NordVPN Promotion

Home / News

Internet Root Servers Hit with Unusual DNS Amplification Attack

On Nov. 30 and Dec. 1, several of the Internet Domain Name System’s root name servers received high rate of suspicious queries, reaching as high as 5 million queries per second, according to a report released by the Root Server System Advisory Council. The incident has been categorized as a unique type of DNS amplification attack.

“While it’s common for the root name servers to see anomalous traffic, including high query loads for varying periods of time, this event was large, noticeable via external monitoring systems, and fairly unique in nature, so this report is offered in the interests of transparency.”

The attack saturated network connections near some DNS root name server instances, however the system is said to have functioned as “designed, demonstrating overall robustness in the face of large-scale traffic floods observed at numerous DNS root name servers.”

The organization has advised use of Source Address Validation and BCP-38 wherever possible to reduce the ability to abuse networks to transmit spoofed source packets.

Update Dec. 12: A new story reports that some security experts believe the attack was even more severe than originally thought. They say “it was brought about by a so-called ‘zombie army’ botnet unwittingly installed on hundreds of millions of smartphones through an as yet unidentified app.”

Update Dec. 15: Verisign’s Perspective on Recent Root Server Attacks

By CircleID Reporter

CircleID’s internal staff reporting on news tips and developing stories. Do you have information the professional Internet community should be aware of? Contact us.

Visit Page

Filed Under

Comments

Proposal: Require BCP38 for anybody connecting to root servers Bill Stewart  –  Dec 10, 2015 6:05 AM

Ok, you can’t really do that, since people can still connect to the root servers through other networks, and Anycast means the root servers are spread around widely, but we can still wish.

Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

Related

Topics

Cybersecurity

Sponsored byVerisign

Brand Protection

Sponsored byCSC

Threat Intelligence

Sponsored byWhoisXML API

DNS

Sponsored byDNIB.com

New TLDs

Sponsored byRadix

Domain Names

Sponsored byVerisign

IPv4 Markets

Sponsored byIPv4.Global

NordVPN Promotion