How Vulnerable?

Could a single company's compromised network be used to crash the entire Internet? That's the thesis explored in a Wired News article recounting the exploits of the hacker group Fluffy Bunny, which at one point contemplated using Akamai's content distribution system to launch a denial-of-service attack on the Internet's domain name root servers.

Fluffy Bunny became well known in security circles for its humorous use of a pink stuffed bunny in its taunting defacements of high-profile targets including Exodus, The SANS Institute and VA Networks. That list apparently also includes Akamai, according to Wired, which reviewed 100 megabytes of Akamai source code, private encryption keys, and internal company documents provided by "a source close to Fluffy Bunny."

Akamai tells Wired that the company learned of the intrusion last year and took "appropriate action," and that the files shared with Wired pose no ongoing threat to the company's network or clients.

Could the plot have succeeded? Both the DNS system and Akamai's distributed network are attractive targets for the hacker community. Some analysts remain skeptical.

If nothing else, the wider circulation of the concept behind the attack will itself raise the bar for Internet security professionals. Once an attack concept becomes known, a bold exploit attempt usually follows.