Arbor Security Blog

DNS Vulnerability; The Other Part of that Partial Disclosure

Danny McPherson, July 22, 2008 | 3 Comments

Just under two weeks ago, on July 8, a vulnerability disclosure was released warning of multiple DNS implementations being susceptible to yet another new DNS cache poisoning attack, but one professed to be far worse than previous attacks. Dan Kaminsky, in cooperation of with a large number of well-respected security and DNS experts, and […]

Read More

Georgia On My Mind - Political DDoS

Jose Nazario, July 20, 2008 | 5 Comments

The website for the President of Georgia, a former Soviet republic, has come under DDoS (hat tip: Shadowserver team). This attack appears to have a political motivation. One of the messages in the floods (HTTP, SYN, ICMP) reads “win+love+in+Rusia”. Tensions between Russia and Georgia appear to be running high lately.
While I am not positive what […]

Read More

Internet Effects of Last Week’s DNS Patching

Jose Nazario, July 14, 2008 | 2 Comments

We got curious to see if there was an effect from the Internet scale DNS patching going on. Our Internet statistics system suggests … no.

Internet-wide DNS traffic, 1 week
Those spikes? We are pretty sure those are massive DNS attacks.
In short, we’re not seeing a significant change in DNS traffic from before the patching to after […]

Read More

Internet Rebooted Over DNS Fixes

Jose Nazario, July 11, 2008 | 2 Comments

We’ve all been aflutter over the past few days, wild with speculation as to the attack in this vulnerability note: Multiple DNS implementations vulnerable to cache poisoning (via CERT/CC). Disclosed on Tuesday (and patched by Microsoft in MS08-037, patched by BIND, by a whole host of vendors) the attack can lead to cache poisoning. Here’s […]

Read More

Spain Wins Euro 2008, Comes under DDoS Attack

Jose Nazario, June 30, 2008 | No Comments

Spain went on to win Euro 2008, but after beating Russia last week 3-0, they came under a DDOS attack from a set of Black Energy botnets based in Argentina. The attacks lasted a few hours and didn’t seem to cause any substantial damage. There were no more attacks that we saw or identified following […]

Read More