Stay-at-Home Orders Coincide With Massive DNS Surge

A variety of sites saw as much as seven times the number of domain requests in late March and early April, suggesting attackers attempted massive denial-of-service attacks.

An analysis of domain-name system (DNS) requests for 316 major sites across five industries shows a massive step up in traffic volume starting the last week of March — the time when many countries and states issued stay-at-home orders due to the pandemic — and continuing through April, according to Farsight Security, a provider of DNS intelligence.
The company, which collects anonymized DNS records and indexes the relationships in those resources, investigated the daily counts of the number of times a request generated a miss — that is, a request for the address of a domain, such as darkreading.com, was not present in the domain-name servers store of addresses. Farsight found that the level of misses grew by four to seven times at the end of March and the beginning of April, creating an increase in traffic volume.
Overall, the increase in traffic is somewhat of a mystery, says Paul Vixie, CEO of Farsight Security. A variety of scenarios could explain a rise in DNS traffic — such as misconfiguration or a change in behavior as people started working from home — but the most likely is a massive denial-of-service (DoS) attack, he says.
We are not in the attribution business, but it looks like someone out there was interested in making some sites harder to reach, Vixie says.
The data shows a significant and unmistakable shift in what is happening on the Internet across five industries, including news, streaming services, travel and transportation, retail, and higher education. Media site Forbes, for example, had DNS queries that rose by more than a factor of five after April 1, from an initial level of about 61,000 queries per day. Other news sites — such as AP News, CNN, and Fox News — showed a similar pattern, as did some transportation sites, such as Allegiant Airlines and Delta Airlines.
Having run the data, what were seeing is more traffic in most cases, with some sites exhibiting spikes consistent with DDoS (distributed denial-of-service) attacks exploiting those sites,
the report states
.
Yet, without further research and data from outside sources, it is unclear what is happening, Vixie says.
While the most likely scenario is a set of significant DoS attacks, the group characteristics of user behavior might have changed. Or the step up in traffic could be a result of workers leaving a subset of companies into which Farsight may not have good visibility and working on home networks on which the company has better data. There are other possibilities as well, Vixie says.
I have all kinds of half-baked theories, but I decided, rather than wait until we knew what has caused this, we would put it out there, so that other people who might have seen something at the same times could cross-correlate with us, he says.
Farsight Securitys technology looks for DNS cache misses, which occur when the domain name of the site that a user wants to visit is not in the local DNS servers cache. Because most Internet users visit a limited number of sites, DNS caches help to efficiently handle popular requests.
If the users query is one for a name that hasnt been seen and cached recently, the recursive resolver must then chase down the information the user requires, the report states. Thats called a cache miss.
The company does not see all of the cache misses worldwide, but gathers data on a significant enough number that it can find trends in the data.
The 95-page report includes plots of every site whose DNS queries the company analyzed, with a significant number showing the step pattern. While there are differences in terms of the magnitude of the change — with some universities also seeing a subsequent decline, creating a hill pattern — overall the patterns across industries and sites is quite consistent, Vixie says.
I think this warrants further explanation, he says. People in the IT world should look at this and say, Huh, I wonder if this appears in my traffic graphs. And then they can ask whether there is some botnet that is contributing to this traffic.
Related Content
Learning from the Honeypot: A Researcher and a Duplicitous Docker Image
Vixie: The Unintended Consequences of Internet Privacy Efforts
Purported Brute-Force Attack Aims at Linksys Routers as More People Work Remotely
Companies Are Failing to Deploy Key Solution for Email Security
How Cybersecurity Incident Response Programs Work (and Why Some Dont)
Latest Security News & Commentary about COVID-19

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that really bad day in cybersecurity. Click for
more information and to register
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Stay-at-Home Orders Coincide With Massive DNS Surge