A spat between Spamhaus, a Dutch-based anti-spam firm, and Cyberbunk, a company accused of hosting spam transmitting websites, quickly escalated into one of the largest ever computer Distributed Denial of Service (DDoS) attacks on the Internet.
As a result, Internet users in different parts of the word experienced delays in Internet services or difficulties accessing popular Web sites. However, reports of the impact of last week's large scale cyber-attack on the Internet may have been overblown.According to one of the leading Internet experts in the region, Bevil Wooding: "The large-scale DDoS attacks targeting Spamhaus were not as unprecedentedly devastating to the Internet as some media outlets reported. However, what the attacks highlighted is the vulnerabilities that still exist in networks that can impact organisations or entire countries."
Wooding heads the Caribbean Network Operators Group, a volunteer-based organisation that provides governments and organisations with training and advice in Internet security and network design and hi-tech areas.He provided some perspective as to how the attacks were implemented.The basic attack technique consists of an attacker sending a DNS name lookup request to what is known as an open recursive DNS server. In this request the source address (is) spoofed to be the victim's address.
He explained, The Domain Name System, or DNS, functions like a telephone switchboard for the Internet. The DNS is a globally distributed database used to translate a human-understood domain name such as www.google.com, to a machine-understood Internet Protocol (IP) address like 75.125.45.113. Data packet routing on the Internet is based on these numeric addresses.
"This is why DNS servers are so critical to the core functionality of Internet–they help direct traffic to the correct IP address location. "In a DNS Amplification attack, the attacker takes advantage of misconfiguration in a DNS server in order to flood a server with DNS response traffic."
The first step in mitigating against the risks of DNS Amplification attacks is to properly configure recursive DNS servers. CaribNOG provides three recommendations:IT administrators can use the OpenResolver site to search their IP space to see if they have an open recursive resolver that the project has already publicly indexed.A related tool is DNSInspect (http://www.dnsinspect.com/) which also provides an online tool for administrators to check for misconfigured DNS servers.
Another option is the Open Resolver Test (http://dns.measurement-factory.com/cgi-bin/openresolvercheck.pl/) from The Measurement Factory.Safeguarding DNS and other pieces of the Internet's critical infrastructure is a top priority for the international bodies and individuals responsible for managing and protecting the Internet. Wooding concluded: "The impact of this recent headline grabbing attack may have been exaggerated. However, the risks of a similar attack crippling a business, or even a country are quite real."
