DDoS Attack Against Dyn Managed DNS • Hacker News Board

Re: DDoS Attack Against Dyn Managed DNS

#421

Post by bhauer » Fri, Oct 21, 2016, 7:21 PM UTC

imsofuture wrote: post #412

jasimp wrote: post #386

Earlier quoted context omitted.

I can guarantee you that popular DNS resolvers (think 500b+ transactions a day) do have this feature! Don't want to say much more due to it being my job, and I don't want to give away too much. EDIT: https://www.google.com/patents/US8583801

What is the point of this comment?

FWIW, since the comment was a reply to my message above:

It provided value by answering my question concerning serious downsides to providing optional post-TTL last-known-good caching within a DNS resolver. The answer is implicit in that a major DNS resolver provides exactly this functionality.

Re: DDoS Attack Against Dyn Managed DNS

#422

Post by pyvpx » Fri, Oct 21, 2016, 7:21 PM UTC

rtrox wrote: post #375

Shank wrote: post #311

Earlier quoted context omitted.

Have a failover DNS provider. Amazon uses Dyn, but also has UltraDNS as a backup, and it's obviously still up. Twitter vs Amazon: host -t ns twitter.com: ns3.p34.dynect.net, ns4.p34.dynect.net, ns1.p34.dynect.net, ns2.p34.dynect.net. host -t ns amazon.com: ns3.p31.dynect.net, ns4.p31.dynect.net, ns2.p31.dynect.net, pdns6.ultradns.co.uk, pdns1.ultradns.net, ns1.p31.dynect.net.

Thank you so much for mentioning this. This was my first thought when I heard about all the major enterprise sites affected by the DDoS: "How do all these major players have singly-homed DNS"?

if you utilize geoip routing features of one provider, it can be difficult to impossible to then ensure repeatable/deterministic behavior on a second provider.

Re: DDoS Attack Against Dyn Managed DNS

#423

Post by foxfaction » Fri, Oct 21, 2016, 7:22 PM UTC

myfinalaccount wrote: post #219

toomuchtodo wrote: post #211

Earlier quoted context omitted.

You don't need to target voting infrastructure. You target media infrastructure (DNS, streaming, web media) in order to either reduce or shift voter turnout. A candidate ahead in a battleground state? You stomp on media reporting to ensure their opponent's voters aren't dissuaded from heading to the polls. Control the message, and through that the actual votes cast.

I dont even think you need to necessarily shift voter turn out. I think you need to sow enough confusion in order to cast the results into doubt.

Yeah it just needs to be "The internet was broken so your votes were lost" and then some made up post-hoc explanations that 90% of people don't understand so they can't dispute

Re: DDoS Attack Against Dyn Managed DNS

#424

Post by fokinsean » Fri, Oct 21, 2016, 7:24 PM UTC

AmrEldib wrote: post #371

scrollaway wrote: post #18

Relevant (or at least a-propos) post by Bruce Schneier, from a month ago: "Someone Is Learning How to Take Down the Internet" https://www.schneier.com/blog/archives/2016/09/someone_is_le... Edit: And to be clear: I don't mean to imply there's any connection :)

Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…

> - Russia's only air craft carrier is trespassing through UK waters to get to Syria in a show of force that doesn't really add anything to their military capabilities there.

If they were really gearing up for war why would they move their only carrier away from the mother land. Your article even says it is more of a "show of force" than start of war.

So how did you jump to WW3?

Re: DDoS Attack Against Dyn Managed DNS

#425

Post by patmcguire » Fri, Oct 21, 2016, 7:24 PM UTC

mdavidn wrote: post #285

patmcguire wrote: post #254

Any quick script to see if a given domain ultimately resolves to them? My SaaS company has a lot of custom domains from whatever DNS servers pointed at us and I'd like to be able to tell people whether it's our fault or not.

`dig NS $domain` Query for the root domain, without any subdomains like www. That is, you need to check the "zone apex," the shortest name purchased from a registrar and potentially delegated to Dyn. Look for dynect.net in the list of authoritative name servers.

Yeah, I tried that. I don't see dnyect in a lot of domains that are failing, and it's clearly related somehow, they didn't all break at the same time by coincidence.

Re: DDoS Attack Against Dyn Managed DNS

#426

Post by Rapzid » Fri, Oct 21, 2016, 7:25 PM UTC

Looks like github and braintree both got AWS dns servers mixed in about the same time. Did they both switch over or is Dyn working with AWS on this?

Re: DDoS Attack Against Dyn Managed DNS

#427

Post by jasonellis » Fri, Oct 21, 2016, 7:25 PM UTC

pitosalas wrote: post #411

imglorp wrote: post #304

Earlier quoted context omitted.

Nope, just point your machine or router's DNS to use opendns resolvers instead of your regular ones: 208.67.222.222 and 208.67.220.220

Do you have a link on the opendns web site that refers to those specific Ips?

https://www.opendns.com/setupguide/

Re: DDoS Attack Against Dyn Managed DNS

#428

Post by JoshTriplett » Fri, Oct 21, 2016, 7:26 PM UTC

bhauer wrote: post #214

Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a la…

It'd be nice to have a "backup TTL" included, to allow sites to specify whether and how long they wanted such caching behavior.

Also, that cache would need to only kick in when the server was unreachable or produced SERVFAIL, not when it returned a negative result. Negative results returned by the authoritative server are correct, and should not result in the recursive resolver returning anything other than a negative result.

Re: DDoS Attack Against Dyn Managed DNS

#429

Post by asdf333 » Fri, Oct 21, 2016, 7:29 PM UTC

natashabaker wrote: post #419

asdf333 wrote: post #396

Earlier quoted context omitted.

did you switch your computer's dns servers to openDNS? 208.67.222.222 208.67.220.220 (or specify dns server in the command)

Yes we did dig @208.67.220.220 -t CNAME .herokussl.com. And we got the following SERVFAIL error: ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ; .herokussl.com. IN CNAME ;; Query time: 1226 msec ;; SERVER: #53( ) ;; WHEN: Fri Oct 21 12:27:55 2016 ;; MSG SIZE rcvd: 44

try nslookup your-SSL-endpoint.herokussl.com

the dig command does not work for me either...

=================================

nslookup iwate-2009.herokussl.com Server: 208.67.222.222 Address: 208.67.222.222#53

Non-authoritative answer: iwate-2009.herokussl.com canonical name = elb030330-152447250.us-east-1.elb.amazonaws.com. Name: elb030330-152447250.us-east-1.elb.amazonaws.com Address: 54.225.242.254 Name: elb030330-152447250.us-east-1.elb.amazonaws.com Address: 54.225.217.226 Name: elb030330-152447250.us-east-1.elb.amazonaws.com Address: 54.235.181.244

Re: DDoS Attack Against Dyn Managed DNS

#430

Post by leesalminen » Fri, Oct 21, 2016, 7:29 PM UTC

AmrEldib wrote: post #371

scrollaway wrote: post #18

Relevant (or at least a-propos) post by Bruce Schneier, from a month ago: "Someone Is Learning How to Take Down the Internet" https://www.schneier.com/blog/archives/2016/09/someone_is_le... Edit: And to be clear: I don't mean to imply there's any connection :)

Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…

> US election is in 3 weeks and Donald Trump is openly in love with Putin.

He states that he's never met Putin nor has any holdings in Russia. He has stated that he is open to positive relationships with the Russian government.

> Trump questioned the benefit of NATO which is the basis for Europe stability after the 2nd world war.

I believe he stated that he wants NATO to "pay their fare share" in the costs of maintaining the organization.

I'm not a Trump supporter but we shouldn't believe everything we read.