Internet Root Servers Hit with Unusual DNS Amplification Attack

By CircleID Reporter

On Nov. 30 and Dec. 1, several of the Internet Domain Name System's root name servers received high rate of suspicious queries, reaching as high as 5 million queries per second, according to a report released by the Root Server System Advisory Council. The incident has been categorized as a unique type of DNS amplification attack.

"While it's common for the root name servers to see anomalous traffic, including high query loads for varying periods of time, this event was large, noticeable via external monitoring systems, and fairly unique in nature, so this report is offered in the interests of transparency."

The attack saturated network connections near some DNS root name server instances, however the system is said to have functioned as "designed, demonstrating overall robustness in the face of large-scale traffic floods observed at numerous DNS root name servers."

The organization has advised use of Source Address Validation and BCP-38 wherever possible to reduce the ability to abuse networks to transmit spoofed source packets.

Update Dec. 12: A new story reports that some security experts believe the attack was even more severe than originally thought. They say "it was brought about by a so-called 'zombie army' botnet unwittingly installed on hundreds of millions of smartphones through an as yet unidentified app."

Update Dec. 15: Verisign's Perspective on Recent Root Server Attacks

Related topics: Cyberattack, Cybersecurity, DNS, Networks

Comments

Proposal: Require BCP38 for anybody connecting to root servers Bill Stewart  –  Dec 09, 2015 11:05 PM PDT

Ok, you can't really do that, since people can still connect to the root servers through other networks, and Anycast means the root servers are spread around widely, but we can still wish.