DDoS Attack Against Dyn Managed DNS • Hacker News Board

Re: DDoS Attack Against Dyn Managed DNS

#211

Post by toomuchtodo » Fri, Oct 21, 2016, 4:51 PM UTC

MaxfordAndSons wrote: post #190

nickbauman wrote: post #143

Earlier quoted context omitted.

Prediction: A massive, sustained attack will occur on key US Internet infra on election night in an attempt to debase the US election results.

This is terrifying. Thankfully I don't think much actual voting infra is network reliant. But it could probably delay the results from being finalized for days, and allow Trump to spew further allegations of rigging. Though if they targeted electric grid, water, and public transport, starting early in the day and choosing the regions by their populations political leaning, it could easily have an effect on the result…

You don't need to target voting infrastructure. You target media infrastructure (DNS, streaming, web media) in order to either reduce or shift voter turnout. A candidate ahead in a battleground state? You stomp on media reporting to ensure their opponent's voters aren't dissuaded from heading to the polls.

Control the message, and through that the actual votes cast.

Re: DDoS Attack Against Dyn Managed DNS

#212

Post by emmet » Fri, Oct 21, 2016, 4:51 PM UTC

Is it just me or are these kind of attacks becoming way more frequent recently? This kind of widespread outage seems so new, but again, that might just be me.

Re: DDoS Attack Against Dyn Managed DNS

#213

Post by komali2 » Fri, Oct 21, 2016, 4:51 PM UTC

colanderman wrote: post #67

jtmarmon wrote: post #4

I'm updating a list of confirmed outages as I see them here https://news.ycombinator.com/item?id=12759520 So far twitter, etsy, soundcloud, spotify, github, pagerduty...crazy that this can even happen

I'm surprised; I would have thought such large sites would use more than one DNS provider? I mean: $ host -t NS twitter.com twitter.com name server ns4.p34.dynect.net. twitter.com name server ns3.p34.dynect.net. twitter.com name server ns2.p34.dynect.net. twitter.com name server ns1.p34.dynect.net. I would have expected at least one of those to be somewhere else. What is the reason they would not have a backup provid…

I know a lot about some things, but almost nothing about networking, so excuse me if this is a really dumb question but - would your physical location determine what hosts you returned from that query? Like if you were in Asia would you get different ones back?

Re: DDoS Attack Against Dyn Managed DNS

#214

Post by bhauer » Fri, Oct 21, 2016, 4:53 PM UTC

Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a last-known-good resolution (perhaps with a flag). This behavior would continue until an administrator-specified and potentially quite generous maximum TTL expires, after which nodes would finally see resolution failing outright.

Ideally, then, the local resolvers of the nodes and/or the UIs of applications could detect the last-known-good flag on resolution and present a UI to users ("DNS authority for this domain is unresponsive; you are visiting a last-known-good IP provided by a resolution from 8 hours ago."). But that would be a nicety, and not strictly necessary.

Is there a spectacular downside to doing so? Since the last-known-good resolution would only be used if a TTL-specified refresh failed, I don't see much downside.

Re: DDoS Attack Against Dyn Managed DNS

#215

Post by sschueller » Fri, Oct 21, 2016, 4:53 PM UTC

chromaton wrote: post #187

I can't currently get resolution on www.paypal.com. $ dig @8.8.8.8 www.paypal.com ; > DiG 9.8.1-P1 > @8.8.8.8 www.paypal.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER ;; QUESTION SECTION: ;www.paypal.com. IN A ;; Query time: 29 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Fri Oct 21 12:35:33 2016 ;; MSG SIZE rcvd: 32

Interesting. 8.8.8.8 is not able to provide me with a record. However ns1.p57.dynect.net and ns3.p57.dynect.net give an answer where as ns2.p57.dynect.net and ns4.p57.dynect.net hang.

Shouldn't 8.8.8.8 query another name server if one fails to respond or takes too long?

EDIT: Is there an inherent flaw in how secondary records are queried? And as bhauer mentioned, is there a possibility to fall back to last known record?

Re: DDoS Attack Against Dyn Managed DNS

#216

Post by dellsystem » Fri, Oct 21, 2016, 4:54 PM UTC

MaxfordAndSons wrote: post #190

nickbauman wrote: post #143

Earlier quoted context omitted.

Prediction: A massive, sustained attack will occur on key US Internet infra on election night in an attempt to debase the US election results.

This is terrifying. Thankfully I don't think much actual voting infra is network reliant. But it could probably delay the results from being finalized for days, and allow Trump to spew further allegations of rigging. Though if they targeted electric grid, water, and public transport, starting early in the day and choosing the regions by their populations political leaning, it could easily have an effect on the result…

That is a terrifying thought. Sounds like the plot of a potential Neal Stephenson novel.

Re: DDoS Attack Against Dyn Managed DNS

#217

Post by zeronzr » Fri, Oct 21, 2016, 4:55 PM UTC

chromaton wrote: post #187

I can't currently get resolution on www.paypal.com. $ dig @8.8.8.8 www.paypal.com ; > DiG 9.8.1-P1 > @8.8.8.8 www.paypal.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER ;; QUESTION SECTION: ;www.paypal.com. IN A ;; Query time: 29 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Fri Oct 21 12:35:33 2016 ;; MSG SIZE rcvd: 32

https://www.whatsmydns.net/#A/art.nflximg.net

http://status.aws.amazon.com/

Seems like it is affecting another regions now.

Re: DDoS Attack Against Dyn Managed DNS

#218

Post by devy » Fri, Oct 21, 2016, 4:55 PM UTC

Is Zendesk being affected? Their status page is reporting external DNS provider is having DNS issue [1] and most of their sites are being affected.

[1] https://status.zendesk.com/

Re: DDoS Attack Against Dyn Managed DNS

#219

Post by myfinalaccount » Fri, Oct 21, 2016, 4:56 PM UTC

toomuchtodo wrote: post #211

MaxfordAndSons wrote: post #190

Earlier quoted context omitted.

This is terrifying. Thankfully I don't think much actual voting infra is network reliant. But it could probably delay the results from being finalized for days, and allow Trump to spew further allegations of rigging. Though if they targeted electric grid, water, and public transport, starting early in the day and choosing the regions by their populations political leaning, it could easily have an effect on the result…

You don't need to target voting infrastructure. You target media infrastructure (DNS, streaming, web media) in order to either reduce or shift voter turnout. A candidate ahead in a battleground state? You stomp on media reporting to ensure their opponent's voters aren't dissuaded from heading to the polls. Control the message, and through that the actual votes cast.

I dont even think you need to necessarily shift voter turn out. I think you need to sow enough confusion in order to cast the results into doubt.

Re: DDoS Attack Against Dyn Managed DNS

#220

Post by darkmouth » Fri, Oct 21, 2016, 4:57 PM UTC

and its down again