http://www.washingtonpost.com/wp-dyn/articles/A828-2002Oct22.html

I'll append the whole of the article below...

Ross


Attack On Internet Called Largest Ever
By David McGuire and Brian Krebs
washingtonpost.com Staff Writers

Tuesday, October 22, 2002; 5:40 PM

The heart of the Internet sustained its largest and most sophisticated
attack ever, starting late Monday, according to officials at key online
backbone organizations.

Around 5:00 p.m. EDT on Monday, a "distributed denial of service" (DDOS)
attack struck the 13 "root servers" that provide the primary roadmap for
almost all Internet communications. Despite the scale of the attack, which
lasted about an hour, Internet users worldwide were largely unaffected,
experts said.

FBI officials would not speculate on who might have planned or carried out
the attack.

David Wray, a spokesman for the FBI's National Infrastructure Protection
Center (NIPC), said the bureau is "aware of the reports and looking into
it."

DDOS attacks overwhelm networks with an onslaught of data until they cannot
be used. According to security experts, the incident probably was the
result of multiple attacks, in which attackers concentrate the power of
many computers against a single network to prevent it from operating.
"This was the largest and most complex DDOS attack ever against the root
server system," said a source at one of the organizations responsible for
operating the root servers.

Ordinary Internet users experienced no slowdowns or outages because of
safeguards built into the Internet's architecture. A longer, more extensive
attack could have seriously damaged worldwide electronic communications,
the source said.

Internet Software Consortium Inc. Chairman Paul Vixie said that if more
servers went down, and if the hackers sustained their hour-long strike a
bit longer, Internet users around the world would have begun to see delays
and failed connections.

Chris Morrow, network security engineer for UUNET, said "This is probably
the most concerted attack against the Internet infrastructure that we've
seen." UUNET is the service provider for two of the world's 13 root
servers. A unit of WorldCom Inc., it also handles approximately half of the
world's Internet traffic.

DDOS attacks are some of the most common and easiest to perpetrate, but the
size and scope of Monday's strike set it apart.

Vixie said only four or five of the 13 servers were able to withstand the
attack and remain available to legitimate Internet traffic throughout the
strike. "It was an attack against all 13 servers, which is a little more
rare than an attack against any one of us," he said.

The server Vixie operates was available throughout the attack, he said.

Internet addressing giant VeriSign Inc., which operates the most important
server from an undisclosed Northern Virginia location, reported no outages.

"VeriSign expects that these sort of attacks will happen and VeriSign was
prepared," company spokesman Brian O'Shaughnessy said.
Vixie said he was unwilling to compare the attack to others he has
witnessed in more than two decades of involvement with Internet
architecture, but said it was "the largest in recent memory."

The root servers, about 10 of which are located in the United States, serve
as a sort of master directory for the Internet.

The Domain Name System (DNS), which converts complex Internet protocol
addressing codes into the words and names that form e-mail and Web
addresses, relies on the servers to tell computers around the world how to
reach key Internet domains.

At the top of the root server hierarchy is the "A" root server, which every
12 hours generates a critical file that tells the other 12 servers what
Internet domains exist and where they can be found.

VeriSign manages its servers under contracts with the Commerce Department
and the Internet Corporation for Assigned Numbers (ICANN), which manages
the DNS.

One rung below the root servers in the Internet hierarchy are the servers
that house Internet domains such as dot-com, dot-biz and dot-info.

The DNS is built so that eight or more of the world's 13 root servers must
fail before ordinary Internet users start to see slowdowns.

"There are various kinds of attacks all the time on all sorts of
infrastructure, and the basic design of the Internet is such that it is
designed to withstand those attacks," said ICANN Vice President Louis
Touton. "We're not aware of any users that were in any way affected.

"Obviously the prevalence of attacks does make it important to have
increased focus on the need for security and stability of the Internet," he
added.

Most often, the computers used in the DDOS assaults have been commandeered
by hackers either manually or remotely with the help of automated software
tools that scan millions of computers for known security holes. These
computers often belong to unsuspecting home users.

Little can be done to insulate targets from such attacks, and some of the
world's most powerful companies have been targeted in the past. In February
2000, Amazon.com, eBay, Yahoo, and a host of other big-name e-commerce
sites came to a grinding halt for several hours due to DDOS attacks.

"Only the richest can defend themselves against this type of attack, and
most of them can't withstand a concerted attack," said Alan Paller,
research director at the SANS Institute, a nonprofit security research and
training group that often works with federal investigators to track
computer virus writers. Paller also was the lead expert witness at the
trial of "Mafiaboy," the Canadian teenager who was ultimately convicted of
the February 2000 attacks.

"The only way to stop such attacks is to fix the vulnerabilities on the
machines that ultimately get taken over and used to launch them," Paller
said. "There's no defense once the machines are under the attacker's
control."

Vixie said he kept the server at Internet Software Consortium operating by
"pushing" the flood of data far enough away from his servers that
legitimate traffic could flow around the obstruction. Such clogs still
affect some Internet users by gumming up Internet communications somewhere
else in the network.

UUNET's Morrow said it is too early to tell what the attack bodes for the
Internet in coming months. "This could be someone just messing around, but
it could also be something much more serious. It's too soon to say," Morrow
said.

washingtonpost.com Staff Writer Robert MacMillan contributed to this
article.

© 2002 TechNews.com



------ End of Forwarded Message

-------------------------------------
You are subscribed as interesting-people () lists elistx com
Archives at: http://www.interesting-people.org/archives/interesting-people/