DDoS Bazooka attack slows down Internet in Europe

“Bazooka ..’ ~ is a shoulder-held weapon consisting of a long metal smoothbore tube for firing armor-piercing rockets at short range.  It reportedly is named so after a crude wind instrument made of pipes. The bazooka consists of a hollow tube open at the breech.

Perhaps you might think of ‘googling’ on this and might find your computer not responding as fast as you want it to.  There are reports quoting security experts that the Internet may have been slowed by one of the largest cyber attacks ever seen, which targeted a European group that patrols the Web for spam. The attacks targeted Spamhaus, a Geneva-based volunteer group that publishes spam blacklists which are used by networks to filter out unwanted email, and led to cyberspace congestion which may have affected the overall Internet.  The attacks began last week, according to Spamhaus, after it placed on its blacklist the Dutch-based Web hosting site Cyberbunker, which claimed it was unfairly labeled as a haven for cybercrime and spam.

So the news is that the internet around the world has been slowed down in what security experts are describing as the biggest cyber-attack of its kind in history. There are apprehensions that this could have  an impact on popular services - and experts worry it could escalate to affect banking and email systems. Five national cyber-police-forces are investigating the attacks.

The Spamhaus Project is an international nonprofit organization whose mission is to track the Internet's spam operations and sources, to provide dependable realtime anti-spam protection for Internet networks, to work with Law Enforcement Agencies to identify and pursue spam gangs worldwide, and to lobby governments for effective anti-spam legislation. Founded in 1998, Spamhaus is based in Geneva, Switzerland and London, UK and is run by a dedicated team of 38 investigators and forensics specialists located in 10 countries. Spamhaus maintains a number of realtime spam-blocking databases ('DNSBLs') responsible for keeping back the vast majority of spam sent out on the Internet. The Spamhaus Block List ("SBL") Advisory is a database of IP addresses from which Spamhaus does not recommend the acceptance of electronic mail.

To filter out spam and keep unwanted content out, the group maintains a number of blocklists - a database of servers known to be being used for malicious purposes. Recently, Spamhaus blocked servers maintained by Cyberbunker, a Dutch web host which states it will host anything with the exception of child pornography or terrorism-related material.  Cyberbunker feels that Spamhaus was abusing its position, and should not be allowed to decide "what goes and does not go on the internet". Spamhaus has alleged that Cyberbunker, in cooperation with "criminal gangs" from Eastern Europe and Russia, is behind the attack.

It is stated that the attackers have used a tactic known as Distributed Denial of Service (DDoS), which floods the intended target with large amounts of traffic in an attempt to render it unreachable. In this case, Spamhaus's Domain Name System (DNS) servers were targeted - the infrastructure that joins domain names,  the website's numerical internet protocol address.  It is stated that such attack could keep the target completely away from the internet.

To understand it better, if you imagine a motorway, the spam attacks try and put more traffic on the way and clog up the entire system so that nothing moves. The attacks typically happened in intermittent bursts of high activity.  We need not be unduly worried as, as of now those in Europe are reportedly more sluggish ~ same analogy – when there is traffic jam in autobahn, those driving in Chennai or Delhi do not worry of their way…….

With regards – S. Sampathkumar

28^th Mar 2013.