NSA-Servers at key places on the Internet backbone can react faster than other websites can. By exploiting that speed difference, these servers can impersonate a visited website to the target before the legitimate website can respond, thereby tricking the target's browser to visit a Foxacid server.
why this attack was a denial of service attack rather than a compromise of the affected devices: by simply flooding, the Speedport router becomes slower in accepting TCP conns and finally accepts none -> restart helped temporarily