It was considered the “largest ever” internet attack in 2002. This distributed denial of service attack hit seven of the 13 servers at the top of the internet’s domain name system hierarchy. Now, 20 years later, its origins remain mysterious, but its methods and size still make it stand out. It isn’t the largest by the numbers anymore, either, but it does show how far both attackers and defenders have progressed. Taking a look back, what can it tell us about cyberattacks today? 

Hitting 13 top-level internet domain servers

According to The Register on October 21, 2002, at 5 p.m., nine of the 13 servers at the top of the internet’s domain name system hierarchy were attacked. The cybercriminals successfully brought seven servers offline and caused two others to go offline repeatedly during the hour-long attack. Because the attack was on all 13 servers at the same time instead of one after another, the Internet Systems Consortium that managed the servers did not have any warning. So, the attack caused more widespread outages.

During the hour-long attack, the attackers flooded servers with packets in an Internet Control Message Protocol ping flood. Instead of 8 Mbps of traffic, the attack sent more than 10 times the usual amount to each server.

The archived version of the Internet Systems Consortium report revealed:

• Attack volume was about 50 to 100 Mbits/sec per root name server. That yielded a total attack volume of approximately 900 Mbits/sec
• Attack traffic contained ICMP, TCP SYN, fragmented TCP and UDP
• Attack source addresses were mostly randomized, chosen within netblocks that were mostly present in the routing table at the time of the attack.

Major attack did not affect users

Cybersecurity researchers often measure attacks today by end-user issues and business disruptions. But in this attack, neither happened. Technically, the servers never crashed, but instead slowed the processing of traffic. It’s possible that there was a delay of a few seconds in some queries. However, in general, the slight lag did not result in error pages for users.

Plus, the host resources were successfully over-provisioning. So, the servers completed all user queries. Some root name servers were unable to answer some valid queries. Interestingly, the response of the root servers also varied based on the location of the user. Some servers remained available in metro areas. Root Server company VeriSign Inc. responded quickly and brought the servers back online. Their quick response also kept users from noticing.

What was most disturbing about these root server attacks is that the attacker clearly wanted to block or shut down the internet as a whole.

No one claimed responsibility for the attack

As the days and weeks passed, no one claimed responsibility. Even 20 years later, the person or group responsible is still unknown. That’s pretty rare in today’s sophisticated cybersecurity world.

Phil Huggins, an expert with security consultancy firm @stake, said most web server traffic goes to secondary domain name servers instead of the 13 servers targeted in the attack. It would have taken four hours of constant attack to make a noticeable impact on general internet users.

“Either they didn’t know the time needed to knock out the root servers or they were up to something else,” said Huggins. “It may be that they were testing out their DDoS network.”

Huggins said that it was actually a relatively simple attack from a technical perspective, as a straight DDoS attack. However, Slater noted that the attacker had done their homework.

‘An army of drones’

People often ask if this type of attack could happen again. The most likely answer is no. Somewhat similar domain name service attacks have occurred, especially using redirection. After the 2002 attacks, the root server system was quickly upgraded with increased peering and transit connectivity as well as wide-area server mirroring. According to the Internet Systems Consortium, these changes prevent attacks from concentrating on network congestion points to take down the servers.

My favorite question to ask when researching is what we, as a cybersecurity community, learned from the attack. I found the best answer by Paul Vixie, chairman of the Internet Software Consortium, in the Register article. He said that the attack showed the importance of securing the end stations that forge the traffic.

“There’s an army of drones sitting out there on DSL lines…. There’s no security at the edge of the network,” said Vixie to The Register. “Anyone can send packets with pretty much any source address.”

The cybercriminals used a simple method and software found online for free to launch the attack. If they had continued the attack for several more hours, then it’s very possible that there would be no debate about whether it was the largest attack. The event would probably be more well-known, too. While the 2002 attack was the largest of its time, it wasn’t the most damaging thanks to the quick thinking of cybersecurity experts.