DDos attack on web infrastructure continues on a massive scale

As we reported a few weeks ago, on the night on 30 November the worldwide web's domain name system (DNS) infrastructure was suddenly subjected to a massive DDoS attack, which peaked at a rate of 5m queries per second: a first attack lasted three hours and a second for one hour. In total, the web's backbone was hit by 50bn queries over this four hour period, ten times the previous historical high and fifty times the typical run-rate. Nominum, a cybersecurity firm, reports that these attacks on web infrastructure have continued during December and are now focussing on sub-domains and specific internet service providers. The DNS servers being attacked are specifically outside the USA, and the sheer scale and time period of the attacks suggest that its authors are a nation state. 

Attack Against DNS Root Servers

Has anyone been following the attack against the DNS root servers two weeks ago? Details.

I can’t precisely explain why, but this feels like someone testing an attack capability.

For defense: it’s long past time to implement source address validation in the DNS system.

Posted on December 15, 2015 at 12:19 AM • 41 Comments