Ask HN: How did Dyn fail to fend off DDOS?

if you draw the line between attacks of the past through this one you see that the scale of DDoS attacks continues to get worse. It's all well and good to say that the enablers of the past learn and improve their products. The problem is continually the enablers of the future.

It's been said before but I will repeat it here; manufacturers have no reason to expend any resources on security until they are held liable for the damage they facilitate. We must make selling insecure devices a liability just like selling unsafe devices is in meatspace.

It's called PLAN (short for physical LAN). It doesn't need a managed switch, like VLAN, because you just use one switch for each network. Careful: Don't connect them.

> While Flashpoint has confirmed that Mirai botnets were used in the October 21, 2016 attack against Dyn, they were separate and distinct botnets from those used to execute the DDoS attacks against “Krebs on Security” and OVH.

So not quite.

> Dale Drew, chief security officer at Level 3, an internet service provider, found evidence that roughly 10 percent of all devices co-opted by Mirai were being used to attack Dyn’s servers. Just one week ago, Level 3 found that 493,000 devices had been infected with Mirai malware, nearly double the number infected last month.

http://www.nytimes.com/2016/10/22/business/internet-problems...

If they aren't significantly underestimating the number of devices participating in this attack, it paints an ugly picture of things to come. My understanding is these botnets are almost impossible to eradicate due to how fast/easy it is to re-compromise the devices, so traditional methods of taking out C2s do almost nothing. Bonus - Mirai source code is freely and easily available for skids to use now, so there's no single threat actor for attribution/retaliation/arrest/etc.

> US consumer law allows suing everybody in the supply chain

IIRC, US consumer law requires the consumer to be the victim. (IAAL/NY, but not practicing) This restriction is called privity – the exceptions to privity are narrow, and no exception comes to mind here.

In this case the primary victims, the online services, are third parties, with any consumer recourse blocked by privity.

These third parties arguably have a couple options, though. The first and perhaps most theoretically interesting is the "class defence", the procedural complement of a "class action", where a few people (the third party online services) can sue multitudes (owner-operators responsible for malicious devices on the Internet) in a single process. Were such a case brought forward, these consumers could sue the manufacturers for indemnity. While as a litigator this makes the most theoretical sense, and this procedure exists in at least one jurisdiction I know of, I have never seen it tested.

Arguably a better option would be for the third parties to sue the manufacturers for negligence, based on the obligation that the manufacturers have to the public.

Any litigation is fraught with uncertainty though, not least of which is having a member of the judicial bench who is capable of properly evaluating the facts (which is not to say they are not out there, but they remain rare).

Like most externalized costs, the recourses of affected individuals are slim and ineffective.

> If Homeland Security tells the Consumer Product Safety Commission this is a national safety issue, the CPSC can order a recall

Proper regulation is a better choice, IMHO, though I don't know what the best process might be.

I'm not too sure. I have heard that the attack also fixed the security vulnerability (changing the default root password) after installing the back door so other people cannot use it.

Although the source code is out there, those will not be able to control all those devices.