Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

Post reply on HN
Print view View original

361–370 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#361

Post by schrodinger »

bhauer wrote: post #319
drinchev wrote: post #303

Earlier quoted context omitted.

I think you understood me. Maybe I can explain more. If you have a service `log.io` with it's own DNS servers ( running named or djbdns ). And one day you decide to shut them down and rename the service to `loggy.io`. What will happen is that any DNS trying to query the `log.io` DNS will reach unreachable server, which will lead to serving the last-known IP from the proposed DNS Cache on your machine. If you don't us…

Thanks for the reply. > If you have a service `log.io` with it's own DNS servers ( running named or djbdns ). And one day you decide to shut them down and rename the service to `loggy.io`. > What will happen is that any DNS trying to query the `log.io` DNS will reach unreachable server, which will lead to serving the last-known IP from the proposed DNS Cache on your machine. To reiterate the scenario you've put forth…

When your customer sees that HTTPS error, they may associate it with your company failing at security.

Re: DDoS Attack Against Dyn Managed DNS

#363

Post by xyclos »

elwell wrote: post #327

To get on github you can add to your /etc/hosts: 192.30.253.113 github.com 151.101.32.133 assets-cdn.github.com And it seems faster than normal right (less users). Edit; for profile pics include: 151.101.32.133 avatars0.githubusercontent.com 151.101.32.133 avatars1.githubusercontent.com 151.101.32.133 avatars2.githubusercontent.com 151.101.32.133 avatars3.githubusercontent.com 151.101.32.133 avatars4.githubuserconten…

how about npm?

Re: DDoS Attack Against Dyn Managed DNS

#364

Post by Artemis2 »

asdf333 wrote: post #350
bgentry wrote: post #308

If you're having issues with people accessing your running Heroku apps, it's likely because you're running your DNS through herokussl.com (with their SSL endpoint product) which is hosted on Dyn. If you can update your DNS to CNAME directly to the ELB behind it, it should at least make your site accessible.

thanks for the tip! how did you determine the ELB address behind the ssl endpoint? edit: figured it out. What i did was do: nslookup your-SSL-endpoint.herokussl.com then you'll see the elb address. Switch to the openDNS servers helpfully pointed out by someone above first...

Presumably with something like `dig @208.67.220.220 -t CNAME .herokussl.com`. This uses the OpenDNS nameservers, that people have been reporting as working. Haven't tested it as I am on the go.

Re: DDoS Attack Against Dyn Managed DNS

#366

Post by paulddraper »

colanderman wrote: post #86
ljosa wrote: post #58

AWS says "We are investigating elevated errors resolving the DNS hostnames used to access some AWS services in the US-EAST-1 Region." Is that coincidental, or are they being DDoSed also?

Apparently us-east-1 is backed by Dyn (and only Dyn) as well? $ host -t NS us-east-1.amazonaws.com us-east-1.amazonaws.com name server ns3.p31.dynect.net. us-east-1.amazonaws.com name server ns1.p31.dynect.net. us-east-1.amazonaws.com name server ns2.p31.dynect.net. us-east-1.amazonaws.com name server ns4.p31.dynect.net. That's… utterly bizarre to me. us-east-2 has a more diverse selection: $ host -t NS us-east-2.ama…

> Not that anyone should be running a service whose availability they care about solely in us-east-1 anyway

Don't confuse regions with availability zones. (Though in this case, the availability zones don't help...)

Re: DDoS Attack Against Dyn Managed DNS

#367

Post by foxhop »

So I had hardcoded my DNS server to googles, aka:

    dig @8.8.4.4 github.com +short
I was not getting an answer.

However using my routers/dhcp/ISP to set my DNS server, I am able to get answers:

    dig github.com +short
    192.30.253.112

Re: DDoS Attack Against Dyn Managed DNS

#369

Post by tedmiston »

davidu wrote: post #255
bhauer wrote: post #214

Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a la…

OpenDNS does this: https://support.opendns.com/hc/en-us/articles/227987767-Dyna... It's called SmartCache.

Anyone know if Google Public DNS does?

Re: DDoS Attack Against Dyn Managed DNS

#370

Post by puddintane »

xyclos wrote: post #363
elwell wrote: post #327

To get on github you can add to your /etc/hosts: 192.30.253.113 github.com 151.101.32.133 assets-cdn.github.com And it seems faster than normal right (less users). Edit; for profile pics include: 151.101.32.133 avatars0.githubusercontent.com 151.101.32.133 avatars1.githubusercontent.com 151.101.32.133 avatars2.githubusercontent.com 151.101.32.133 avatars3.githubusercontent.com 151.101.32.133 avatars4.githubuserconten…

how about npm?

I was able to access everything by changing DNS as mentioned in the other posts [1].

[1] https://news.ycombinator.com/item?id=12762841

edit Of course this is if your local policy allows you to change this!

Post reply on HN