DDoS Attack Against Dyn Managed DNS • Hacker News Board

Re: DDoS Attack Against Dyn Managed DNS

#141

Post by mugsie » Fri, Oct 21, 2016, 2:28 PM UTC

pyvpx wrote: post #119

alberts00 wrote: post #102

Earlier quoted context omitted.

Route53 doesn't allow using it as slave DNS. https://forums.aws.amazon.com/thread.jspa?threadID=56011

more accurately, they don't support the common standard methodologies for transferring zone data between primary and secondary name servers (like NOTIFY, AXFR, etc). there is nothing stopping you from having Route53 and $others as NS records for your domains. You just have to make sure they stay consistent. Apparently from the linked discussion, there are people offering scripts and services to do just that.

Keeping Serial numbers in sync can be basically impossible.

Re: DDoS Attack Against Dyn Managed DNS

#142

Post by blantonl » Fri, Oct 21, 2016, 2:31 PM UTC

redm wrote: post #51

sly010 wrote: post #44

I am confused. Are so many big websites using Dyn, or does Dyn have some special role in the DNS chain in the US?

They sell premium services, have a large sales team, and are very aggressive. I get emails from them weekly discussing millisecond savings of their DNS solutions and the value increase in customers and sales. Squeaky wheels get grease and their sales team squeaks a lot.

Boy, you aren't kidding about an aggressive sales team. They are relentless.

Ironically, a quick search of my Gmail mailbox came up with this gem in the subject line from Dyn.

"Did you know the average cost of a single DDoS outage is $882K?"

Re: DDoS Attack Against Dyn Managed DNS

#143

Post by nickbauman » Fri, Oct 21, 2016, 2:35 PM UTC

scrollaway wrote: post #18

Relevant (or at least a-propos) post by Bruce Schneier, from a month ago: "Someone Is Learning How to Take Down the Internet" https://www.schneier.com/blog/archives/2016/09/someone_is_le... Edit: And to be clear: I don't mean to imply there's any connection :)

Prediction: A massive, sustained attack will occur on key US Internet infra on election night in an attempt to debase the US election results.

Re: DDoS Attack Against Dyn Managed DNS

#144

Post by Raphmedia » Fri, Oct 21, 2016, 2:36 PM UTC

foobarbecue wrote: post #131

According to Fortune, Hacker News "reported" on the incident. Are we journalists now? "Popular tech site Hacker News reported many other sites were affected including Etsy, Spotify, Github, Soundcloud, and Heroku." -- http://fortune.com/2016/10/21/internet-outages/

No but we are a hivemind of smart individuals that correctly upvote important information and downvote irrelevant information. Most of the time, you can be sure that the top HN listings are going to be relevant.

Re: DDoS Attack Against Dyn Managed DNS

#145

Post by razster » Fri, Oct 21, 2016, 2:38 PM UTC

lanna wrote: post #117

lanna wrote: post #104

Earlier quoted context omitted.

This is what you can do to restore your GitHub access: grep github ~/.ssh/known_hosts sudo vim /etc/hosts sudo killall -HUP mDNSResponder ping github.com

Why am I being downvoted for providing useful information? I don't understand HN...

May not be HN doing the downvotes my friend.

Re: DDoS Attack Against Dyn Managed DNS

#146

Post by metaverse » Fri, Oct 21, 2016, 2:40 PM UTC

While my app isn't resolved using DYN, we are relying on APIs on our EC2 backend that use their DNS. Is there a Linux DNS caching server that will serve from a local cache primarily, and do lookups in the background instead to update the local cache? During the period DYN was down, it would've continued severing from the local cache and retried the background lookups, keeping my app up. I can also see it improving performance as my servers currently do lookups to the EC2 DNS on each http request...

Re: DDoS Attack Against Dyn Managed DNS

#147

Post by melvinram » Fri, Oct 21, 2016, 2:40 PM UTC

foobarbecue wrote: post #131

According to Fortune, Hacker News "reported" on the incident. Are we journalists now? "Popular tech site Hacker News reported many other sites were affected including Etsy, Spotify, Github, Soundcloud, and Heroku." -- http://fortune.com/2016/10/21/internet-outages/

I wonder if they used "Hacker News" as the source on that because it contains the word "hacker" and they wanted to say "oh, hackers read this site"... as in "the blackhat, break into stuff, steal your money, deface your website" folks.

Re: DDoS Attack Against Dyn Managed DNS

#148

Post by toast0 » Fri, Oct 21, 2016, 2:44 PM UTC

afshinmeh wrote: post #74

jssjr wrote: post #68

I'm a GitHub employee and want to let everyone know we're aware of the problems this incident is causing and are actively working to mitigate the impact. "A global event is affecting an upstream DNS provider. GitHub services may be intermittently available at this time." is the content from our latest status update on Twitter ( https://twitter.com/githubstatus/status/789452827269664769 ). Reposted here since some peo…

Just being curious, why don't you use different DNS servers?

(I'm not Github, but I work for a Dyn customer) Using multiple DNS providers has technical and organizational issues.

From a technical perspective, if you're doing fancy DNS things like geo targetting, round robin though more A records than you'll return to a query, or healtchecks to fail out ips from your rotations, using multiple providers means they're likely to be out of sync, especially if the provider capabilities don't match. That may not be terrible, because some resolvers are going to cache DNS answers for way longer than the TTL and you have to deal with that anyway. You'll also have to think about what to do when an update applied successfully to one provider, but the second provider failed to apply the update.

From an organizational perspective, most enterprise DNS costs a bunch of money, with volume discounts, so paying for two services, each at half the volume, is going to be significantly more expensive than just one. And you have to deal with two enterprise sales teams bugging you to try their other products, asking for testimonials, etc, bleh.

Also, the enterprise DNS I shopped with all claimed they ran multiple distinct clusters, so they should be covered for software risks that come from shipping the same broken software to all servers and having them all fall over at the same time.

Re: DDoS Attack Against Dyn Managed DNS

#149

Post by rdtsc » Fri, Oct 21, 2016, 2:45 PM UTC

AsyncAwait wrote: post #123

curiousgal wrote: post #31

Earlier quoted context omitted.

>We don't know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses. Why not the USA?

The usual thinking goes something like; well, the US created the internet so why would they want to take it down? Yes, NSA spies and all that, but they need the internet up to do that and also as bad as NSA is, it's nowhere near as bad as China or Russia where they ... (ranges from censorship to eating babies alive)

> The usual thinking goes something like; well, the US created the internet so why would they want to take it down?

To pin it on someone else?

"17 Intelligence agencies told me Russia hacked our DNC thing" (Clinton).

So maybe it is now "Oh look they took down the whole internet as well".

Re: DDoS Attack Against Dyn Managed DNS

#150

Post by nixgeek » Fri, Oct 21, 2016, 2:45 PM UTC

metaverse wrote: post #146

While my app isn't resolved using DYN, we are relying on APIs on our EC2 backend that use their DNS. Is there a Linux DNS caching server that will serve from a local cache primarily, and do lookups in the background instead to update the local cache? During the period DYN was down, it would've continued severing from the local cache and retried the background lookups, keeping my app up. I can also see it improving pe…

If you're in us-east-1 then you potentially do actually rely on Dyn even for the amazonaws.com instance hostnames.

https://gist.github.com/agh/4e20df0d2d3bfa189477569b77f72e24