IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Expert warns of attacks on DNS servers

Attacks that failed to take down internet root servers could be more successful against organisations.

The kind of attacks that hit the internet's root servers in February, could be played out in an organisation's infrastructure with devastating effects.

In February, hackers took aim at the root servers of the internet in a distributed denial of service attack that lasted hours. The offensive was thought to be one of the biggest seen in four years.

But Cricket Liu, vice president of Architecture at network appliance vendor Infoblox and an expert on DNS, said that the attack was doomed to failure because 11 of the 13 root servers ran in Anycast groups that prevented them from being swamped with information.

Servers in an Anycast configuration run different servers in different locations but anyone on the internet will only see the nearest box to them. It is used to provide redundancy and load sharing to specific types of network services on the internet.

He said that it would be extremely difficult to hackers to completely overcome a particular set of servers.

"You can't simultaneously attack all 40 servers in the group because you can't see all 40 servers at the same time. They all have the same IP address," said Liu. "You'd have to attack all 40 from 40 different points around the world to be anywhere near successful. That would be a pretty big task for any hacking organisation."

But he warned that companies running DNS servers within their own infrastructure could see the name servers by successfully attacked in the same way.

He said that many organisations had their name servers all on the same subnet and hackers would find the task of taking them offline a trivial one with a dozen broadband-connected boxes.

"In places like South Korea there is a huge penetration of broadband and a lot of bandwidth available to computers. A box with 20Mbps bandwidth to the internet can generate a lot of traffic," said Liu.

He said that companies should consider using Anycast on name servers to prevent them from being a victim of a DoS attack from hackers. But Liu warned that there was a certain amount of fear that prevents organisation from deploying Anycast as they perceived it to be too complicated to roll out.

"In some cases they haven't even heard of it. Some people give you a blank look when you bring up the topic," he said.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Most Popular

Salaries for the least popular programming languages surge as much as 44%
Development

Salaries for the least popular programming languages surge as much as 44%

23 Jun 2022
The UK's best cities for tech workers in 2022
Business strategy

The UK's best cities for tech workers in 2022

24 Jun 2022
LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022