Nationwide DDoS attacks on the .tr domain and Turkish services

NIC.tr, the registry run by Middle East Technical University that manages every domain under .tr, published a public announcement on 21 December 2015. It says a DDoS attack began on Monday 14 December 2015 against six .tr name servers at five separate points, in Turkey and abroad. It says the attack started as a DNS amplification attack and was organized by sources outside the country, using heavy traffic that included fake network traffic.

As the attack grew it filled the international links of the telecom operators that host the servers. NIC.tr says several 40 Gbps lines at upstream operators overflowed, at times reaching more than 200 Gbps, and that it was known as one of the heaviest attacks seen anywhere. RIPE, which hosted one name server abroad, said it had to shut that server down because of the traffic. NIC.tr says its other five servers stayed up.

BuzzFeed News reported on 18 December 2015 that the servers of NIC.tr had been attacked for nearly four days, with the five NIC.tr servers hit by an attack of 40 gigabits per second. Turkey’s National Response Center for Cyber Events closed external traffic to NIC.tr, which cut outside access to .tr websites and email. NIC.tr then worked with internet providers to spread the queries.

Al-Monitor reported on 29 December 2015 that the attacks began on 14 December and were still going on, and that government agencies, private entities and the three largest internet providers were hit. It says more than 400,000 websites under .tr had problems and that banks and credit card terminals could not process transactions on 25 December. It says the Ankara-based Network Information Center confirmed the attacks were DDoS attacks.

Step one: amplification

NIC.tr says the attack began as a DNS amplification attack. Heavy network traffic, including fake traffic, was sent toward the .tr name servers by sources outside Turkey, with the aim of stopping users from reaching the addresses behind .tr domains.

Step two: pressure on the links

Later the traffic filled the international connections of the telecom operators that run the networks hosting the servers. The operators asked their upstream providers for filters and attack prevention, which NIC.tr calls routine for this kind of attack.

The attackers’ plan, as NIC.tr read it

NIC.tr describes the strategy it saw from the first hours as two parts. First, stop the DNS servers and push the country into the dark. If that failed, create problems deeper in the network and look for other targets. It says the attackers did not reach the first goal in the first 36 hours and kept attacking in the following days.

Why the servers held

NIC.tr says the load on its DNS servers stayed very low and that there was no hardware or software shortfall. The pressure was on the network links, not on the servers. At the time of the announcement it ran 11 name servers, 3 of them abroad. Because of anycast on the foreign servers, those 11 served as more than 20 in practice.

What the .tr registry manager reported later

A presentation by the .tr ccTLD manager, dated 7 March 2016, describes the attack as basically a DNS (UDP) amplification attack: botnets sent spoofed query packets to open DNS resolvers and to authoritative DNS servers without rate limiting, amplified by 10 to 150 times by the victims. It says 25 percent of the victims were on Turkish IP addresses, that the attack targeted the 6 name servers, and that the registry web services were a secondary target.

It says the attack ran mainly between 09:00 and 17:00, with 185,000 queries per second per server, against 1,250 queries per second and 1.5 Mbps per server before the attack. It says the name servers were almost always up, and the reachability and delay problems came from overloaded links. It also lists observations: no ingress or egress filtering in subnets, and 8 percent of the name servers registered in the registry database were open resolvers.

Sources differ on size, effect and cause. Size: BuzzFeed News gives 40 gigabits per second for the NIC.tr servers on the first days, Al-Monitor gives 220 gigabits per second, and NIC.tr says several 40 Gbps lines overflowed and at times traffic passed 200 Gbps. Servers: BuzzFeed News says five NIC.tr servers were hit, NIC.tr says six servers at five points, and that a name server hosted abroad was shut by RIPE. Effect: NIC.tr says there was no very significant countrywide slowdown and that online banking worked, while Al-Monitor reports that banks and card terminals failed on 25 December and that more than 400,000 sites had problems.

Cause: BuzzFeed News (18 December 2015) says no group had formally claimed responsibility and that suspicion pointed to Russia after the downing of a Russian jet, and quotes a Turkish government engineer on this. Al-Monitor (29 December 2015) reports that Anonymous issued threats on 23 December against banks and government sites, saying Turkey supports Daesh. NIC.tr names no attacker and says only that sources outside the country organized the attack. No source gives a confirmed attribution.

NIC.tr says the traffic slowed some internet services in Turkey, such as e-mail exchange and the time websites take to open. It says the effect was not even: some parts of the network slowed down while others kept normal speed. It did not see heavy complaints about social media or online banking. It says it cannot answer how many people or organizations were affected, and that the data cannot show whether public or private targets were the focus.

Al-Monitor gives a larger picture: more than 400,000 websites with problems, the three largest internet providers hit, a fall in average internet speed, and banks and credit card terminals unable to process transactions on 25 December.

The registry manager's presentation says one ISP reported 220 Gbps of attack bandwidth, that there was no synchronized picture of the attack history, and that it might have been one of the largest DDoS attacks observed at the time. It says the attack went on for nearly 3 weeks and, towards the end, changed its target to the finance and government sectors.

RIPE NCC wrote on 15 December 2015 that its authoritative DNS services were in a severely degraded state during parts of Monday 14 December, because of an attack on one of the ccTLDs for which it hosts a secondary DNS service. The message does not name that ccTLD. It says normal services were restored at around 18:30 UTC, apart from the service for the attacked ccTLD.

The National Response Center for Cyber Events closed external traffic to NIC.tr, according to BuzzFeed News, and NIC.tr worked with internet providers to spread queries. Operators asked their upstream providers for filters and attack prevention.

NIC.tr says the only remedy against attacks made of fake traffic from abroad is protection at the main gateways and arteries where the country’s internet enters, that this protection was in place, and that operators would apply it again if the attack returned.

The sources opened link this event to no later law or policy, and report no arrests or court cases. The country page covers the legal framework adopted since.

The registry manager’s presentation lists the defense steps: widen the surface by adding name servers, analyze traffic to find drop rules, and adapt mitigation as the attackers changed their patterns. Afterwards it expanded the list of critical domain names, such as government and banks, from 100 to 600 to over 1,000, and for a time ran zone updates three times a day with manual inspection. RIPE NCC contacted its upstream peers for mitigation help and recommended Source Address Validation and BCP-38.