Early last week, one of the most vital organs of the Internet anatomy came under an unusual attack. On two separate occasions lasting an hour or more each, a flood of as many as many as five million queries per second hit multiple domain name system root servers that act as the final and authoritative reference for determining which IP address is returned when a user types a domain name into a browser.
The first barrage took place on Monday, November 30, and lasted for about two hours and 40 minutes. The second one happened a day later and lasted for almost exactly an hour. Most but not all of the 13 root servers that form the Internet’s DNS root zone were hit. The attacks started and stopped on their own and consisted of billions of valid queries for just two undisclosed domain names, one for each incident. There’s no indication of who or what was behind the attack.
While the load was large enough to be detected on external systems that monitor the Internet’s root servers, they ultimately had little effect on the billions of Internet end users who rely on them. That’s partly because root servers provide IP translations only when a much larger network of intermediate DNS servers fail to do so and partly because of the robust design of the hundreds of servers that run the dozen-plus root authorities.
“My takeaway is that the event pretty much ‘didn’t happen’ for the ordinary user,” Randal Vaughn, a professor of information systems at Baylor University who follows DNS operations, wrote in an e-mail. “They either failed to observe it or just didn’t associate any connectivity issues with an ongoing attack.”
Despite the minimal impact on end users, however, the attack was by no means a non-event. A torrent of five million queries a second that hits most of the root servers for an hour or more represents a formidable amount of computing power and bandwidth. The volume represents as much as a 250-fold increase over the normal load placed on a typical root server, Keith Mitchell, president of the Domain Name System Operations Analysis and Research Center, told Ars. Mitchell cited slide six of this presentation showing root servers receiving from 20,000 to 50,000 queries per second.
Perhaps more concerning, the junk queries were received by name servers that use IP Anycast, a network routing method that assigns the same public IP address to multiple geographically dispersed servers. Since the attack was observed hitting Anycast machines, that means the significant resources that made them possible were also geographically dispersed rather than being from a handful of sources in just a few locations.
“This event was notable for the fact that source addresses were widely and evenly distributed, while the query name was not,” an advisory published Friday noted. “This incident, therefore, is different from typical DNS amplification attacks whereby DNS name servers (including the DNS root name servers) have been used as reflection points to overwhelm some third party.”
A large botnet of infected computers or other Internet-connected devices is the most plausible explanation for such an attack. That would explain how the attack occurred, but it doesn’t shed any light on why it was carried out. It has also renewed calls for networks to implement BCP 38, an Internet Engineering Task Force standard for defeating IP address spoofing. Many networks enforce it, but some still don’t, and they’re the ones making such attacks possible.
SOURCE: Dan Goodin | Ars Technica