Akamai Dns Outage

FYI…from the Internet Storm Center:

- http://isc.sans.org/diary.php?date=2004-06-15
Updated June 15th 2004 16:25 UTC
"Starting at around 8:30 am EDT (12:30 UTC), a number of sources started to report a widespread Akamai DNS issue. Large web sites, which use Akamai for its DNS service, did no longer resolve. Affected sites were Yahoo, Google, Microsoft, Fedex, Xerox, Apple and likely many others. At this time (10:30 am EDT), some affected domains removed the Akamai DNS servers and are reachable again using their own DNS servers. Typically, the domain itself (e.g. 'google.com') still resolved, but popular hostnames, like 'www.google.com' did not resolve. As a result, the web site was no longer reachable. The effect appears to be world wide. Some of the Akamai servers do respond to pings, but do not respond to DNS queries…Posts to the NANOG mailing list regarding this issue:
- http://www.merit.edu/mail.archives/nanog/msg05267.html …"

- http://www.theregister.com/2004/06/15/akamai_goes_postal/
"…Because a huge number of websites run through the Akamai site - including the world's four biggest, Yahoo.com, MSN.com, Google.com and Microsoft.com - when Akamai went down, so did they. Akamai is the world's biggest content hoster, claiming to carry 15 per cent of the Net's traffic…"

lol.. thats kinda like telling everyone that there's a tornado coming… while their cleaning up after its past

FYI…from the Internet Storm Center:

Akamai/Internet DNS Problems (Updated)
- http://isc.sans.org/diary.php?date=2004-06-15
Updated June 15th 2004 21:48 UTC
"…The problems seem to be attributable to a DDoS attack on Akamai's DNS servers, though we do not presently have the information to make a definitive assessment. According to the Akamai spokesperson, the problem was not limited to Akamai. He attributed the outage to an attack on the Internet infrastructure on a larger scale. We do not currently know of any sites that were affected by the attack without using Akamai's services…"

- http://www.reuters.com/newsArticle.jhtml?t…storyID=5430450
Jun 15, 2004 05:04 PM ET
"…Keynote, which counts Akamai as a customer, said that disruption was the result of some kind of attack, although they could not speculate who was responsible, or how it was launched. "We can speculate that it was probably due to some kind of coordinated attack on the DNS infrastructure that Akamai hosts," said Keynote analyst Roopak Pitel. "We are reasonably confident that it wasn't a problem internal to Akamai."

>>> http://www.internetpulse.com/

- http://story.news.yahoo.com/news?tmpl=stor…43635_2004jun15
"…Computer security experts and law enforcement authorities said that it is often extremely difficult to find out who is responsible for denial-of-service attacks. In October 2002, a denial-of-service attack disabled most of the 13 "root servers" that provide the primary roadmap for almost all Internet communications…"

FYI…

Akamai Attack Reveals Increased Sophistication
- http://www.computerworld.com/printthis/200…4,93977,00.html
JUNE 21, 2004
"An attack last week against Akamai Technologies Inc. demonstrated the disruption of key Web site activity that a well-placed assault on the Internet's Domain Name System can cause…The question of what went wrong at Akamai is important because of the nature of the attack, security experts said. The DNS is a critical component of the Internet because it maps Web names to IP addresses. The fact that the attackers were successful in finding these systems and then compromising them at a company that specializes in protecting the DNS infrastructure is another key concern…Some security experts, however, said a DDoS attack is unlikely to have been the cause of the problem simply because of the amount of bandwidth an attacker would have needed to overwhelm an operation such as Akamai's…"DNS is an attractive target because so many things rely on it, from the Web to e-mail to VoIP call routing," said Paul Mockapetris, inventor of the DNS and chairman of IP address management vendor Nominum Inc. in Redwood City, Calif…"

Other DNS problems:

- http://secunia.com/advisories/11888/

Symantec Gateway Security Products DNS Cache Poisoning Vulnerability
- http://www.sarc.com/avcenter/security/Cont…2004.06.21.html
SYM04-010 June 21, 2004
"…Symantec resolved a DNS cache poisoning vulnerability that was reported to impact the Symantec Gateway Security products…Under specific conditions and configurations, incorrect or false DNS records could be inserted into the DNS cache tables. It would then be possible that legitimate DNS requests would return incorrect responses…Symantec released a hotfix to address this issue that provides additional authentication and validation checks for each response directed to DNSd. Symantec recommends customers apply the appropriate hotfix for their affected product versions immediately to protect against this type of threat. Product specific hotfixes are available via the Symantec Enterprise Support site http://www.symantec.com/techsupp …"