INTERNET DDOS ATTACK BRINGS DOWN MORE THAN 400,000 WEBSITES

Dot TK, the registry for .TK Internet Domain Names, announced today that on April 1st 2003 all three Root Servers were taken down because of a DDOS attack.

Amsterdam, Netherlands -- April 2nd 2003. Dot TK, the registry for .TK Internet Domain Names, announced today that on April 1st 2003 all three Root Servers were taken down because of a DDOS attack.

Dot TK is the Root Server operator for Tokelau, a group of islands in the South Pacific. A Root Server operator manages a country code top-level domain. Just as the United Kingdom has .UK, Tokelau has the .TK extension. If someone wants to visit a .TK website, his computer first contacts one of the three Root Servers of Dot TK. One of the Root Servers is located in San Francisco, and the other two are in Amsterdam, the Netherlands. There are more than 400,000 domains registered with Dot TK. Websites bearing the .TK extension and those sites are visited more than 40 times per second by people all around the world. The revenue of Dot TK adds 10% to the Gross Domestic Product of the group of islands, which is home to 1500 people. Dot TK is a US company and has a Dutch subsidiary in Amsterdam, the Netherlands.

DDOS attacks are attacks on computer networks whereby packets of information are sent through the Internet. The Internet is based on the TCP/IP protocol, a system for communicating with packets. If, for example, a web page is accessed by a computer user, the page, including text and pictures, are divided into small packets (small envelopes), which are sent over a switched network: the Internet. The normal size of a packet is 1500 bytes (1500 characters). The sender and the recipient of packets are known; as identifiers are sent with each transmission of a packet. Connections on the Internet have a maximum capacity of packets per second, which they can tolerate. Fiber optic connections are able to handle the highest volume. A DDOS attack, or Distributed Denial of Service Attack occurs when millions of packets are transmitted at the same time, from different sources, to one or more particular destinations. This system overload causes the connections to fail because they cannot tolerate the amount of packets.

Computer users, everywhere in the world, are using more and more ADSL and cable modem connections in order to have dedicated connections to the Internet. Because of the use of popular music download software, computers, most of which use the Microsoft Windows operating system, are becoming more and more insecure. Hackers mount their attack by infiltrating these home computers. They install, remotely, a computer program 'DDOS Windows Client, which can be used in a DDOS attack (see above). This sets in motion the simultaneous attack of one or more particular destinations, by thousands of infiltrated computers. The attack results in the failure of connections.

On April 1st 2003 Dot TK received an attack on all three of its Root Servers. The upstream providers have jointly received more then 1 gbps (gigabit per second) of packet streams. One upstream provider mentioned it has never received such an immense attack before.

Dot TKs upstream Internet providers had no option but to 'blackhole the Root Servers of Dot TK from the Internet. This action resulted in the immediate non-availability of all 400,000 Dot TK websites, which use the .TK extension including the Dot TK registry website www.dot.tk.

I consider DDOS attacks on Root Servers a terrorist crime of the 21st century. Root Servers form the basis of the Internet. When a Root Server is attacked, forcing it to be taken down, every domain name on the server is rendered inaccessible", says Joost Zuurbier, General Manager of the Dot TK registry, Due to these attacks Dot TK must now provision for very high bandwidth networks, which may effect the financial aid to the people in Tokelau."

Together with ICANN, the Internet Corporation for Assigned Names and Numbers, which deals with policies of Root Servers on the Internet, Dot TK has found a solution, which will bring the Root Servers of Dot TK back online in the early morning of April 2nd 2003.

In the mean time, the attack continues. The Federal Bureau of Investigation (FBI) in the United States is thoroughly investigating the attack, IP address by IP address, because one of the Root Servers is on US soil.

The attack has also been reported to the appropriate Dutch police authorities.

DOT TK: DIVIDING DOMAINS DIFFERENTLY
Amsterdam -- Netherlands / San Francisco - USA
Cathy Josey
Tel: +1 954-791-0281
Fax: +1 954-584-7208