Malicious DNS DDoS Attack at Tucows

Recursive DNS used to amplify server requests

On May 3, 2006, the Tucows network suffered a massive Distributed Denial of Service (DDoS) attack. The power of the attack was amplified by using a weakness in recursive name servers. During the attack, two out of three upstream providers to the company's collocation facility were knocked out. Because of this, the security experts at Tucows thought it was a network failure.

For more than four hours no effort was made to stop the attack, until the upstream providers managed to recover. After the upstream providers came online, it was clear that what caused the outage was a severe DDoS amplification attack.

The target of the attack was a website that used the managed DNS service from Tucows. DNS administrators worked with the upstream providers to stop the attack. The options were limited by the fact that Tucows was not the registrar of the attacked website's domain and they needed to act with caution. The staff worked during the night to restore the full functionality of the servers at Tucows.

Source: Wired

About Secure64 Software Corporation
Secure64® is a software developer providing highly secure DNS and server applications with built-in denial-of-service protection features to help ensure your Internet-dependent business is always accessible. Based on the genuinely secure SourceT® microOS, Secure64 DNS remains highly available during network attacks and is immune to compromise from rootkits and malware.

DNS Security News Index