Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

Post reply on HN
Print view View original

451–460 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#451

Post by bhauer »

rickhanlonii wrote: post #416
phil21 wrote: post #380

Earlier quoted context omitted.

It doesn't take much of an imagination to attack this. The older I get in tech the more I realize we just go in circles re-implementing every bad idea over again for the same exact reasons each "generation". Ah well. TTL is TTL for a reason. It's simple. The publisher is in control, they set their TTL for 60 seconds so obviously they have robust DNS infrastructure they are confident in. They are also signaling with s…

Assume we serve the last known record after TTL. Here's the attack: - Compromise IP (maybe facebook.com) - DDoS nameservers - facebook removes IP from rotation - Users still connect to bad actor even though TTL expired "We have standards for a reason" is absolutely correct, and we can't start ignoring the standards because someone can't imagine why we need them _at this moment_

Yes, but there's one piece missing.

> Here's the attack:

> - Compromise IP (maybe facebook.com)

- Attacker generates or acquires counterfeit facebook.com certificate.

> - DDoS nameservers

> - facebook removes IP from rotation

> - Users still connect to bad actor even though TTL expired

I understand what you are saying, but this attack scenario is extraordinarily difficult as a means to attack users who have opted to configure their local DNS resolver to retain a last-known-good IP resolution. It involves commandeering an IP and counterfeiting Facebook's SSL/TLS certificate. As I have said elsewhere in this thread, all sites are currently vulnerable to such an attack today for the duration of their TTL window. So if this is a plausible attack vector, we could plausibly see it used now.

Re: DDoS Attack Against Dyn Managed DNS

#452

Post by djhworld »

At work earlier we was seeing hostname resolution errors with applications trying to contact amazon s3 from on premises infrastructure.

This was in eu-west-1, but it coincided with a bunch of other systems in the organisation having problems at the same time.

Additionally CloudWatch logs seemed to be completely broken for about 30 minutes on the Amazon Console.

Re: DDoS Attack Against Dyn Managed DNS

#453

Post by nickbauman »

kirizt wrote: post #431
tim_armandpour wrote: post #413

I wanted to provide an update on the PagerDuty service. At this time we have been able to restore the service by migrating to our secondary DNS provider. If you are still experiencing issues reaching any pagerduty.com addresses, please flush your DNS cache. This should restore your access to the service. We are actively monitoring our service and are working to resolve any outstanding issues. We sincerely apologize f…

I appreciate the update, but your service has been unavailable for hours already. This is unacceptable for a service whose core value is to ensure that we know about any incidents.

Flush your DNS like the parent said.

Re: DDoS Attack Against Dyn Managed DNS

#454

Post by saltyhiker »

kirizt wrote: post #431
tim_armandpour wrote: post #413

I wanted to provide an update on the PagerDuty service. At this time we have been able to restore the service by migrating to our secondary DNS provider. If you are still experiencing issues reaching any pagerduty.com addresses, please flush your DNS cache. This should restore your access to the service. We are actively monitoring our service and are working to resolve any outstanding issues. We sincerely apologize f…

I appreciate the update, but your service has been unavailable for hours already. This is unacceptable for a service whose core value is to ensure that we know about any incidents.

Given that a large swath of SaaS services, infrastructure providers, and major sites across the internet are impacted, this seems harsh. Are you unhappy with PagerDuty's choice of DNS provider, or something else they have control over? I don't think anyone saw this particular problem coming.

Re: DDoS Attack Against Dyn Managed DNS

#455

Post by jasimp »

bhauer wrote: post #421
imsofuture wrote: post #412

Earlier quoted context omitted.

What is the point of this comment?

FWIW, since the comment was a reply to my message above: It provided value by answering my question concerning serious downsides to providing optional post-TTL last-known-good caching within a DNS resolver. The answer is implicit in that a major DNS resolver provides exactly this functionality.

Thank you :)

A little more information, considering it is public. (I had to double check if it was)

https://www.google.com/patents/US8583801

Re: DDoS Attack Against Dyn Managed DNS

#456

Post by WorldMaker »

curiousgal wrote: post #31
scrollaway wrote: post #18

Relevant (or at least a-propos) post by Bruce Schneier, from a month ago: "Someone Is Learning How to Take Down the Internet" https://www.schneier.com/blog/archives/2016/09/someone_is_le... Edit: And to be clear: I don't mean to imply there's any connection :)

>We don't know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses. Why not the USA?

From the context of the paper, because the USA could just send a three-letter-agency agent of some sort to Dyn, a US-based company, and ask what their infrastructure looks like? (Presuming of course some weird scenario where they weren't already tracking it, which seems unlikely.)

Re: DDoS Attack Against Dyn Managed DNS

#457

Post by a3n »

amalcon wrote: post #55
curiousgal wrote: post #31

Earlier quoted context omitted.

>We don't know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses. Why not the USA?

It doesn't make a whole lot of sense for the USA to take down the internet, as they benefit the most from it. A significant fraction of that economy is based on it, much larger than in the cases of China and Russia. It would be like the owner of a coal mine campaigning for a carbon emissions tax: maybe there's something we don't know, but from the information we have it seems unlikely. Note that this wouldn't rule ou…

Total and absolute speculation follows: If the US wanted reliable take-down capability, they might want to test it first, and it would be least provocative if they tested here in the US.

As for the length of the "test," they might want to see how the US would react to such attacks in the future, and shake out anything critical. "Oh, these two agencies can't talk to each other. Good to know."

I hate the way modern times makes me look.

Re: DDoS Attack Against Dyn Managed DNS

#458

Post by Animats »

So who was prepared for this? Pornhub:

pornhub.com:

    Name Server: ns1.p44.dynect.net
    Name Server: ns2.p44.dynect.net
    Name Server: ns3.p44.dynect.net
    Name Server: ns4.p44.dynect.net
    Name Server: sdns3.ultradns.biz
    Name Server: sdns3.ultradns.com
    Name Server: sdns3.ultradns.net
    Name Server: sdns3.ultradns.org
ultradns.biz:

    Name Server: PDNS196.ULTRADNS.ORG
    Name Server: ARI.ALPHA.ARIDNS.NET.AU
    Name Server: ARI.BETA.ARIDNS.NET.AU
    Name Server: ARI.GAMMA.ARIDNS.NET.AU
    Name Server: ARI.DELTA.ARIDNS.NET.AU
    Name Server: PDNS196.ULTRADNS.NET
    Name Server: PDNS196.ULTRADNS.COM
    Name Server: PDNS196.ULTRADNS.BIZ
    Name Server: PDNS196.ULTRADNS.INFO
    Name Server: PDNS196.ULTRADNS.CO.UK

Re: DDoS Attack Against Dyn Managed DNS

#459

Post by harryh »

gmaslov wrote: post #273
Kalium wrote: post #249

Earlier quoted context omitted.

Historically, doing this has been a source of a truly awe-inspiring amount of pain.

Aw, don't leave us hanging like that. What problems did it cause?

Proper cache invalidation is one of the 2 hard problems of computer science (the other 2 being naming things and off by 1 errors).

Re: DDoS Attack Against Dyn Managed DNS

#460

Post by [deleted] »

warmwaffles wrote: post #450
kirizt wrote: post #431

Earlier quoted context omitted.

I appreciate the update, but your service has been unavailable for hours already. This is unacceptable for a service whose core value is to ensure that we know about any incidents.

You apparently don't understand DNS. DynDNS is a very reputable DNS provider that twitter and many others use. For someone to take them down requires a massive amount of effort. Running a redundant DNS provider is expensive as all hell.

[deleted]
Post reply on HN