International group The Spamhaus Project is being subjected to a huge cyber attack, with the organisation claiming that it’s a result of their placement of Dutch company CyberBunker on an anti-spam blacklist.
The cyber attack is so large that it’s affecting average users by slowing down online services such as Netflix, with some experts warning that it could escalate further to negatively impact online banking and email service providers. Patrick Gilmore of Akamai Networks told the New York Times that the DDoS (distributed denial of service) attack being waged on Spamhaus “is the largest publicly announced DDoS attack in the history of the Internet.”
According to Spamhaus’ website, the group’s mission “is to track the Internet's spam operations and sources, to provide dependable realtime anti-spam protection for Internet networks, to work with Law Enforcement Agencies to identify and pursue spam gangs worldwide, and to lobby governments for effective anti-spam legislation”. One of their main tasks is maintaining various ‘block lists’. Working with service providers, the lists are implemented to help discourage companies, servers and hosts from engaging in spamming activities.
CyberBunker, meanwhile, are a Dutch hosting company with their headquarters based in an old military bunker in the Netherlands. The company proclaims that they will host any online content other than child pornography and material related to terrorism. They further suggest that they have fended off various attempts by authorities to raid their headquarters.
The current situation occurred after Spamhaus placed CyberBunker on their blacklist, accusing the Dutch firm of hosting spam. Spamhaus has since implicated CyberBunker and Eastern European criminal groups in this new DDoS attack as an act of retaliation against Spamhaus. An Internet security firm called CloudFlare was also hit by attacks when they tried to help Spamhaus defend against the DDoS.
Attacking the foundations of the Internet
The new attack is based on exploiting the DNS (Domain Name System) foundations of Internet technology. To simplify the concept, the DNS structure of the Internet allows familiar URLs to be translated into numbered IP addresses, helping Internet users locate and connect to other websites and computers.
While many DDoS attacks are based on directly attacking a single company or organisation’s website through automated ‘bots’, a DNS based attack aims at the very foundations of the Internet. The DNS servers cannot simply be ‘turned off’ as they’re a central part of how the Internet as we know it operates. The importance of DNS technology to the very structure of the Internet helps explain how the current attack is impacting other services not directly involved in the current dispute.
The New York Times writes that DNS security weaknesses have “long been known by Internet security specialists, but it has only recently been exploited in a way that threatens the Internet infrastructure”.
With the attack generating 300 billion bits of data per second – that’s a lot – the DDoS has yet to overwhelm the world’s largest servers but is putting a burden on vital equipment, increasing the threat of escalation to many major Internet services. And it’s all because of those nonsense messages in your email spam folder!
