Attack On Internet Fails. Perp and Motive Unknown.

In the worst attack on the internet since 2003, an unknown party on Tuesday attacked 3 of the 13 root nameservers at the heart of the internet's domain name system. The FBI is currently investigating the issue, but is apparently not seeking help from the usual sources. Though no damage was apparent on an end-user level, no one knows who attacked, or why the attack was staged. Rumors abound, but the only known variable is that the attack was extremely sophisticated, had the ability to alter itself on the fly, and would have required the coordination of a large group of people with a bot network.



I can't even begin to offer an explanation short of speculation, but my guess is that it was either the crab people or skynet. I do have to say it's rather odd though. Normally by now they'd already have busted the door down to some kid's bedroom and hauled him off to a job interview. Sorry, I wish I had more of an opinion on this, except to say I doubt we'll get the full story. Ever.

Related News Links:
www.npr.org
www.postchronicle.com
www.latimes.com
www.pcadvisor.co.uk

Related AboveTopSecret.com Discussion Threads:
DARPA AI .mil & more
Choking the Internet: How much longer will your favorite sites be on line?

Hmmm this is interesting. It says the attacks came mainly from Korea and china. The article listed many different reasons for making this attack. From money, to influence in a circle of hackers. But does any one think that the servers targeted might be just a test to see what they can handle? To learn something that might be useful?
Just a thought.

China? US government themselves? Russia? Amateurs? It's more likely it's a government that some bunch of amateurs highly skilled in computers... Motives... fear, disruption, government saving everything, economy... Your ideas?

Aren't the servers regulating the internet supposed to be kept secret? I know that a few are known, but I once heard that the others are to be kept secret in case there is ever an attack, such as what happened.

Originally posted by DJMessiah
Aren't the servers regulating the internet supposed to be kept secret? I know that a few are known, but I once heard that the others are to be kept secret in case there is ever an attack, such as what happened.

It wouldnt matter, these types of attacks arent effective. All servers on the net cache their DNS resolutions, so trying to take down the DNS servers would only result in a minor inconvience, slower net times and such. Apparently this is the work of amateurs otherwise they would be aware of this fact.

It wouldnt matter, these types of attacks arent effective. All servers on the net cache their DNS resolutions, so trying to take down the DNS servers would only result in a minor inconvience, slower net times and such. Apparently this is the work of amateurs otherwise they would be aware of this fact.

Just asking, do you pretend you know more about this kind of things that people who hacked the centrals DNS, and that it's ranked the biggest attack in over 4 years? Seriously.

Wouldn't they crash internet if they would be able to enter the 13 main DNS, crash them, erase everything... it would be a mess to repare... they would be able, they surely have backup machines... but it would slow internet for at least 1 week. Would the economy collapse? Probably.

[edit on 7-2-2007 by Vitchilo]

There are some graphs showing the traffic rates to the root servers here.

They must think they are fairly bullet proof to go after the DOD's Network Information Center. Doesn't seem like it's merely rogue hackers that have control over a million bots.

Zombie botnets attack global DNS servers IT Week
Secrets Of The DoS Root Server Attack Revealed Informationweek

[edit on 7-2-2007 by Regenmacher]

Originally posted by Vitchilo

It wouldnt matter, these types of attacks arent effective. All servers on the net cache their DNS resolutions, so trying to take down the DNS servers would only result in a minor inconvience, slower net times and such. Apparently this is the work of amateurs otherwise they would be aware of this fact.

Just asking, do you pretend you know more about this kind of things that people who hacked the centrals DNS, and that it's ranked the biggest attack in over 4 years? Seriously.

Wouldn't they crash internet if they would be able to enter the 13 main DNS, crash them, erase everything... it would be a mess to repare... they would be able, they surely have backup machines... but it would slow internet for at least 1 week. Would the economy collapse? Probably.

[edit on 7-2-2007 by Vitchilo]

I agree,
If they managed to get into it, and attempt to hack, im pretty sure they knew the basics of caching.
And if they managed to succeed, it would be alot more than a 'minor' inconvenience.
for starters... ensure you have word, cause ats wont be there for you to post your opinions.

Hopefully the intended victem will also learn from this attack and will make changes to help protect them selves more in the future.
I like to think that is what has been done in the past any way.

Originally posted by RedGolem
Hopefully the intended victem will also learn from this attack and will make changes to help protect them selves more in the future.
I like to think that is what has been done in the past any way.

Actually that's a good point. The attack in 2003 was apparently much worse than this one, because they learned from the attack in 2003 and implemented the neccessary changes to minimize the risk.

It's not so much the scale of the attack that bothers me, but rather the motive and complexity. What country would stand to benefit the most from the world wide web being brought to a crawl for a few days? What would be the point of it? China is the only country I could think of with even a sliver of a reason (censorship, or bait and switch), and even that's a really far-fetched guess, because they rely on the net as well.

Yet the attack required the sophistication, programming, and adaptability of a large group of seriously 1337 hackers, and the annual North American Network Operators Conference was going on at the time of the attacks. Dunno if the two are related or not, but if there was ever going to be a group of people large enough to pull it off, talented enough to pull it off, and in a close enough proximity to organize instantaneously, that'd be it.

There's still something about this whole story that screams "wrong" though. It's like one of those pictures where you have to find what's wrong, but it's really subtle. Anyway, I'll be curious to see what comes of this.

I will be curious also to see what becomes of it also. Although as what has been said earlier, it is unlikely if we will ever see what becomes of this. The best possibility would be if any of us attend a hackers convention or something.

It could be a "false flag" testing operation to probe faults in the system. This could be premonition to stage a later "terrorist" attack that will effect most users of the internet. Then will report a loss of "millions of dollars a day" or however much they decide to say the attacks cost the U.S. and world economy. The reason for this opperation could be to put forward resolutions for more strict internet monitoring and have atleast the american people happy to give away more of their privacy rights, that is to say they are still intact.

Originally posted by XphilesPhan

Originally posted by DJMessiah
Aren't the servers regulating the internet supposed to be kept secret? I know that a few are known, but I once heard that the others are to be kept secret in case there is ever an attack, such as what happened.

It wouldnt matter, these types of attacks arent effective. All servers on the net cache their DNS resolutions, so trying to take down the DNS servers would only result in a minor inconvience, slower net times and such. Apparently this is the work of amateurs otherwise they would be aware of this fact.

Quite wrong. These attacks are actually effective in the sense that if all 13 root servers were targeted Internet users would be impacted. There is some degree of caching but DNS zones have TTL periods in which they refresh information. These TTL settings are very arbitrary and provide the robustness of how the DNS hierarchy functions. Was this attack bad? No not in the sense of what transpired but then again a lot has been learned from previous incidents not to mention mitigating ddos attacks. Co-ordinating attacks like this takes some effort hardly the workings of your average 12yr old zit faced basement dweller.

Also just to add, root dns servers are not secret, that defeats their purpose.

brill