Google Knocked Offline Saturday, But Not A Hack (so the title says, but read the article)
May 9, 2005
http://informationweek.com/story/showArticle.jhtml?articleID=163100367
Google was off-line for a short time Saturday evening due to an undisclosed DNS problem.
The search service was unavailable from 6:45 p.m. to 7:00 p.m. EDT, Saturday, May 7
Krane denied that the problem was caused by a hack or other attack, and only said it was related to the DNS, or Domain Name System. Some security firms have recently warned of DNS cache poisoning attacks as a way for phishers to make their identity thievery less detectable.
Talk of a hack was fueled by users who reported being diverted to SoGoSearch.com during the Google outage. Additional investigation, however, found that that site had registered the domain com.net, and when some browsers were unable to resolve google.com, they tried google.com.net.
Other Google services, such as Gmail, were also offline for a time on Saturday.
Widespread Internet Attack Cripples Computers with Spyware
Experts say at least 20,000 PCs already have been affected. Is your company next?
April 21, 2005
An insidious new Internet attack that hijacks a victim's Internet connection and stealthily installs a barrage of adware and spyware is targeting businesses and organizations across the United States.
The two-pronged attack, which has been ongoing since early March, has afflicted an estimated 20,000 computers, according to Ken Dunham, director of malicious code at IDefense, a Virginia-based Internet security company.
It starts with an assault known as DNS poisoning: Domain name system servers, which guide Internet traffic, are fooled into directing anyone heading to any .com Web site--for example, www.cnn.com or www.americanexpress.com--to a malicious Web site that the attackers control. That Web site then surreptitiously installs a wide range of adware and spyware on the victim's computer.
Companies suffer from the attack in a number of ways. First, the Internet connection for anyone using the poisoned DNS server--often the entire company in the case of smaller businesses--is completely disrupted. All Web traffic and e-mail trying to go to any .com site gets hijacked for as long as the DNS server remains compromised.
Even after the DNS server is fixed, the company has to clean the adware and spyware from any affected computers, an onerous task that can keep IT people like David Parsons, who supports about 7000 people in his help-desk job at a Boston hospital, extremely busy. Parsons says his hospital was "slammed for about two days straight" by the DNS poisoning attacks starting March 29.
Dunham conservatively estimates that 3000 DNS servers at a range of U.S. companies, including at least two with more than 8000 employees, were compromised over the past month.