Journalist and security researcher Brian Krebs believes this is someone doing a DDoS as payback for research into questionable "DDoS mitigation services" that he and Dyn's Doug Madory did. Doug just presented his results yesterday at NANOG and Krebs believes this is payback. Read more: https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twit...
DDoS Attack Against Dyn Managed DNS
621–630 of 721 posts
Re: DDoS Attack Against Dyn Managed DNS
#622I'm wondering, from a regulatory perspective, what might be done to mitigate DDoS attacks in the future? From comments made on this and other similar posts in the past, I've gathered the following: 1) Malicious traffic often uses a spoofed IP address, which is detectable by ISPs. What if ISPs were not allowed to forward such traffic? 2) There is no way for a service to exert back pressure. What if there was? e.g. sen…
Regarding point 2, I can think of a few ways to utilize that mechanism itself as a way to DDoS something. Sometimes the security mechanisms themselves are the attack vectors.
Re: DDoS Attack Against Dyn Managed DNS
#623I wanted to provide an update on the PagerDuty service. At this time we have been able to restore the service by migrating to our secondary DNS provider. If you are still experiencing issues reaching any pagerduty.com addresses, please flush your DNS cache. This should restore your access to the service. We are actively monitoring our service and are working to resolve any outstanding issues. We sincerely apologize f…
I had the privilege of being on-call during this entire fiasco today and I have to say I was really really disappointed. It's surprising how broken your entire service was when DNS went down. I couldn't acknowledge anything, and my secondary on-call was getting paged because it looked like I wasn't trying to respond. I was getting phone calls for alerts that wasn't even showing up on the web client, etc. Overall, it…
Hopefully you have a nice SLA with them.
Re: DDoS Attack Against Dyn Managed DNS
#624Earlier quoted context omitted.
Withing a small hosting provider this might be pretty simple. Attacker might lease a bunch of new servers and get the IP that was recently released. Then they could launch a DDoS to force address resolution in their favor. It's a bit far-fetched, but a lot of very successful attacks seem that way until someone figures out a way to pull them off.
Sure, within a small host or ISP, that may be doable; even then, I'd consider it a stretch. But if we were to limit it to those constraints, when will this ever be exploited except as a PoC? No entity large enough to actually want to run this exploit on has an architecture where this would be feasible (due to things like geodistribution and load balancing), nor would be hosted on a provider so small that their IP poo…
How about DNS cache poisoning? Serving stale data combined with a DDoS on the root resolver makes DNS cache poisoning more dangerous by prolonging it.
Re: DDoS Attack Against Dyn Managed DNS
#625[deleted]
Re: DDoS Attack Against Dyn Managed DNS
#626Earlier quoted context omitted.
No tool is silly as long as it does the job adequately. Are paperclips silly for a billion-dollar company? If both Dyn and R53 go down, it's exactly when you want a service like PagerDuty work without a hitch.
You're asserting that your (or their) homegrown DNS service will have better reliability than Dyn and Route53 combined . That assertion gets even worse when it's a backup because people never, ever test backups. And "ready to go" means an extremely low TTL on NS records if you need to change them (which, for a hidden backup, you will), and many resolvers ignore that when it suits them, so have fun getting back to 100…
Idea: Chaos Monkey for DNS outages
Re: DDoS Attack Against Dyn Managed DNS
#627I'm wondering, from a regulatory perspective, what might be done to mitigate DDoS attacks in the future? From comments made on this and other similar posts in the past, I've gathered the following: 1) Malicious traffic often uses a spoofed IP address, which is detectable by ISPs. What if ISPs were not allowed to forward such traffic? 2) There is no way for a service to exert back pressure. What if there was? e.g. sen…
> What if IoT devices were required to continually pass some sort of a health check to make other HTTP requests?
Even better, what if IoT devices were required to pass some health check to operate at all. This could be as simple as a verified boot plus a forcible reboot every now and then.
Re: DDoS Attack Against Dyn Managed DNS
#628Earlier quoted context omitted.
Let's try to put this DDoS attack in some context aside from the technical part. As @scrollaway mentioned, 6 weeks ago, Bruce Schneier posted that several companies told him that they're detecting attempts to probe their networks and find ways to bring it down https://www.schneier.com/blog/archives/2016/09/someone_is_le... Now let's look at the progress of events: - Hillary Clinton's personal email server was hacked…
I just want to sell my software, why does everyone have to fight?! Thank you for these links. I'm trying not to get wrapped up in conspiracies but am increasingly worried by the mounting conflict. I'd love to hear a calm, reasoned response from someone more knowledgable than me on these topics.
The global powers are negotiating with themselves, and consolidating state power at home. Proxy wars for the former, and fear mongering at home for the latter.
The players are the 0.001% who control these states and the rest (we) are the captive (and propagandized) audience. They are being super kind as to at least make it entertaining for us.
Re: DDoS Attack Against Dyn Managed DNS
#629Earlier quoted context omitted.
That was exactly my thought. This may be unrelated, or it may be a test run. But a large scale attack on Election Day that crippled communications would stir up unrest for a variety of reasons. Although I think that's highly unlikely to change the outcome, unrest after such a contentious election is not good.
If this is a test run, this is an amazing early warning for Twitter and the like to immediately start working on contingency plans for election day.
Gives them time to test the countermeasures before 11/8
Re: DDoS Attack Against Dyn Managed DNS
#630I'm a GitHub employee and want to let everyone know we're aware of the problems this incident is causing and are actively working to mitigate the impact. "A global event is affecting an upstream DNS provider. GitHub services may be intermittently available at this time." is the content from our latest status update on Twitter ( https://twitter.com/githubstatus/status/789452827269664769 ). Reposted here since some peo…
This is what you can do to restore your GitHub access: grep github ~/.ssh/known_hosts sudo vim /etc/hosts sudo killall -HUP mDNSResponder ping github.com
seems like the right thing to do.
however the ip address itself won't respond either