Traffic attack compromised the .cn top-level domain

In the early morning of August 25, China Internet Network Information Center managed and operated countries. The CN top-level domain name system suffered a large-scale denial of service attack. According to the Bureau of Communication Security of the Ministry of Industry and Information Technology, the attack used botnets. The CN top-level domain name system continuously initiated a large number of requests for querying the domain name of a game's private service website, and the peak traffic increased by nearly 1,000 times compared with the normal one. The Internet export bandwidth of the cn top-level domain name system is seriously congested in the short term.

Dr. Shi Xiaohong, a 360 security expert, said that the hackers’ tactics are not new, they are simply traffic attacks. He believes that two kinds of reasons lead to more and more such attacks: first, tool automation is becoming more and more obvious; secondly, bandwidth is getting more and more abundant, and attackers even attack the server by directly renting the server. It can be attributed to the lower and lower technical and capital costs of such attacks.

Dr. Shi Xiaohong analyzed that the criminals were targeting. CN domain names are mainly flooded by UDP traffic attacks, DNS resolution requests for denial of service attacks, and may be mixed with DNS amplification attacks. The ultimate goal is to make the network bandwidth exceed the service bandwidth, and the number of service requests exceeds the design threshold. , so as to achieve the purpose of DNS resolution service crashes.

Can this large-scale attack defend? Dr. Shi Xiaohong believes that defense can be achieved through three means. First, there are sufficient DNS servers with sufficient bandwidth and performance. Second, the deployment of security devices, such as traffic cleaning, needs to be performed. In conjunction with interworking between operators, packets with forged source addresses or packets from a single point must be discovered on a large scale. Attacks are blocked. Third, the reason why there are cyber attacks is because the cost of launching is getting lower and lower, and there are few cases that are handled through technical orientation. Therefore, it is necessary to strengthen the position and put the case together to severely punish cybercrime.

However, for a large number of small and medium-sized websites and SMEs, it is unrealistic to spend a lot of money to purchase website protection bandwidth. As the threshold of traffic attacks is getting lower and lower, a special black industry chain has been formed. Employers can purchase an attack service, and the service is also divided into grades, including multiple packages that are divided by attack time, flow rate, or snoring. The price will be different. In general, peer competition is the biggest cause of a website being attacked, but being attacked after it is attacked is also an important reason for such incidents.

According to reports, in order to help the site to resist large-scale traffic attacks, 360 has previously launched a free website protection product - 360 website guards, using 360 existing bandwidth of hundreds of gigabytes to help webmasters free website protection, there are now tens of thousands Home website is open for use.