The worst attack on the internet鈥檚 infrastructure in years slowed traffic using infected 鈥渮ombies鈥� computers on Tuesday.
The attack involved deluging the internet鈥檚 central domain name system (DNS) servers with meaningless traffic in an effort to render them inaccessible or cause them to crash.
The DNS keeps traffic flowing across the internet by storing the master records that link internet protocol (IP) addresses with more memorable domain names. When someone types in the name of a web site, the DNS connects them with the right server, based on its IP address.
Advertisement
The US Department of Homeland Security confirmed its cyber-security arm had been monitoring the activity. 鈥淭he nature of the traffic has not been confirmed, and the servers, which are overseas, remain operational,鈥� says spokesman Russ Knocke.
Serious business
Graham Cluley, senior technology consultant at UK anti-virus firm Sophos described the incident as 鈥渢he most serious attack against these domain name servers鈥� since 2002.
Cluley said three of the 13 domain name system (DNS) servers that control global internet traffic were hit during the so-called 鈥渄enial of service鈥� attack. He says the attack appeared to originate from ordinary PCs remotely controlled by hackers in a giant 鈥渂otnets鈥� made up of thousands of hacked computers.
鈥淲hile the resilience of the root servers should be commended, more needs to be done to tackle the root of the problem,鈥� Cluley adds.
Experts from the US-based SANS Internet Storm Center were 鈥渁ware of the attacks鈥� and are working to dig up more information about them, says director Marcus Sachs. 鈥淲e鈥檙e still hunting for some technical details,鈥� he adds.
Grandmother attack
Some reports trace the attacks to South Korea, but Cluley says this does not mean the perpetrators are based there: 鈥淚t could be that your grandmother鈥檚 computer in the bedroom, unbeknownst to her, may have been trying to bring down the internet.鈥�
Cluley adds the motive for the attack remains unclear. One tactic sometimes used by hackers is to threaten to shut down a website with a denial of service attack if money is not paid. 鈥淎nother possibility is just plain mischief, and my feeling is that this may have been just a bit of a lark,鈥� Cluley said.
In October 2002, another major attack targeted all 13 root servers and slowed internet traffic more dramatically (see Internet鈥檚 foundations shaken by attack).
