This story was written by Keith Dawson for the Media Unspun email newsletter and is Copyright 2002 by Keith Dawson.
M E D I A   U N S P U N
Internet Attacked! Film at 11
2002-10-24

The Internet was attacked at about 5 p.m. Eastern time on Monday. Network operators noticed immediately and took steps to mitigate any damage. The press noticed about 24 hours later. The Washington Post's David McGuire and Brian Krebs seem to have been the first mainstream reporters to write about the incident, a "distributed denial of service" (DDoS) attack aimed at the 13 machines at the heart of the Net's naming system.

No other outlet that we reviewed tried to give the Post much competition for the thoroughness of its probing; many simply called the same sources the Post had cited. The Post stayed ahead of the story, this morning reporting that the first attack had been followed five or six hours later by a second sortie aimed at a different part of the Net's infrastructure.

CNET's reporter interviewed Paul Mockapetris, one of the Internet's pioneers and the inventor of the Domain Name System, whose root servers were the target of Monday's first attack. According to CNET, Mockapetris said that "compared to the 300 or so records that each root server contains, a future target that administrators should worry about is the three million or so records held by the .com DNS servers." These were in fact among the targets of the second attack, as reported by the Post. (InternetNews also spoke with Mockapetris but misspelled his name.)

Several outlets led with the angle of FBI and/or White House involvement in investigating the attacks. Good luck with that. As the BBC pointed out, DDoS attacks are relatively simple to mount after a bad guy rounds up a stable of "slave" machines to do the dirty work; "numerous free packages" are available for the roundup, the BBC reported. (Whew, good thing their authors don't charge for them.) The Post's followup story today explained how difficult it it so trace the actual locations of the slave machines once a DDoS attack is launched.

The BBC put some perspective on the occurrence of DDoS attacks, quoting a Web monitoring source who guesstimated that 4,000 such attacks are launched every week, though most are not so precisely targeted at the Net's crucial infrastructure.

Among the most amusing accounts of the attack was one carried in the Inquirer (no, not THAT Inquirer), a British Web site aimed at the IT profession. The story's first three words should tip savvy readers to the outlet's slant on tech news: "The wonderous Interweb withstood an almost catastrophic DDoS attack ..." (There is no such animal as the Interweb). We mention this source only to bring to your attention this spinoff from The Register that seems determined to outdo its progenitor in outrageousness and raw sarcastic attitude. In other words, the Inquirer has it has its tongue in its cheek, but some might say it has its head in some other orifice. - Keith Dawson

Attack On Internet Called Largest Ever (10/22)
http://www.washingtonpost.com/wp-dyn/articles/A828-2002Oct22.html

More Than One 'Net Attack Occurred Monday (10/24)
http://www.washingtonpost.com/wp-dyn/articles/A6894-2002Oct23.html

Net attack flops, but threat persists
http://news.com.com/2100-1001-963095.html

Dealing With Massive Attack: DNS Protection
http://www.internetnews.com/dev-news/article.php/1487331

FBI probes attack on net
http://news.bbc.co.uk/1/hi/technology/2352667.stm

Internet almost brought to its knees!
http://www.theinquirer.net/?article=5884

FBI investigating assault on Internet
http://www.bayarea.com/mld/mercurynews/business/4356781.htm

Net backbone withstands major attack
http://www.infoworld.com/articles/hn/xml/02/10/23/021023hnattack.xml

Internet's foundations shaken by attack
http://www.newscientist.com/news/news.jsp?id=ns99992963