Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

Post reply on HN
Print view View original

301–310 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#301

Post by pbarnes_1 »

raemike123 wrote: post #176

USA cyber defenses are NOT up to the task of defending our critical electronic infrastructure. Letting every company that runs critical services decide their own security posture is not scalable and has left us vulnerable. While no one is getting hurt, we are taking cyber missile hits from our enemies and eventually the damage will be worse. Other countries with more central controls will be less vulnerable than we a…

Zzzz.

The USG is not responsible for a corporation that runs DNS services.

Re: DDoS Attack Against Dyn Managed DNS

#302

Post by rdtsc »

mzw_mzw wrote: post #163
rdtsc wrote: post #149

Earlier quoted context omitted.

> The usual thinking goes something like; well, the US created the internet so why would they want to take it down? To pin it on someone else? "17 Intelligence agencies told me Russia hacked our DNC thing" (Clinton). So maybe it is now "Oh look they took down the whole internet as well".

>To pin it on someone else? That's... kind of conspiratorial thinking? Would you cut off your own hand so you could blame it on someone else?

As someone else pointed out this is a classic false flag operation. Look up Gleiwitz incident and Operation Northwood. It can be very effective. With good opsec and anonymity online it can be even easier.

> kind of conspiratorial thinking?

You mean like lizard aliens infiltrating our planet? -No. But in the realm of "shooting down of passenger and military planes, sinking a U.S. ship in the vicinity of Cuba, burning crops, sinking a boat filled with Cuban refugees, attacks by alleged Cuban infiltrators inside the United States, and harassment of U.S. aircraft and shipping and the destruction of aerial drones by aircraft disguised as Cuban MiGs", yes.

It was mostly a reply to "US would have absolutely no reason for doing this" and the reply is there cold be a plausible reason.

Re: DDoS Attack Against Dyn Managed DNS

#303

Post by drinchev »

bhauer wrote: post #243
drinchev wrote: post #225

Earlier quoted context omitted.

All will break the moment that one of the websites that you access makes a server-side request to another website ( think about logging-services, server-clusters, database servers, etc - they all either have IPs or most-likely some domains. )

I'm not sure I understand what you're saying. The scenario is that my local network's caching DNS resolver retains resolutions beyond the authority-provided TTL in the event that a TTL-specified refresh at expiration fails. Therefore, my web browser may—in the very rare situation where this arises—make an HTTP request to an IP address of a server that has been intentionally moved by a service provider (let's assume t…

I think you understood me. Maybe I can explain more.

If you have a service `log.io` with it's own DNS servers ( running named or djbdns ). And one day you decide to shut them down and rename the service to `loggy.io`.

What will happen is that any DNS trying to query the `log.io` DNS will reach unreachable server, which will lead to serving the last-known IP from the proposed DNS Cache on your machine.

If you don't use forever-failback-cache after the TTL expired you will just reach unreachable server and return back no IP address.

Re: DDoS Attack Against Dyn Managed DNS

#304

Post by imglorp »

bhauer wrote: post #272
davidu wrote: post #255

Earlier quoted context omitted.

OpenDNS does this: https://support.opendns.com/hc/en-us/articles/227987767-Dyna... It's called SmartCache.

Awesome! Is this available as software I can install on my network? Sorry, probably a dumb question.

Nope, just point your machine or router's DNS to use opendns resolvers instead of your regular ones: 208.67.222.222 and 208.67.220.220

Re: DDoS Attack Against Dyn Managed DNS

#305

Post by roland-s »

chromaton wrote: post #232
chromaton wrote: post #187

I can't currently get resolution on www.paypal.com. $ dig @8.8.8.8 www.paypal.com ; > DiG 9.8.1-P1 > @8.8.8.8 www.paypal.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER ;; QUESTION SECTION: ;www.paypal.com. IN A ;; Query time: 29 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Fri Oct 21 12:35:33 2016 ;; MSG SIZE rcvd: 32

And it's back again. I'm on AT&T in Atlanta. $ dig @8.8.8.8 www.paypal.com ; > DiG 9.8.1-P1 > @8.8.8.8 www.paypal.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER

Paypal and others still down for me at University of California (I think we're our own ISP?)

Re: DDoS Attack Against Dyn Managed DNS

#306

Post by chetanahuja »

caleblloyd wrote: post #241
beachstartup wrote: post #231

Earlier quoted context omitted.

i seem to remember that dns has generally been reliable (until recently, i guess), probably nobody has ever thought that to be necessary. you could write a cron script that generates a date-stamped hosts file based on a list of your top-used domain names, and simply use that on your machine(s) if your dns ever goes down. that's basically a very simple local dns cache. if you feel like living dangerously, have it upda…

> i seem to remember that dns has generally been reliable (until recently, i guess) Probably because people used to use long TTLs (1 hour, 4 hours, whatever) and now the default behavior in services like Amazon Route 53 is to use 5 minutes.

Try Akamai managed CDN content. 20 seconds !!

Re: DDoS Attack Against Dyn Managed DNS

#307

Post by codedokode »

nickbauman wrote: post #143
scrollaway wrote: post #18

Relevant (or at least a-propos) post by Bruce Schneier, from a month ago: "Someone Is Learning How to Take Down the Internet" https://www.schneier.com/blog/archives/2016/09/someone_is_le... Edit: And to be clear: I don't mean to imply there's any connection :)

Prediction: A massive, sustained attack will occur on key US Internet infra on election night in an attempt to debase the US election results.

Is it really important who wins it there are only two candidates that share common view on many problems? And you don't need Internet to count votes anyway.

Re: DDoS Attack Against Dyn Managed DNS

#308

Post by bgentry »

If you're having issues with people accessing your running Heroku apps, it's likely because you're running your DNS through herokussl.com (with their SSL endpoint product) which is hosted on Dyn.

If you can update your DNS to CNAME directly to the ELB behind it, it should at least make your site accessible.

Re: DDoS Attack Against Dyn Managed DNS

#309

Post by profmonocle »

piquadrat wrote: post #17
dudul wrote: post #7

Damn, I've spent the past 30 minutes trying to update my DNS and playing with my router config! :) No GitHub, well, it's gonna be a fun Friday...

putting something like 192.30.253.113 github.com into your /etc/hosts (or other appropriate location for your OS) should get you going again.

Just remember to take it out when this is resolved. IPs shuffle around all the time, and that IP might not always work for the main github.com domain.

Re: DDoS Attack Against Dyn Managed DNS

#310

Post by brown9-2 »

lanna wrote: post #117
lanna wrote: post #104

Earlier quoted context omitted.

This is what you can do to restore your GitHub access: grep github ~/.ssh/known_hosts sudo vim /etc/hosts sudo killall -HUP mDNSResponder ping github.com

Why am I being downvoted for providing useful information? I don't understand HN...

Probably because you say to edit /etc/hosts but not what the content should be.
Post reply on HN