A squabble between a group fighting spam and a Dutch
company that hosts websites said to be sending spam has escalated into
one of the largest computer attacks on the Internet, causing widespread
congestion and jamming crucial infrastructure.
Millions
of ordinary Internet users have experienced delays in services or could
not reach a particular website for a short time.
However,
for the Internet engineers who run the global network, the problem is
more worrisome. The attacks are becoming increasingly powerful, and
computer security experts worry that if they continue to escalate,
people may not be able to reach basic Internet services, like e-mail and
online banking.
The dispute started when the
spam-fighting group, called Spamhaus, added the Dutch company
Cyberbunker to its blacklist, which is used by e-mail providers to weed
out spam.
Cyberbunker, named for its headquarters, a
five-story former Nato bunker, offers hosting services to any website
“except child porn and anything related to terrorism”, according to its
website.
A spokesman for Spamhaus, which is based in
Europe, said the attacks began March 19 but had not stopped the group
from distributing its blacklist.
Patrick Gilmore,
chief architect at Akamai Networks, a digital content provider, said the
attacks, which are generated by swarms of computers called botnets,
concentrate data streams that are larger than the Internet connections
of entire countries. He likened the technique, which uses a long-known
flaw in the Internet’s basic plumbing, to using a machine gun to spray
an entire crowd when the intent is to kill one person.
The
attacks were first mentioned publicly last week by Cloudflare, an
Internet security firm in Silicon Valley that was trying to defend
against the attacks and as a result became a target.
“These
things are essentially like nuclear bombs,” said Matthew Prince, chief
executive of Cloudflare. “It’s so easy to cause so much damage.”
The
so-called denial of service, or DDoS, attacks have reached previously
unknown magnitudes, growing to a data stream of 300 billion bits per
second. “It is a real number,” said Mr. Gilmore. “It is the largest
publicly announced DDoS attack in the history of the Internet.”
Spamhaus,
one of the most prominent groups tracking spammers on the Internet,
uses volunteers to identify spammers and has been described as a
vigilante group.
In the past, blacklisted sites have
retaliated against Spamhaus with denial-of-service attacks, in which
they flood Spamhaus with traffic requests from personal computers until
it falls offline. But in recent weeks, the attackers hit back with a far
more powerful strike that exploited Internet’s core infrastructure,
called the Domain Name System, or DNS.
That system
functions like a telephone switchboard for the Internet. It translates
the names of websites like Facebook.com or Google.com into a string of
numbers that the Internet’s underlying technology can understand.
Millions of computer servers around the world perform the actual
translation.
In the latest incident, attackers sent
messages, masquerading as ones coming from Spamhaus, to those machines,
which were then amplified drastically by the servers, causing torrents
of data to be aimed back at the Spamhaus computers.
When
Spamhaus requested aid from Cloudflare, the attackers began to focus
their digital ire on the companies that provide data connections for
both Spamhaus and Cloudflare.
Questioned about the
attacks, Sven Olaf Kamphuis, an Internet activist who said he was a
spokesman for the attackers, said in an online message, “We are aware
that this is one of the largest DDoS attacks the world had publicly
seen.”
Mr. Kamphuis said Cyberbunker was retaliating
against Spamhaus for “abusing their influence”. “Nobody ever deputised
Spamhaus to determine what goes and does not go on the Internet,” said
Mr. Kamphuis. “They worked themselves into that position by pretending
to fight spam.”
A typical denial of service attack
tends to affect only a small number of networks. But in the case of a
Domain Name System flood attack, data packets are aimed at the victim
from servers all over the world. Such attacks cannot easily be stopped,
computer security experts say, because those servers cannot be shut off
without halting the Internet.
