DDoS attack takes down internet shopping sites

By siliconindia   |   Thursday, 24 December 2009, 19:30 IST   |    15 Comments
Printer Print Email Email
Bangalore: An attack planned for DNS service providers like Amazon, Wal-Mart, and Expedia took many Internet shopping sites offline. Neustar, the company that provides DNS services under the UltraDNS brand name, confirmed an attack took place, taking out sites or rendering them extremely sluggish for about an hour, according to CNET. A representative who answered the customer support line said the attacks were directed against Neustar facilities in Palo Alto and San Jose, California, and Allen Goldberg, Vice President of Corporate Communications for Neustar, confirmed, "Our alarms went off." Goldberg said the company received a disproportionately high number of queries coming into the system, and analyzed it as an attack. Neustar deployed "a mitigation response" within minutes of the attack and brought matters under control within an hour. The response limited the problems to Northern California, he said. Dozens of smaller sites that rely upon Amazon for web-hosting services were also taken down by the attack. Amazon's S3 and EC2 services were affected by the problems, according to Jeff Barr, Amazon's Lead Web Evangelist, who retweeted a report to that effect without clarification and confirmed it in later tweets. This is how an attack like this happens. Web sites need DNS providers to translate the character-based URLs that people can remember to the IP addresses that Web sites actually use to list themselves on the Internet. When a DNS provider is overwhelmed with malicious requests for IP addresses, the system can overload and prevent legitimate users from reaching their destinations. UltraDNS suffered a similar attack earlier this year, which took out Amazon, Salesforce.com, and other sites. Goldberg described Wednesday's attack as smaller than that one. Goldberg declined to comment on specific customers affected by the outage, and said Neustar had not yet determined the source of the attack. "This was wider than just UltraDNS. It's difficult to tell at this point how much is a DDoS attack and how much is collateral damage from the attack that is being felt in other ways. There were routing problems at some major European exchanges at the same time that caused major Internet service providers' routers to encounter a higher load and pass fewer packets," said Bill Woodcock, Research Director at Packet Clearing House, which operates domain name servers and supports Internet exchange points around the globe.