DNS was designed so that you can have multiple operators for your authoritative name servers.
Who would have thought adding a spof to your infrastructure would ever be a problem?
DDoS Attack Against Dyn Managed DNS
611–620 of 721 posts
Re: DDoS Attack Against Dyn Managed DNS
#612Earlier quoted context omitted.
Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…
> Say Hello to World War III, everybody! Is this sabre rattling or the prelude to a global conflict? Surely at worst it will (continue to) be a proxy war between NATO and Russia in Syria and nothing more? What motive is there for Russia or NATO to engage in open warfare? I'm not sure that a slow and prolonged lead up to an open war would even be effective in this situation. Perhaps it should be "Say hello to Cold War…
I like this version number better :)
Re: DDoS Attack Against Dyn Managed DNS
#613Out of curiosity, why do caching DNS resolvers, such as the DNS resolver I run on my home network, not provide an option to retain last-known-good resolutions beyond the authority-provided time to live? In such a configuration, after the TTL expiration, the resolver would attempt to refresh from the authority/upstream provider, but if that attempt fails, the response would be a more graceful failure of returning a la…
HTTP has a good solution/proposal for this: the server can include a stale-on-error=someTimeInSeconds header in addition to the TTL and then every cache is allowed to continue serving stale data for the specified time while the origin is unreachable. Probably a good idea to include such a mechanism in DNS, too.
Re: DDoS Attack Against Dyn Managed DNS
#614Earlier quoted context omitted.
Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…
I just want to sell my software, why does everyone have to fight?! Thank you for these links. I'm trying not to get wrapped up in conspiracies but am increasingly worried by the mounting conflict. I'd love to hear a calm, reasoned response from someone more knowledgable than me on these topics.
I don't actually think this will lead to open conflict. My comment at the end was just saying that this is what a world war would probably look like now, and that this back and forth might continue for a while.
I'd like to hear from an expert as well, rather than rely on piecing news items together.
Re: DDoS Attack Against Dyn Managed DNS
#615I am confused. Are so many big websites using Dyn, or does Dyn have some special role in the DNS chain in the US?
They offer Anycast and have POPs around the globe. They also have some other nice features such as intelligent failover and extra GEO IP features. Things that you would otherwise have to build yourself.
They have been around a long time. For years they had a free product called DynDNS that would allow you get an A record for your dynamic IP at home.
Re: DDoS Attack Against Dyn Managed DNS
#616Earlier quoted context omitted.
We don't know yet, but the attack very easily could have been coming from a botnet of devices entirely inside the US. Geographic borders don't matter much at all for the Internet.
But even if it were, the creator of the botnet would first have to gain control and then issue a command, right? How would either of those things be possible from outside if there was no connection into the US?
Well, there's pretty much no way to impose the geographic borders of the US onto the Internet. Our networks here in the US are all global and integrated with other networks all around the world. The only places where this kind of geographic control is possible are countries like Iraq, Iran, China and others where the government controls all the ISPs. Countries with more freedom have a free flow of information and packets - and to me that is a very GOOD thing.
Re: DDoS Attack Against Dyn Managed DNS
#617Can someone explain why this is so bad? I think the internet handled the downtime of Dyn pretty great, not reaching github wasn't exactly pleasing, but i added the ip temporary to /etc/hosts and the problem was solved. Isn't the best strategy to accept that attacks will continue and systems may go down and design for resilience? If so this attack can serve as a warning and as a check that we can handle these types of…
You're assuming we'll build immunity fast enough. What if we don't?
Attacks at this scale can bring a significant part of Internet down. The economic affect can be just as bad as a war.
Re: DDoS Attack Against Dyn Managed DNS
#618Earlier quoted context omitted.
They sell premium services, have a large sales team, and are very aggressive. I get emails from them weekly discussing millisecond savings of their DNS solutions and the value increase in customers and sales. Squeaky wheels get grease and their sales team squeaks a lot.
Realistically they compete with Neustar which is shockingly expensive and has less features and is harder to use. I chose Dyn over Neustar (UltraDNS) when it was time to renew contracts because it was 60% cheaper, had a better latency, their support was great and the interfaces were clear. Not a fanboy or anything, I really don't like how aggressively they hound me now (even though I have nothing to do with DNS for m…
It seems that many people who have dealt with them have a story about their overly aggressive nature, me included. It's really a turn off.
Re: DDoS Attack Against Dyn Managed DNS
#619Earlier quoted context omitted.
Exactly. You can't know if it is still valid, so you might send clients to an IP that's now controlled by somebody else. Worst case, they know and set up a phishing site. DNS generally has been reliable enough that the trade-off is not worth it.
I like this idea. Grab a new elastic IP on AWS. Set up an EC2 listening on 80, maybe some other interesting ports, and see if anything juicy comes in. Or just respond with some canned SPAM or phishing attempt. Repeat.
I guarantee you'll get lots of weird traffic. We do all the time on our ELB-fronted app servers.
Re: DDoS Attack Against Dyn Managed DNS
#620Earlier quoted context omitted.
Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…
> - Finland (yes, Finland) is increasingly worried about Russia. They violated their air space, and they're questioning Finland's independence. Finland shares a long boarder with Russia. The Finns actually have still quite good relationship with Russia (better than other neighbors) and nobody's actually questioning Finland's independence. Baltic countries is a different story. Source: A Finn here.
It's good to know things are clam, I was just quoting the article. Not sure where they got that from
> Finland is becoming increasingly worried about what it sees as Russian propaganda against it, including Russian questioning about the legality of its 1917 independence