Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DDoS Attack Against Dyn Managed DNS

dynstatus.com

Post reply on HN
Print view View original

561–570 of 721 posts

Re: DDoS Attack Against Dyn Managed DNS

#561

Post by 67726e »

matwood wrote: post #528
AmrEldib wrote: post #371

Earlier quoted context omitted.

Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…

> - Russia's only air craft carrier is trespassing through UK waters to get to Syria in a show of force that doesn't really add anything to their military capabilities there. I read they were passing in international waters. Is that not the case? It's clearly a show of force, but no need for the hyperbole if it is not true.

Foreign vessels are allowed to transit through another nations waters. This happens regularly and is not in any way noteworthy.

Re: DDoS Attack Against Dyn Managed DNS

#562

Post by komali2 »

pjlegato wrote: post #477
saltyhiker wrote: post #454

Earlier quoted context omitted.

Given that a large swath of SaaS services, infrastructure providers, and major sites across the internet are impacted, this seems harsh. Are you unhappy with PagerDuty's choice of DNS provider, or something else they have control over? I don't think anyone saw this particular problem coming.

A company that bills themselves as a reliable, highly available disaster handling tool ought to know better than to have a single point of failure anywhere in its infrastructure. Specifically, they shouldn't have all of their DNS hosted with one company. That is a major design flaw for a disaster-handling tool.

I'm not using the service, but I'm curious what an acceptable threshold for this company is. Like, if half the DNS servers are attacked? If hostile actors sever fiber optic lines in the Pacific?

I ask because my secondary question, as a network noob, is was anybody prepared / preparing for a DDOS on a DNS like this? Were people talking about this before? I live in Mountain View so I've been thinking today about the steps I and my company could take in case something horrifying happens - I remember reading on reddit years ago about local internets, wifi nets, etc, and would love to start building some fail safes with this in mind.

Two pronged comment, sorry.

Re: DDoS Attack Against Dyn Managed DNS

#563

Post by eridius »

Zancarius wrote: post #252
omni wrote: post #202

Earlier quoted context omitted.

> wouldn't hesitate to take down dns to the entire internet to avoid another similar data leak to the Snowden dump. I don't understand how this would change anything unless you're assuming they would take down the Internet permanently

I'm probably wrong, but this is how I see it (not sure about the OP). News cycles happen fairly rapidly, so if you could take down a number of sites that might be friendly to the dissemination of potentially damaging information just long enough such that it's forgotten about, or the attack is so large the media talks about the attack instead, then you might be able to successfully avoid widespread public knowledge o…

If you take them offline before they've managed to disseminate the info, then it can't be forgotten because nobody knew about it in the first place. Which means when the sites come back on, the info is still newsworthy.

Re: DDoS Attack Against Dyn Managed DNS

#564

Post by LeanderK »

Can someone explain why this is so bad? I think the internet handled the downtime of Dyn pretty great, not reaching github wasn't exactly pleasing, but i added the ip temporary to /etc/hosts and the problem was solved. Isn't the best strategy to accept that attacks will continue and systems may go down and design for resilience? If so this attack can serve as a warning and as a check that we can handle these types of attacks. I am a bit exaggerating, but i would imagine that constant attacks keep the internet resilient and healthy. An unchallenged internet may be the greater risk.

Re: DDoS Attack Against Dyn Managed DNS

#565

Post by eridius »

leesalminen wrote: post #430
AmrEldib wrote: post #371

Earlier quoted context omitted.

Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…

> US election is in 3 weeks and Donald Trump is openly in love with Putin. He states that he's never met Putin nor has any holdings in Russia. He has stated that he is open to positive relationships with the Russian government. > Trump questioned the benefit of NATO which is the basis for Europe stability after the 2nd world war. I believe he stated that he wants NATO to "pay their fare share" in the costs of maintai…

Trump says he never met Putin, now. In the past, he said he did. I just did a search for "trump met putin" and found a bunch of news sites reporting that in a GOP debate a while ago Trump said

“I got to know him very well because we were both on ‘60 Minutes,’ we were stablemates, and we did very well that night.”

Re: DDoS Attack Against Dyn Managed DNS

#566

Post by davidu »

conatico wrote: post #408
davidu wrote: post #255

Earlier quoted context omitted.

OpenDNS does this: https://support.opendns.com/hc/en-us/articles/227987767-Dyna... It's called SmartCache.

A shame OpenDNS used to redirect me to some spam webpage every time I tried to resolve a domain that didn't exist--they earned a spot on my black list forever. :(

It's been years since we did that, and they were not spam pages, and easily able to opt-out.

Re: DDoS Attack Against Dyn Managed DNS

#568

Post by steveklabnik »

Animats wrote: post #434

Github is currently inaccessible. Can you still compile Rust programs that depend on Github files?

First of all, the only thing that'd matter is for modifying your dependencies at the moment. If you've previously built the project, and don't touch your deps, GitHub won't be hit.

Second, Cargo only depends on GitHub for the index. For more: http://integer32.com/2016/10/08/bare-minimum-crates-io-mirro...

That includes a link to a mirror run by integer32.

Re: DDoS Attack Against Dyn Managed DNS

#569

Post by justinlardinois »

davidu wrote: post #566
conatico wrote: post #408

Earlier quoted context omitted.

A shame OpenDNS used to redirect me to some spam webpage every time I tried to resolve a domain that didn't exist--they earned a spot on my black list forever. :(

It's been years since we did that, and they were not spam pages, and easily able to opt-out.

That is not an appropriate tone for someone representing OpenDNS to take.

Re: DDoS Attack Against Dyn Managed DNS

#570

Post by Kalium »

bluejekyll wrote: post #259
bhauer wrote: post #214

Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a la…

I've been thinking of adding this exact feature to my DNS framework that I've been working on (if github was resolving): https://github.com/bluejekyll/trust-dns If you have any feedback, I'd love to hear it.

To be perfectly honest, a "feature" like this has no business being in a safe and secure DNS server. You should fail-safe, rather than serving stale data of unknown safety.

Serving data you cannot verify is a dangerous failure state.

Post reply on HN