Internet Withstands Zombie AssaultInternet Withstands Zombie Assault

Do you know what your computer was doing last week?

That's the question many security pros would like to put to users. On Feb. 6, the 13 root servers that manage worldwide Internet traffic were hit by a denial-of-service attack that nearly took down three of them. The attackers probably used millions of zombie computers, a "botnet" army that enlists the desktops and laptops of unknowing users worldwide.

The roots are central machines on the Domain Name System. They're akin to directory assistance for the Internet, says Zully Ramzan, a researcher at Symantec Security Response. If the roots had been taken down for a significant amount of time, it would have crippled Internet traffic. That wasn't close to happening on Feb. 6.

Still, it was the fiercest attack on the 13 roots since an October 2002 assault that took down many of them. The servers didn't go down this time because of the significant increase in computing power in the last four years and because the roots' defenses have been heavily fortified.

While they're referred to as the 13 root servers, most of them front many computers. "The strength of those systems has to do with the number of machines behind them," says Alan Paller, director of research at the SANS Institute. "People don't know about this infrastructure, so it's hard to attack."

The three servers most affected in last week's attack probably were standalone, analysts say. They did go into a brownout state, in which their response times were slowed.

In an unrelated move, VeriSign, the company that manages the infrastructure for the .com and .net DNS, said last week that it plans to expand the capacity of its global Internet infrastructure tenfold by 2010. It will increase both bandwidth and the number of locations in which its servers are based by a factor of 10 to keep ahead of exploding traffic and improve network diversity and security.