DDoS Attack Against Dyn Managed DNS • Hacker News Board

Re: DDoS Attack Against Dyn Managed DNS

#441

Post by knz » Fri, Oct 21, 2016, 7:36 PM UTC

AmrEldib wrote: post #371

scrollaway wrote: post #18

Relevant (or at least a-propos) post by Bruce Schneier, from a month ago: "Someone Is Learning How to Take Down the Internet" https://www.schneier.com/blog/archives/2016/09/someone_is_le... Edit: And to be clear: I don't mean to imply there's any connection :)

Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…

> Say Hello to World War III, everybody!

Is this sabre rattling or the prelude to a global conflict? Surely at worst it will (continue to) be a proxy war between NATO and Russia in Syria and nothing more? What motive is there for Russia or NATO to engage in open warfare? I'm not sure that a slow and prolonged lead up to an open war would even be effective in this situation.

Perhaps it should be "Say hello to Cold War v2.2017"?

Re: DDoS Attack Against Dyn Managed DNS

#442

Post by throwaway5345 » Fri, Oct 21, 2016, 7:36 PM UTC

bgentry wrote: post #308

If you're having issues with people accessing your running Heroku apps, it's likely because you're running your DNS through herokussl.com (with their SSL endpoint product) which is hosted on Dyn. If you can update your DNS to CNAME directly to the ELB behind it, it should at least make your site accessible.

Nice, this is working well for us too. We were able to get the CNAME of the ELB by doing a `dig whatever.ourdomain.com` in an EC2 instance we launched in São Paulo (which presumably worked since Dyn's outage is primarily affecting their east coast PoPs.)

Re: DDoS Attack Against Dyn Managed DNS

#443

Post by newsat13 » Fri, Oct 21, 2016, 7:37 PM UTC

newsat13 wrote: post #296

Switch to OpenDNS servers - 208.67.222.222 and 208.67.220.220. Even google NS are down it seems. Heroku works after switching to opendns.

Sorry for the confusion about saying Google NS is down :-) I meant dig heroku.com @8.8.8.8 does not work (as pointed by some other poster it is because google NS honors TTL but opendns does not)

Re: DDoS Attack Against Dyn Managed DNS

#444

Post by stuntmachine » Fri, Oct 21, 2016, 7:37 PM UTC

tedmiston wrote: post #356

Anyone else spend the morning thinking the problem was their setup? I've been flushing my system DNS cache, Chrome's DNS cache, changing DNS servers, rebooting my router, turning VPN on/off, etc.

Yeah. :/

It happened to be at the same time I was getting things configured to connect to a new VPN that I hadn't used before for the first time. Until about 7am today my home network was a 10.0.0.0/8 network. VPN kept bombing in the last phase of connecting and I couldn't figure out why, so I thought it was an IP conflict with my internal network range.

So naturally, I then went into my router and changed my subnet for my entire home network to the more common 192.168.1.0/24 range to see if it'd help. It didn't. Until suddenly VPN "just worked" -- which makes me wonder if I needed to change my network at all to begin with.

Then I started experiencing all sorts of weird issues where the Internet seemed to disappear from one minute until the next.

Then I hit IRC when things finally stabilized and see "Did you hear about Dyn?".

My reaction: wut.

TL;DR: I rearchitected my home network at 7am for no reason.

Re: DDoS Attack Against Dyn Managed DNS

#445

Post by asdf333 » Fri, Oct 21, 2016, 7:37 PM UTC

natashabaker wrote: post #432

asdf333 wrote: post #429

Earlier quoted context omitted.

try nslookup your-SSL-endpoint.herokussl.com the dig command does not work for me either... ================================= nslookup iwate-2009.herokussl.com Server: 208.67.222.222 Address: 208.67.222.222#53 Non-authoritative answer: iwate-2009.herokussl.com canonical name = elb030330-152447250.us-east-1.elb.amazonaws.com. Name: elb030330-152447250.us-east-1.elb.amazonaws.com Address: 54.225.242.254 Name: elb030330…

In that case I get: ;; Got SERVFAIL reply from 10.17.100.2, trying next server Server: 10.17.100.2 Address: 10.17.100.2#53 server can't find .herokussl.com: NXDOMAIN

maybe try this and replace w/ ur sslendpoint? see if that works? this works for me.

http://network-tools.com/nslook/Default.asp?domain=iwate-200...

Re: DDoS Attack Against Dyn Managed DNS

#446

Post by blobbob2 » Fri, Oct 21, 2016, 7:38 PM UTC

This is a false flag operation by the Obama administration so they can blame it on Russia. If you notice all of the rhetoric from the democrats blaming Russia with no evidence. Then you understand that Russia has nothing to gain from such an attack, it is crystal clear.

Re: DDoS Attack Against Dyn Managed DNS

#447

Post by Mizza » Fri, Oct 21, 2016, 7:40 PM UTC

Although I don't like to to recommend Google products, they provide a provide a public DNS-over-HTTPS interface that should be useful for people who want to add specific entries into their /etc/hosts files: https://dns.google.com/query?name=github.com&type=A&dnssec=t...

Re: DDoS Attack Against Dyn Managed DNS

#448

Post by knz » Fri, Oct 21, 2016, 7:41 PM UTC

fokinsean wrote: post #424

AmrEldib wrote: post #371

Earlier quoted context omitted.

Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…

> - Russia's only air craft carrier is trespassing through UK waters to get to Syria in a show of force that doesn't really add anything to their military capabilities there. If they were really gearing up for war why would they move their only carrier away from the mother land. Your article even says it is more of a "show of force" than start of war. So how did you jump to WW3?

I'm sure that carrier is being followed by multiple NATO submarines as well.

It seems incredibly unlikely that a global war would start over Syria when we've had 60 years of proxy conflict instead. Russia or NATO have absolutely nothing to gain from an open military conflict.

Re: DDoS Attack Against Dyn Managed DNS

#449

Post by jasimp » Fri, Oct 21, 2016, 7:42 PM UTC

pyvpx wrote: post #418

jasimp wrote: post #386

Earlier quoted context omitted.

I can guarantee you that popular DNS resolvers (think 500b+ transactions a day) do have this feature! Don't want to say much more due to it being my job, and I don't want to give away too much. EDIT: https://www.google.com/patents/US8583801

you mean opendns?

No I mean ISP's that run their own DNS resolvers.

Re: DDoS Attack Against Dyn Managed DNS

#450

Post by warmwaffles » Fri, Oct 21, 2016, 7:43 PM UTC

kirizt wrote: post #431

tim_armandpour wrote: post #413

I wanted to provide an update on the PagerDuty service. At this time we have been able to restore the service by migrating to our secondary DNS provider. If you are still experiencing issues reaching any pagerduty.com addresses, please flush your DNS cache. This should restore your access to the service. We are actively monitoring our service and are working to resolve any outstanding issues. We sincerely apologize f…

I appreciate the update, but your service has been unavailable for hours already. This is unacceptable for a service whose core value is to ensure that we know about any incidents.

You apparently don't understand DNS. DynDNS is a very reputable DNS provider that twitter and many others use. For someone to take them down requires a massive amount of effort. Running a redundant DNS provider is expensive as all hell.