Akamai blames ‘global DNS attack’ for disruptions

A global attack on the domain name system (DNS) caused disruptions affecting customers of Internet hosting company Akamai Technologies, including search engine sites, said Jeff Young, an Akamai spokesman.

Akamai disputed early reports that the disruption in service to the sites, including yahoo.com, google.com and microsoft.com, was specific to its network of DNS servers, which translate user-friendly domain names into numeric IP addresses. Instead, the problem on Akamai’s network was part of a “large scale international attack on the Internet infrastructure,” Young said. However, at least one Web performance monitoring company said it has no evidence of a wider attack.

The attack, which Young declined to describe, started shortly before 9 a.m. Eastern Daylight Time. The attack affected Akamai’s Internet name service and a “small number” of the company’s customers, primarily search engines that use Akamai to manage traffic to their Web sites, he said.

“There was an intermittent service issue. It was not an outage on the Akamai network. The name service continued to operate throughout the incident,” he said. “We have no information that leads us to believe the attack was directed specifically at Akamai.”

However, others aren’t so sure.

Systems at Web performance monitoring company Keynote Systems noted a decrease in performance at leading Web sites starting at 8:30 a.m. EDT and said that a number of sites, including those for Microsoft, Yahoo, Google and Symantec were only at 20% capacity for as much as an hour Tuesday, according to Lloyd Taylor, vice president of technology at Keynote.

The companies affected appear to be Akamai customers. Keynote could not rule out a broader attack, but said that the company lacks any evidence to support such. However, traffic to other companies on Keynote’s Business 40 Internet Performance Index, which includes the corporate Web sites of Cisco, 3Com and Charles Schwab were not slowed, he said.

“There’s nothing that has shown up as performance issues yet,” Taylor said.

Akamai could not provide details about the nature of the attack, where it came from or organizations other than its customers that were affected. However, networks around the world experienced the attack, Young said.

The interruptions at Akamai have the fingerprint of a denial-of-service attack, in which hundreds or thousands of machines work together to flood a specific Internet address or addresses with malicious traffic, slowing it down, Taylor said.

“You saw things get bad suddenly, then get better slowly,” he said.

In contrast, service is typically restored quickly after hardware or software failures, once the cause of the failure is determined, he said.

In the meantime, most of the affected customers have switched and are using their own DNS servers or those hosted by other companies, Taylor said. However, the Akamai DNS service appeared to be up and running, and Google was still using it to resolve requests to their site Tuesday, he said.