Major Net backbone attack could be first of many

IDG News Service - The distributed denial-of-service (DDOS) attack launched Monday against all 13 of the Internet Domain Name System (DNS) root servers failed to bring down the Internet (see story). But that doesn't mean more attacks won't follow and succeed where this week's attack failed, according to experts, some of whom said the federal government needs to step in to secure the Net infrastructure.
The attack was targeted at 13 key servers that translate easy-to-remember URLs into the numeric IP addresses used by computers to communicate.
Attackers flooded the DNS servers with Internet traffic using the Internet Control Message Protocol (ICMP) at more than 10 times the normal rate of traffic, according to Brian O'Shaughnessy, a spokesman for Mountain View, Calif.-based VeriSign Inc., which manages the "A" and "J" root servers.
Such events are nothing new, with high-profile attacks having occurred in past years against Internet service providers and companies such as Microsoft Corp. and eBay Inc. But experts say that this incident opens a new chapter in the history of Internet-based attacks.
"Monday's attack was an example of people not targeting enterprises, but going against the Internet itself by attacking the architecture and protocols on which the Internet was built," said Ted Julian, chief strategist at Arbor Networks Inc. in Lexington, Mass.
Factors contributing to such attacks are well known, according to experts. Worms such as Code Red, Nimda and Slapper have left hundreds -- if not thousands -- of compromised computers on the Internet, Julian said. Such systems can be used as "zombies" in a DDOS attack. Zombies are machines controlled remotely and used to launch an attack.
Reports from Austin, Texas-based Matrix NetSystems Inc. yesterday traced the attacks to Internet hosting-service providers in the U.S. and Europe.
Gerry Brady, chief technology officer at Guardent Inc. in Waltham, Mass., said sophisticated software programs make leveraging those compromised machines a simple matter, even for novice attackers.
"With automated attack tools, even inexperienced people can get control of a large number of hosts. The IP addresses and access passwords for those systems are traded on the Internet like you or I used to trade baseball cards," Brady said.
While the FBI's National Infrastructure Protection Center is investigating the incident, Brady pointed out that some of the most frequent sources of such attacks are teenagers, not terrorists.
"The big drivers we're seeing [in DDOS attacks] are juvenile rivalries -- revenge for incidents that might have happened during online gaming. These attacks are not professional or financial in nature. They're random and nondirected," Brady said.