Detecting Globally Malicious Events with Local Records: A Case Study

On or about August 25 2013, the name servers supporting the country code Top Level Domain (ccTLD) “.cn” were attacked and brought offline[2, 6–8, 11]. As local DNS caches expired, this attack eventually affected the internet traffic of most users attempting to reach Chinese websites because the authoritative DNS servers for those sites ceased working. While the attack itself was widely reported in tech circles, there are very few technical details publicly available about the attack. In this paper, we follow a series of deductive hypotheses: each leading closer to the actual malicious actors and eventually revealing the nature of the attack on the Chinese DNS to be a dictionary based NXDOMAIN attack.