July 21, 2022 By Jennifer Gregory 3 min read

It was considered the “largest ever” internet attack in 2002. This distributed denial of service attack hit seven of the 13 servers at the top of the internet’s domain name system hierarchy. Now, 20 years later, its origins remain mysterious, but its methods and size still make it stand out. It isn’t the largest by the numbers anymore, either, but it does show how far both attackers and defenders have progressed. Taking a look back, what can it tell us about cyberattacks today? 

Hitting 13 top-level internet domain servers

According to The Register on October 21, 2002, at 5 p.m., nine of the 13 servers at the top of the internet’s domain name system hierarchy were attacked. The cybercriminals successfully brought seven servers offline and caused two others to go offline repeatedly during the hour-long attack. Because the attack was on all 13 servers at the same time instead of one after another, the Internet Systems Consortium that managed the servers did not have any warning. So, the attack caused more widespread outages.

During the hour-long attack, the attackers flooded servers with packets in an Internet Control Message Protocol ping flood. Instead of 8 Mbps of traffic, the attack sent more than 10 times the usual amount to each server.

The archived version of the Internet Systems Consortium report revealed:

  • Attack volume was about 50 to 100 Mbits/sec per root name server. That yielded a total attack volume of approximately 900 Mbits/sec
  • Attack traffic contained ICMP, TCP SYN, fragmented TCP and UDP
  • Attack source addresses were mostly randomized, chosen within netblocks that were mostly present in the routing table at the time of the attack.

Major attack did not affect users

Cybersecurity researchers often measure attacks today by end-user issues and business disruptions. But in this attack, neither happened. Technically, the servers never crashed, but instead slowed the processing of traffic. It’s possible that there was a delay of a few seconds in some queries. However, in general, the slight lag did not result in error pages for users.

Plus, the host resources were successfully over-provisioning. So, the servers completed all user queries. Some root name servers were unable to answer some valid queries. Interestingly, the response of the root servers also varied based on the location of the user. Some servers remained available in metro areas. Root Server company VeriSign Inc. responded quickly and brought the servers back online. Their quick response also kept users from noticing.

What was most disturbing about these root server attacks is that the attacker clearly wanted to block or shut down the internet as a whole.

No one claimed responsibility for the attack

As the days and weeks passed, no one claimed responsibility. Even 20 years later, the person or group responsible is still unknown. That’s pretty rare in today’s sophisticated cybersecurity world.

Phil Huggins, an expert with security consultancy firm @stake, said most web server traffic goes to secondary domain name servers instead of the 13 servers targeted in the attack. It would have taken four hours of constant attack to make a noticeable impact on general internet users.

“Either they didn’t know the time needed to knock out the root servers or they were up to something else,” said Huggins. “It may be that they were testing out their DDoS network.”

Huggins said that it was actually a relatively simple attack from a technical perspective, as a straight DDoS attack. However, Slater noted that the attacker had done their homework.

‘An army of drones’

People often ask if this type of attack could happen again. The most likely answer is no. Somewhat similar domain name service attacks have occurred, especially using redirection. After the 2002 attacks, the root server system was quickly upgraded with increased peering and transit connectivity as well as wide-area server mirroring. According to the Internet Systems Consortium, these changes prevent attacks from concentrating on network congestion points to take down the servers.

My favorite question to ask when researching is what we, as a cybersecurity community, learned from the attack. I found the best answer by Paul Vixie, chairman of the Internet Software Consortium, in the Register article. He said that the attack showed the importance of securing the end stations that forge the traffic.

“There’s an army of drones sitting out there on DSL lines…. There’s no security at the edge of the network,” said Vixie to The Register. “Anyone can send packets with pretty much any source address.”

The cybercriminals used a simple method and software found online for free to launch the attack. If they had continued the attack for several more hours, then it’s very possible that there would be no debate about whether it was the largest attack. The event would probably be more well-known, too. While the 2002 attack was the largest of its time, it wasn’t the most damaging thanks to the quick thinking of cybersecurity experts.

More from Risk Management

Working in the security clearance world: How security clearances impact jobs

2 min read - We recently published an article about the importance of security clearances for roles across various sectors, particularly those associated with national security and defense.But obtaining a clearance is only part of the journey. Maintaining and potentially expanding your clearance over time requires continued diligence and adherence to stringent guidelines.This brief explainer discusses the duration of security clearances, the recurring processes involved in maintaining them and possibilities for expansion, as well as the economic benefits of these credentialed positions.Duration of security…

Remote access risks on the rise with CVE-2024-1708 and CVE-2024-1709

4 min read - On February 19, ConnectWise reported two vulnerabilities in its ScreenConnect product, CVE-2024-1708 and 1709. The first is an authentication bypass vulnerability, and the second is a path traversal vulnerability. Both made it possible for attackers to bypass authentication processes and execute remote code.While ConnectWise initially reported that the vulnerabilities had proof-of-concept but hadn’t been spotted in the wild, reports from customers quickly made it clear that hackers were actively exploring both flaws. As a result, the company created patches for…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today