Hackers hit key Internet traffic computers

Described as "unusually powerful attack" it overwhelmed at least some computers that manage global computer traffic.
The origin is still unknown but the trace seems to be leading in South Korea.

News Source

WASHINGTON (AP) -- Hackers briefly overwhelmed at least three of the 13 computers that help manage global computer traffic Tuesday in one of the most significant attacks against the Internet since 2002.

Experts said the unusually powerful attacks lasted for hours but passed largely unnoticed by most computer users, a testament to the resiliency of the Internet.

Among the targeted "root" servers that manage global Internet traffic were ones operated by the Defense Department and the Internet's primary oversight body.

No wonder I noticed the unusually slow internet connectivity starting yesterday which had occassional drops. Almost went unoticed for most people. They were probably thinking some minor ISP problems or technical issues. Even the system administrator in my place was not aware.


[edit on 7-2-2007 by searching_for_truth]

[edit on 7-2-2007 by searching_for_truth]

Sounds like they were trying to flood out the root DNS servers, which has been attempted before with equally little success. Since most of the servers on the internet cache their DNS resolutions, these attacks do very little to actually disrupt thye internet. The key here was when they said "13 servers" I think there are only 13 or 14 root DNS servers, all of which are in pocession of the US government.

Mark another trial and failure up to some wannabes out of gods-know-where-asia, or at least thats where the trail points to at the moment, but proxies are about as easy to find in that part of the world as STDs are in a house of ill repute.

As for the locations of the DNS servers the majority of them are in the US however a few are distributed around the world using anycast such as RIPE(K), VeriSign(J), Autonomica(I), and ISC(F). According to the article (although they don't say it directly) the K server in Columbus Ohio was one of the ones hit along with the L server of ICANN hosted in California.

The reason many people are not aware is the very nature of DNS, its a trickle down effect where new domains are added at the root servers, then propagate down to lower level DNS servers such as the ones almost every ISP in the world maintains. As long as the ISP level servers aren't hosed as well (which would indicate either a more unique type of DoS attack or worse; a vulnerability in the very DNS daemon itself) then the net continues to work since the lower level servers maintain their records for a period of time.

Since BIND itself wasn't being attacked but rather just spewing craptons of requests/data at the servers there was precisely 0 threat or impact on the tubes, just a bunch of busting arse at the respective servers.

It's just a matter of time before a group manages to figure out how to crash everything. I know there are systems all over the world and it would have to be a huge effort ... but I betchya there are people who would love to make it happen ... either for fame, glory, money, or ideology.

It will happen someday. It's just a matter of time.

@FlyersFan

I would almost agree except for the fact that just as there are groups and people out there who are working to find ways to try to take out the internet or at least the root dns servers there are security professionals in the IT sector working just as hard to make sure it doesn't happen. Unless those in the security field start to give up and move to other sectors the balance between the good guys and the bad guys will probably remain about at its currently somewhat balanced state.