Update: Akamai blames 'global DNS attack' for disruptions

IDG News Service - A global attack on the Domain Name System caused disruptions affecting customers of Internet hosting company Akamai Technologies Inc., including search engine sites, said Jeff Young, an Akamai spokesman.

Akamai disputed early reports that the disruption in service to the sites, including Yahoo.com, Google.com and Microsoft.com, was specific to its network of DNS servers, which translate user-friendly domain names into numeric IP addresses. Instead, the problem on Akamai's network was part of a "large-scale international attack on the Internet infrastructure," Young said.

However, at least one Web performance monitoring company said it has no evidence of a wider attack.

The attack, which Young declined to describe, started shortly before 9 a.m. EDT. The attack affected Akamai's Internet name service and a "small number" of the company's customers, primarily search engines that use Akamai to manage traffic to their Web sites, he said.

"There was an intermittent service issue. It was not an outage on the Akamai network. The name service continued to operate throughout the incident," Young said. "We have no information that leads us to believe the attack was directed specifically at Akamai."

However, others aren't so sure.

Systems at Web performance monitoring company Keynote Systems Inc. noted a decrease in performance at leading Web sites starting at 8:30 a.m. EDT and said that a number of sites, including those for Microsoft Corp., Yahoo Inc., Google Inc. and Symantec Corp., were only at 20% capacity for as much as an hour this morning, according to Lloyd Taylor, vice president of technology at Keynote.

The companies affected appeared to be Akamai customers. Keynote couldn't rule out a broader attack but said that the company lacks any evidence to support such a claim. However, traffic to other companies on Keynote's Business 40 Internet Performance Index, which includes the corporate Web sites of Cisco Systems Inc., 3Com Corp. and Charles Schwab & Co., weren't slowed, he said.

"There's nothing that has shown up as performance issues yet," Taylor said.

Akamai couldn't provide details about the nature of the attack, where it came from or organizations other than its customers that were affected. However, networks around the world experienced the attack, Young said.

The interruptions at Akamai have the fingerprint of a denial-of-service attack, in which hundreds or thousands of machines work together to flood a specific Internet address or addresses with malicious traffic, slowing it down, Taylor said.

"You saw things get bad suddenly, then get better slowly," he said.

In contrast, service is typically restored quickly after hardware or software failures,once the cause of the failure is determined, Taylor noted.

In the meantime, most of the affected customers have switched to their own DNS servers or those hosted by other companies, Taylor said. However, the Akamai DNS service appeared to be up and running, and Google was still using it to resolve requests to its site today, he said.