Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

Post reply on HN
Print view View original

321–330 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#322

Post by zwily »

bhauer wrote: post #214

Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a la…

This can be pretty bad in a world where AWS ELB IP addresses change regularly.

Re: DDoS Attack Against Dyn Managed DNS

#323

Post by sinap »

jrochkind1 wrote: post #313

Is it time for everyone to actually start using secondary name servers/DNS resolvers too from a different provider from primary? DNS _is_ built for this, for the very purpose of handling failure of the primary resolver, isn't it? Just most people don't seem to do it -- including major players? Or would that not actually solve this particular scenario?

The attack is on the authoritative name servers, not a DNS resolver. A public DNS resolver will query the authoritative name server for a record if it doesn't exist in it's cache.

Re: DDoS Attack Against Dyn Managed DNS

#324

Post by cjbprime »

zwily wrote: post #322
bhauer wrote: post #214

Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a la…

This can be pretty bad in a world where AWS ELB IP addresses change regularly.

Why? The OP is only proposing using a cached result when there's no updated record available.

Re: DDoS Attack Against Dyn Managed DNS

#325

Post by bhauer »

mej10 wrote: post #298
leesalminen wrote: post #288

Earlier quoted context omitted.

One possible issue is that IPs are re-used in cloud environments. Potentially, your browser could POST sensitive data to an IP address that now belongs to a totally different company.

Yeah, that is definitely possible. I mean, hopefully it is over HTTPS so they can't do anything with it... but if it isn't then it can definitely happen. Our servers get random web traffic all of the time.

True. I am not aware of any web services POSTing sensitive data over the public Internet that don't use HTTPS. If your service is sending sensitive data over HTTP without TLS, I feel the problem is bigger than a potential long-lived DNS resolution.

Re: DDoS Attack Against Dyn Managed DNS

#326

Post by toomuchtodo »

cjbprime wrote: post #324
zwily wrote: post #322

Earlier quoted context omitted.

This can be pretty bad in a world where AWS ELB IP addresses change regularly.

Why? The OP is only proposing using a cached result when there's no updated record available.

Serving wrong records is usually worse than serving no records.

EDIT: It would be fine as long as your site only served HTTPS content and HSTS was enabled for your domain, preventing any sort of MITM attack.

Re: DDoS Attack Against Dyn Managed DNS

#327

Post by elwell »

To get on github you can add to your /etc/hosts:

    192.30.253.113  github.com
    151.101.32.133  assets-cdn.github.com
And it seems faster than normal right (less users).

Edit; for profile pics include:

    151.101.32.133  avatars0.githubusercontent.com
    151.101.32.133  avatars1.githubusercontent.com
    151.101.32.133  avatars2.githubusercontent.com
    151.101.32.133  avatars3.githubusercontent.com
    151.101.32.133  avatars4.githubusercontent.com
    151.101.32.133  avatars5.githubusercontent.com

Re: DDoS Attack Against Dyn Managed DNS

#329

Post by dEnigma »

I was not aware of the attacks going on until this happened:

1. Tried to download "Unknown Horizons" (game featured recently on Hacker News) binary, github-link doesn't work.

2. Think "Ok, might be an old link", google their github-repository, github appears down.

3. Try accessing github status website, is down.

4. Interested, try to visit github status twitter account, twitter is down.

Really weird experience, normally at least the second source of news on a downed website I try during an attack works.

Re: DDoS Attack Against Dyn Managed DNS

#330

Post by stingraycharles »

mxuribe wrote: post #139
foobarbecue wrote: post #131

According to Fortune, Hacker News "reported" on the incident. Are we journalists now? "Popular tech site Hacker News reported many other sites were affected including Etsy, Spotify, Github, Soundcloud, and Heroku." -- http://fortune.com/2016/10/21/internet-outages/

No, not necessarily journalists; rahter, an information source...Fortune - a site/company known for journalism/reporting - now just gave HackerNews more legitimacy as an official information source ...Now with this power, please use it responsibly. ;-)

Too bad that the majority of the readers will think that HackerNews is somehow related to the "Hackers" that took down the internet.
Post reply on HN