Security expert warns of repeat DNS server attacks

 

Gallery

By Rene Millman

Posted on 14 May 2007 at 17:57

The same kind of denial of service attacks that hit the Internet's root servers in February could be played out on an organisation's infrastructure with devastating effects, warns a security expert.

In February, hackers took aim at the root servers of the Internet in a distributed denial of service attack that lasted hours. The offensive was thought to be one of the biggest seen in four years.

But Cricket Liu, vice president of Architecture at network appliance vendor Infoblox and an expert on DNS, said that the attack was doomed to failure because 11 of the 13 root servers ran in Anycast groups that prevented them from being swamped with information.

Servers in an Anycast configuration run different servers in different locations but anyone on the Internet will only see the nearest box to them. It is used to provide redundancy and load sharing to specific types of network services on the internet.

He said that it would be extremely difficult to hackers to completely overcome a particular set of servers.

'You can't simultaneously attack all 40 servers in the group because you can't see all 40 servers at the same time. They all have the same IP address,' said Liu. 'You'd have to attack all 40 from 40 different points around the world to be anywhere near successful. That would be a pretty big task for any hacking organisation.'

But he warned that companies running DNS servers within their own infrastructure could see the name servers successfully attacked in the same way.

He said that many organisations had their name servers all on the same subnet and hackers would find the task of taking them offline a trivial one with a dozen broadband-connected boxes.

'In places like South Korea there is a huge penetration of broadband and a lot of bandwidth available to computers. A box with 20Mbps bandwidth to the internet can generate a lot of traffic,' said Liu.

He said that companies should consider using Anycast on name servers to prevent them from being a victim of a DoS attack from hackers. But Liu warned that there was a certain amount of fear that prevents organisation from deploying Anycast as they perceived it to be too complicated to roll out.

'In some cases they haven't even heard of it. Some people give you a blank look when you bring up the topic,' he said.