Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

Post reply on HN
Print view View original

401–410 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#401

Post by andrewmchen »

bluejekyll wrote: post #183
raemike123 wrote: post #176

USA cyber defenses are NOT up to the task of defending our critical electronic infrastructure. Letting every company that runs critical services decide their own security posture is not scalable and has left us vulnerable. While no one is getting hurt, we are taking cyber missile hits from our enemies and eventually the damage will be worse. Other countries with more central controls will be less vulnerable than we a…

No. What we need are new techniques for creating back-pressure to all the routers which are forwarding on this type of attack. The issue is that our Routing technology does not give downstream nodes any way to push back on the flood of packets. Cisco could step up to the plate here. And no, I'm not talking about firewalls. We need newer ICMP type packets to create this back-pressure, so that we can stop floods like t…

It looks like we used to have something similar but it got deprecated. https://tools.ietf.org/html/rfc6633

Re: DDoS Attack Against Dyn Managed DNS

#402

Post by leesalminen »

woot01 wrote: post #389
mej10 wrote: post #298

Earlier quoted context omitted.

Yeah, that is definitely possible. I mean, hopefully it is over HTTPS so they can't do anything with it... but if it isn't then it can definitely happen. Our servers get random web traffic all of the time.

HTTPS does not protect you against sending data to a host owned by another company.

Correct, but they wouldn't be able to decrypt the data.

Re: DDoS Attack Against Dyn Managed DNS

#403

Post by mzw_mzw »

plasticchris wrote: post #276
mzw_mzw wrote: post #163

Earlier quoted context omitted.

>To pin it on someone else? That's... kind of conspiratorial thinking? Would you cut off your own hand so you could blame it on someone else?

It's called a false flag operation, and does happen.

And the ratio of false flag operations to false accusations of false flag operations is about 1:99. Lots of unlikely things "do happen," but if that's the immediate explanation you reach for you're going to be wrong most of the time.

Re: DDoS Attack Against Dyn Managed DNS

#405

Post by colanderman »

sandinmyjoints wrote: post #234
colanderman wrote: post #86

Earlier quoted context omitted.

Apparently us-east-1 is backed by Dyn (and only Dyn) as well? $ host -t NS us-east-1.amazonaws.com us-east-1.amazonaws.com name server ns3.p31.dynect.net. us-east-1.amazonaws.com name server ns1.p31.dynect.net. us-east-1.amazonaws.com name server ns2.p31.dynect.net. us-east-1.amazonaws.com name server ns4.p31.dynect.net. That's… utterly bizarre to me. us-east-2 has a more diverse selection: $ host -t NS us-east-2.ama…

AWS may have updated this, I now see $ host -t NS us-east-1.amazonaws.com us-east-1.amazonaws.com name server pdns5.ultradns.info. us-east-1.amazonaws.com name server ns3.p31.dynect.net. us-east-1.amazonaws.com name server pdns1.ultradns.net. us-east-1.amazonaws.com name server pdns3.ultradns.org. us-east-1.amazonaws.com name server ns4.p31.dynect.net. us-east-1.amazonaws.com name server ns1.p31.dynect.net. us-east-1…

Me too. Someone realized their oopsie :)

Re: DDoS Attack Against Dyn Managed DNS

#406

Post by colanderman »

paulddraper wrote: post #366
colanderman wrote: post #86

Earlier quoted context omitted.

Apparently us-east-1 is backed by Dyn (and only Dyn) as well? $ host -t NS us-east-1.amazonaws.com us-east-1.amazonaws.com name server ns3.p31.dynect.net. us-east-1.amazonaws.com name server ns1.p31.dynect.net. us-east-1.amazonaws.com name server ns2.p31.dynect.net. us-east-1.amazonaws.com name server ns4.p31.dynect.net. That's… utterly bizarre to me. us-east-2 has a more diverse selection: $ host -t NS us-east-2.ama…

> Not that anyone should be running a service whose availability they care about solely in us-east-1 anyway Don't confuse regions with availability zones. (Though in this case, the availability zones don't help...)

Oh good point, my bad.

Re: DDoS Attack Against Dyn Managed DNS

#407

Post by gkop »

bgentry wrote: post #308

If you're having issues with people accessing your running Heroku apps, it's likely because you're running your DNS through herokussl.com (with their SSL endpoint product) which is hosted on Dyn. If you can update your DNS to CNAME directly to the ELB behind it, it should at least make your site accessible.

Another option may be to switch from the SSL endpoint add-on to the new, free SNI-based SSL termination feature, which will mean CNAMEing to your-domain.herokudns.com. , which seems not to be affected by today's issues.

Re: DDoS Attack Against Dyn Managed DNS

#408

Post by conatico »

davidu wrote: post #255
bhauer wrote: post #214

Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a la…

OpenDNS does this: https://support.opendns.com/hc/en-us/articles/227987767-Dyna... It's called SmartCache.

A shame OpenDNS used to redirect me to some spam webpage every time I tried to resolve a domain that didn't exist--they earned a spot on my black list forever. :(

Re: DDoS Attack Against Dyn Managed DNS

#409

Post by BHSPitMonkey »

rybosome wrote: post #299
Shank wrote: post #267

Earlier quoted context omitted.

If this is a test run, this is an amazing early warning for Twitter and the like to immediately start working on contingency plans for election day.

What can they do? It's not Twitter themselves being DDOS'd, it's a DNS provider. This propagates up the chain to impact both a Tier 1 network and cloud providers, which hits tons of stuff on top of that.

They could distribute instructions for users to follow, E.g. using some permanent working IPs or alternate DNS servers.
Post reply on HN