Porn Sites use malicious Denial of Service attacks to try and shut one another down
One well known streaming pornography site maliciously took the other down today by sending a new form of a Distributed Distributed Denial of Service attack its way. The relatively new variant of DDoS took the site and ISP down for hours.
This new security hole found in DNS records is known as a DNS Amplification Variation and has gathered speed within the past month when a few ISP’s reported receiving attacks.
It’s a type of DDoS attack which attempts to make a computing resource unavailable to users by sending relatively small packets of data and tricking the DNS server to send large packets. The new form does not rely on so-called “recursive queries” and sends a very short query simply asking for the nameservers listed on the root domain. It replies with a huge list of records and instead of sending it back to the client, the attacker spoofs the nameserver into sending it back to itself jamming the system.
Another element that makes this attack different from previous DoS attacks is that it’s initiated by a relatively small army of computers, or botnets. A botnet is a software robot that runs automatically in the background after malicious software has been installed. There are millions of botnets on compromised computers all over the world that are used to carry out DDoS attacks and spread spyware, adware and malware.
ISPrime, the host for one of the porn sites reported large traffic spikes of about 5GB/s for almost an entire day before they could identify the attack.
This attack is stirring up a lot of talk amongst security experts because of worry that this king of attack could be used on much more high-profile large-scale targets.
Secure Works has a created a Technical Analysis of the DNS Amplification Variation Used in Recent DDoS Attacks.
Norton AntiVirus 2009 - 2-yr Protection
