DDoS on Domain Registrar

miller60 writes "Netcraft is reporting that 'domain registrar Joker.com says its nameservers have been hit with a massive DDoS attack, causing outages for customers. More than 550,000 domains are registered with Joker, meaning the outages could be widely felt. It's not clear why the DDoS is succeeding, as most registrars have implemented sturdy DDoS protection since the attack on the root nameserver system back in 2002.' Some security experts have warned in recent weeks about DNS recursion attacks as previously discussed here on Slashdot, which can amplify the power of attacks launched from botnets."

Not that surprising!

[Anonymous Coward]

Anyone that has had to deal with DDoS attacks against their networks lately should know that it isn't terribly uncommon to see DDoS attacks that saturate over 1Gbps of bandwidth. With a sizeable botnet, even if the registrar has two gigabit uplinks, it wouldn't be too difficult for an attacker to knock them compleetly offline. Take whatever DDoS prevention methods you want, if your upstream links are saturated... you're boned.

Can still switch DNS servers

[pixelbeat]

Their website is still functional enough to allow
one to change the DNS servers away from [abc].ns.joker.com
I did this last for my domain.

Re:Considering...

[arivanov]

Can't really say anything about that, but a quick investigation of their DNS shows that it is not geographically distributed (RFC3258). OK, I do not have the tools to do it properly, but it does not look like.

On top of that they do not look like they have their own connectivity to peering points in EU.

So frankly, they look like they are ripe for the picking. It is utterly trivial to run a domain registrar out of several diverse locations using RFC 3258. A registrar that is not doing it is in clear need of a cluebat on the head several times. I hope that this DDOS finally delivers it.

Old news

[rueger]

The DDOS attack was actually middle of last week. Joker.com is now operating fine. Timeliness is important when one posts stuff like this, or at least enough editorial sense to edit for the past tense and to check out what is being said.

I've used joker.com for years. It's significantly cheaper than Network Solutions and other US registrars and I've never had a problem.