House Energy and Commerce Subcommittee on Communications, Technology, and the Internet Hearing

"Often, the security industry, through hard work, coordination, knowledge and frequently, pure luck, are able to mitigate the effects before end users notice them. In most cases, these attacks never come to public notice. However, just a few minutes of effort with Google, searching for the terms "DNS and DDoS", and "cache poisoning", and "keystroke logging" will bring thousands of links to reports of successful breaches of Internet defenses. I'll focus on some events that have occurred or have been identified publicly in the last month.

In the first attack, on April 1st, 2009, Register.com, one of the major Internet domain name registrars, was attacked by the use of a DNS DDoS. In this attack, the attackers caused tens of thousands of compromised computers to flood the DNS or directory servers of the victim with bogus DNS requests, effectively rendering the directory servers unusable. In this particular case, hundreds of thousands of organizations became unreachable because Register.com provided the DNS service for their domains. This attack lasted a number of hours, but the effects lingered for a few days.

A second event occurred on April 12th that is far more insidious for average Internet users. The DNS servers of a large Brazilian ISP, Virtua, were compromised and their cache, or their local temporarily stored domain name and address directory, was "poisoned". The entry for one of Brazil's major banks, Bradesco, was modified by re-directing users to a fake website that was an exact copy of the Bradesco site, but was controlled by cybercriminals. This poisoned entry remained in place for five hours before Virtua and Bradesco noticed the problem and corrected it. According to an official statement from Bradesco, approximately "only 1% of their customers" were affected and potentially re-directed to this malicious site. Unfortunately, 1% of their customers are almost 150,000 individuals and this represents potentially huge monetary losses

Similar cache poisoning events have been occurring for years, and the only complete defense is the implementation of the DNSSEC protocol. However, absent significant effort and support, this solution is unlikely to be available to the general public until 2011 at the earliest."

Read full article

Source: “House Energy and Commerce Subcommittee on Communications, Technology, and the Internet Hearing”, TMCnews, Retrieved on 05/05/2009 from tmcnet.com/usubmit/2009/05/04/4162903.htm