Michael Witt, deputy director of US-CERT's cybersecurity section, who spoke at a panel discussion at the RSA Conference last week, said the DNS root server attack was targeted at three root servers, known as G, L and M. "G is the military's top-level domain," Witt said. According to information at the US-CERT Web site, L operates on behalf of ICANN, and M is dedicated to the WIDE Project.

"The attacks didn't impact the root-level servers," Witt said. "They continued to do their job. The Department of Defense had no impact toward degradation on their network."

Witt said mitigation of the attack was carried out with the help of the North American Network Operators Group. "We worked closely with those in the organization to minimize that attack," he said.

While these three root servers were disrupted by the botnet attack, 10 other root servers worked fine. Overall, the Internet's service suffered little disruption, and few corporate users even noticed that the attacks were happening.

"This attack was maybe one-tenth of the size of earlier attacks that we've seen on the DNS infrastructure," McPherson says. "It wasn't really that large, and it started tapering off quickly. More importantly, the user experience was not that far degraded."

This was the first major attack against the root servers since 2002, when all 13 root servers were targeted in a more severe distributed denial-of-service (DOS) attack.

"The oddest thing about this attack is that it happened at all," Bellovin says. "We haven't had any major pure vandalism attacks in the last few years. The energy in the hacking world has shifted to a profit motive. Most of the DDOS attacks we see are for extortion. Sports gambling sites are especially affected."

Howard Schmidt, former White House cybersecurity adviser and now president and CEO of Issaquah, Washington-based R&H Security Consulting, said the fact that the attack on the DNS root servers this week had no perceivable impact on the public indicates how resilient the underlying system is. "But we shouldn't let our guard down," Schmidt says.

Schmidt recalled how the massive attack in February 2002, when he was White House cyber-security adviser, also had no perceivable public impact but it did draw attention to the potential for grave consequences in loss of the Internet.

"We didn't find out who was doing it in 2002," Schmidt says. "Until we catch the people doing it, we'll never know their motivation."