Distributed denial of service attacks on root nameservers
Distributed denial of service attacks on root nameservers are Internet events in which distributed denial-of-service attacks target one or more of the thirteen Domain Name System root nameserver clusters. The root nameservers are critical infrastructure components of the Internet, mapping domain names to Internet Protocol (IP) addresses and other resource record (RR) data.
Attacks against the root nameservers could, in theory, impact operation of the entire global Domain Name System, and thus all Internet services that use the global DNS, rather than just specific websites. However, in practice, the root nameserver infrastructure is highly resilient and distributed, using both the inherent features of DNS (result caching, retries, and multiple servers for the same zone with fallback if one or more fail), and, in recent years, a combination of anycast and load balancer techniques used to implement most of the thirteen nominal individual root servers as globally distributed clusters of servers in multiple data centers.
In particular, the caching and redundancy features of DNS mean that it would require a sustained outage of all the major root servers for many days before any serious problems were created for most Internet users, and even then there are still numerous ways in which ISPs could set their systems up during that period to mitigate even a total loss of all root servers for an extended period of time: for example by installing their own copies of the global DNS root zone data on nameservers within their network, and redirecting traffic to the root server IP addresses to those servers. Nevertheless, DDoS attacks on the root zone are taken seriously as a risk by the operators of the root nameservers, and they continue to upgrade the capacity and DDoS mitigation capabilities of their infrastructure to resist any future attacks.
Contents |
[edit] Attacks
[edit] October 21, 2002
On October 21, 2002 an attack lasting for approximately one hour was targeted at all 13 DNS root name servers.[1]
This was the second significant failure of the root nameservers. The first caused the failure of seven machines in April 1997 due to a technical problem.[2]
[edit] February 6, 2007
On February 6, 2007 an attack began at 10 AM UTC and lasted twenty-four hours. At least two of the root servers (G-ROOT and L-ROOT) reportedly suffered badly while two others (F-ROOT and M-ROOT) experienced heavy traffic. The latter largely contained the damage by distributing requests to other root server instances with anycast addressing. ICANN published a formal analysis shortly after the event.[3]
Due to a lack of detail, speculation about the incident proliferated in the press until details were released.[4]
On February 8, 2007 it was announced by Network World that: "If the United States found itself under a major cyberattack aimed at undermining the nation's critical information infrastructure, the Department of Defense is prepared, based on the authority of the President, to launch [...] an actual bombing of an attack source or a cyber counterattack."[5]
[edit] Threats
[edit] Operation Global Blackout 2012
On February 12, 2012, a statement was posted on the pastebin.com pastebin cited to be from Anonymous threatening an attack on the root servers on March 31, 2012.[6]
“To protest SOPA, Wallstreet, our irresponsible leaders and the beloved bankers who are starving the world for their own selfish needs out of sheer sadistic fun, On March 31, anonymous will shut the Internet down,” reads the statement. “Remember, this is a protest, we are not trying to ‘kill’ the Internet, we are only temporarily shutting it down where it hurts the most…It may only lasts one hour, maybe more, maybe even a few days. No matter what, it will be global. It will be known.”[7]
According to cyber security researcher Rob Graham at Errata Security, it is unlikely that such an attack would be effective. He says "it's doubtful many people would notice."[8]
[edit] References
- ^ Vixie, Paul; Gerry Sneeringer, Mark Schleifer (2002-11-24). "Events of 21-Oct-2002". http://www.isc.org/f-root-denial-of-service-21-oct-2002. Retrieved 2008-07-11.
- ^ "Router glitch cuts Net access". CNET News.com. 1997-04-25. http://news.com.com/Router+glitch+cuts+Net+access/2100-1033_3-279235.html. Retrieved 2008-07-11.
- ^ "Factsheet - Root server attack on 6 February 2007". ICANN. 2007-03-01. http://www.icann.org/announcements/factsheet-dns-attack-08mar07.pdf. Retrieved 2008-07-11.
- ^ Kristoff, John (2007-07-27). "Root DDoS Attack Analysis". DNS-OARC. https://www.dns-oarc.net/files/dnsops-2007/Kristoff-Feb07-attacks.pdf. Retrieved 2009-09-09.
- ^ Messmer, Ellen (2007-02-08). "U.S. cyber counterattack: Bomb 'em one way or the other". Network World, Inc. http://www.networkworld.com/news/2007/020807-rsa-cyber-attacks.html. Retrieved 2008-07-11.
- ^ "Untitled". pastebin.com. 2012-02-12. http://pastebin.com/NKbnh8q8. Retrieved 2012-02-19.
- ^ Greenberg, Andy (2012-02-16). "Anonymous Plans To Take Down The Internet? We're Being Trolled". Forbes. http://www.forbes.com/sites/andygreenberg/2012/02/16/anonymous-plans-to-take-down-the-internet-were-being-trolled/. Retrieved 2012-02-19.
- ^ Graham, Robert D. (2012-02-16). "No, #Anonymous can't DDoS the root DNS servers". Errata Security. http://erratasec.blogspot.com/2012/02/no-anonymous-cant-ddos-root-dns-servers.html. Retrieved 2012-02-19.
[edit] External links
- Significant Internet events
- Internet Traffic Report's synopsis
- InformationWeek article on February 2007 attack
- Robert Lemos (October 22, 2002 7:40 PM PDT). "Assault on Net servers fails". CNET news.com. http://news.com.com/2100-1001-963005.html. Retrieved 2012-01-02.
