Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

Post reply on HN
Print view View original

431–440 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#431

Post by kirizt »

tim_armandpour wrote: post #413

I wanted to provide an update on the PagerDuty service. At this time we have been able to restore the service by migrating to our secondary DNS provider. If you are still experiencing issues reaching any pagerduty.com addresses, please flush your DNS cache. This should restore your access to the service. We are actively monitoring our service and are working to resolve any outstanding issues. We sincerely apologize f…

I appreciate the update, but your service has been unavailable for hours already. This is unacceptable for a service whose core value is to ensure that we know about any incidents.

Re: DDoS Attack Against Dyn Managed DNS

#432

Post by natashabaker »

asdf333 wrote: post #429
natashabaker wrote: post #419

Earlier quoted context omitted.

Yes we did dig @208.67.220.220 -t CNAME .herokussl.com. And we got the following SERVFAIL error: ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ; .herokussl.com. IN CNAME ;; Query time: 1226 msec ;; SERVER: #53( ) ;; WHEN: Fri Oct 21 12:27:55 2016 ;; MSG SIZE rcvd: 44

try nslookup your-SSL-endpoint.herokussl.com the dig command does not work for me either... ================================= nslookup iwate-2009.herokussl.com Server: 208.67.222.222 Address: 208.67.222.222#53 Non-authoritative answer: iwate-2009.herokussl.com canonical name = elb030330-152447250.us-east-1.elb.amazonaws.com. Name: elb030330-152447250.us-east-1.elb.amazonaws.com Address: 54.225.242.254 Name: elb030330…

In that case I get:

;; Got SERVFAIL reply from 10.17.100.2, trying next server Server: 10.17.100.2 Address: 10.17.100.2#53

server can't find .herokussl.com: NXDOMAIN

Re: DDoS Attack Against Dyn Managed DNS

#433

Post by eli »

conatico wrote: post #408
davidu wrote: post #255

Earlier quoted context omitted.

OpenDNS does this: https://support.opendns.com/hc/en-us/articles/227987767-Dyna... It's called SmartCache.

A shame OpenDNS used to redirect me to some spam webpage every time I tried to resolve a domain that didn't exist--they earned a spot on my black list forever. :(

They don't do that any more, for what it's worth. I think for a while that was the only revenue stream for what was otherwise a free service. https://www.opendns.com/no-more-ads/

Re: DDoS Attack Against Dyn Managed DNS

#435

Post by acdha »

paulddraper wrote: post #314

I thought DNS (particularly public) was basically immune to DDoS? If one DNS server is down, use the cached result or another server. DNS is some of the most distributable, cachable data I can imagine.

Some sites intentionally disable that, however, by setting a short TTL on replies. The idea is usually that it allows them to very quickly adjust to hardware failures or load across datacenters but it has the consequence of making your infrastructure comparatively brittle.

Re: DDoS Attack Against Dyn Managed DNS

#436

Post by kettu228 »

AmrEldib wrote: post #371
scrollaway wrote: post #18

Relevant (or at least a-propos) post by Bruce Schneier, from a month ago: "Someone Is Learning How to Take Down the Internet" https://www.schneier.com/blog/archives/2016/09/someone_is_le... Edit: And to be clear: I don't mean to imply there's any connection :)

Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…

> - Finland (yes, Finland) is increasingly worried about Russia. They violated their air space, and they're questioning Finland's independence. Finland shares a long boarder with Russia.

The Finns actually have still quite good relationship with Russia (better than other neighbors) and nobody's actually questioning Finland's independence. Baltic countries is a different story.

Source: A Finn here.

Re: DDoS Attack Against Dyn Managed DNS

#438

Post by AlanBoyce69 »

tim_armandpour wrote: post #413

I wanted to provide an update on the PagerDuty service. At this time we have been able to restore the service by migrating to our secondary DNS provider. If you are still experiencing issues reaching any pagerduty.com addresses, please flush your DNS cache. This should restore your access to the service. We are actively monitoring our service and are working to resolve any outstanding issues. We sincerely apologize f…

How am i meant to see twitter status updates when twitter is down?

Re: DDoS Attack Against Dyn Managed DNS

#439

Post by aianus »

woot01 wrote: post #389
mej10 wrote: post #298

Earlier quoted context omitted.

Yeah, that is definitely possible. I mean, hopefully it is over HTTPS so they can't do anything with it... but if it isn't then it can definitely happen. Our servers get random web traffic all of the time.

HTTPS does not protect you against sending data to a host owned by another company.

Yes it does, the cert presented by api.othercompany.com would not pass validation when you're trying to open a connection to api.intendedcompany.com.

Re: DDoS Attack Against Dyn Managed DNS

#440

Post by Symbiote »

mgamble wrote: post #354
sinap wrote: post #323

Earlier quoted context omitted.

The attack is on the authoritative name servers, not a DNS resolver. A public DNS resolver will query the authoritative name server for a record if it doesn't exist in it's cache.

Agreed, but there is nothing stopping you from having the authoritative name servers for a domain with different providers. As someone previously said, DNS was designed for this.

It's used to be common for universities to do this, mine still does:

  ic.ac.uk.		45665	IN	NS	ns1.ic.ac.uk.
  ic.ac.uk.		45665	IN	NS	ns2.ic.ac.uk.
  ic.ac.uk.		45665	IN	NS	ns0.ic.ac.uk.
  ic.ac.uk.		45665	IN	NS	authdns1.csx.cam.ac.uk.
(and Cambridge use Imperial College as a secondary) but the best-known American universities are on cloud providers now.
Post reply on HN