Two DNS servers hit by denial-of-service attacks

28.03.2006
In the second attack of its kind in the past few days, Domain Name System (DNS) servers at Network Solutions Inc. were hit by a denial-of-service attack Monday, resulting in a brief performance degradation for customers, according to the company.

The attacks, which started at around 2:20 p.m. EST, were targeted at the company's WorldNIC name servers and resulted in a service degradation for about 25 minutes before the server was restored to normal, a spokeswoman for the company said.

A Network Solutions spokeswoman declined to say what measures the Herndon, Va.-based company took to mitigate the attack.

Over the weekend, Joker.com, a domain-name registrar in Germany, was hit with a similar distributed denial of service (DDoS) that disrupted service to customers.

In an advisory posted on its site, Joker said that 'massive' attacks against its DNS servers had affected the DNS resolution of Joker.com as well as domains belonging to its customers.

Beyond apologizing to customers, the company offered no other details on the attack except to say that it was 'working hard' to find a permanent solution to the problem.

According to Netcraft Ltd., a Bath, England-based Internet performance monitoring company, more than 550,000 domains are registered with Joker. 'Any of those domains that use Joker's DNS servers are likely to be affected,' Netcraft said in a note posted on its Web site.

A DNS server is used to look up and translate domain names such as Computerworld.com from plain text to numeric Internet Protocol addresses.

Attacks against DNS servers, though relatively rare until now, are considered especially critical because of their potential to bring down large numbers of Web sites.

In October 2002, all 13 of the Internet's root DNS servers were victims of a massive DDoS attack that raised concerns about the Internet's infrastructure but did little damage otherwise.

Just a week ago, VeriSign Inc. said that about 1,500 organizations worldwide had been attacked earlier this year by unknown hackers who employed botnets and DNS servers to launch a particularly devastating form of denial of service.

In the attacks described by VeriSign, DNS servers were used to amplify the affects of denial-of-service attacks and were not really targets themselves. But security experts said they believe that DNS servers could just as easily become targets.