Anonymous plans to take down the 13 root DNS servers that power the Internet?

There's somewhere around 240 root server sites each consisting of multiple physical servers, just served up on 13 IP's.

Given that many of these sites are colocated at interchanges and with providers with tons of multi gigabit links, they have quite a challenge...

Ripe last year had an incident where they reported a fivefold increase in queries to the K-root without any operational problems, for example. They successfully handled close to 70,000 queries per second at one point.

I'll be surprised if they manage to even have a noticeable effect.

> A: Now you are stretching it. How likely is that? The diversity in the system will prevent that from happening. But let's treat it as a hypothetical case: In that hypothetical case the Internet will not suddenly grind to a halt. If absolutely nothing is done to correct the situation every hour about 2% of all queries will not be answered, 2% at the end of the first hour, 4% at the end of the second hour and so forth until 48h after the root name servers stop answering queries no DNS names can be resolved anymore. However it is even more hypothetical to assume that nothing will be done to correct this hypothetical situation.

> Even in the hypothetically hypothetical case that the root name server operators would do nothing to correct the situation, the IANA, TLD operators, ISPs and others would have the motivation and the means to take corrective action.

> Again: this is very hypothetical. DNS failures outside the root name servers are much more likely. Name service for the vast majority of top-level domains is very much less redundant than that of the root name servers. Whole top-level domains and major corporations have been unreachable for significant amounts of time because of DNS failures. Name service for the root zone has always been available.

http://www.isoc.org/briefings/020/

DNS is a distributed hierarchy for serving requests. It's designed to be fault-tolerant because if every name resolution (google.com->8.8.8.8) performed by a browser had to reach 13 servers in the world, we'd still be using gopher and newsgroups instead of the web.

DNS is distributed, hierarchical, redundant, and cached all over the place as much as possible. Even my laptop caches DNS queries until a reboot. Even if a DNS cache misses (which is infrequent), it goes to the nameserver hosting the zone, which isn't a root name server.

Bottom line, it's probably just a joke designed to get some attention and to experiment and see what actually does happen if you hit those servers.

[0] http://www.icann.org/en/announcements/factsheet-dns-attack-0...

In fact, the only people I can see this affecting (in the unlikely event it does happen) are people setting up new sites.

It's far more likely that a bored teenager somewhere wrote this.

Also, if we were to assume that Anonymous does actually exist in some semblance, they would never ship a notice like this with gramatical errors. They're small, but obvious.

I'll eat my foot if they actually manage to make a noticeable affect on the DNS servers anyway.

What does taking down the internet have to do with that mission statement?

http://c.root-servers.org/october21.txt

Although the report states "2.4. There are no known reports of end-user visible error conditions during, and as a result of, this attack.", it's not entirely accurate. I personally experienced issues with name resolution shortly after the attack started, and had no idea what the cause was until afterward. If I recall correctly, my name resolution was handled by Qwest, as they were the T1 transit provider I was using at the time.

The principle is simple; a flaw that uses forged UDP packets is to be used to trigger a rush of DNS queries all redirected and reflected to those 13 IPs. The flaw is as follow; since the UDP protocol allows it, we can change the source IP of the sender to our target, thus spoofing the source of the DNS query.

The DNS server will then respond to that query by sending the answer to the spoofed IP. Since the answer is always bigger than the query, the DNS answers will then flood the target ip. It is called an amplified because we can use small packets to generate large traffic. It is called reflective because we will not send the queries to the root name servers, instead, we will use a list of known vulnerable DNS servers which will attack the root servers for us.

Also if I don't if this is the best ways to protest, I support the cause.

You would need to have complete control over the infrastructure of something equivalent to an Amazon, Microsoft, or Google to take down the whole DNS system - and it would require a permanently sustained and constantly evolving attack.

I'm always amazed at the vast under-estimation of what would be faced in a real attempt of that sort. First, let's assume they made some progress and actually started harming the stability of the global Internet. 1) the number of interested parties (from hackers to corporations) that would immediately respond to the counter, in numerous ways, would resolve the issue in an extraordinarily short amount of time and 2) watch you don't have the US special forces black bagging you within 24 hours if you're involved, no matter where you're at on earth. The corporate money interest in the Internet being up is at least a hundred billion dollars per day. They will kill you over that, or at the least put you in an off grid terrorist prison.

Big talk, like with Facebook, but nothing will happen.

Can we kind of bury this